Windows 11 23H2 Enterprise and Education: Security Updates End Today

Published 10 November 2026 · Rathish Kumar, Invitty

Today, 10 November 2026, is the last day Microsoft lists for security updates to Windows 11 version 23H2 in its Enterprise, Education and Enterprise multi-session editions. From December's Patch Tuesday onwards, a PC still on 23H2 with one of those editions will stop receiving the monthly fixes. The Home and Pro editions of 23H2 already passed this point on 11 November 2025, so if your business PCs run Pro, they should have moved on a year ago.

This is not a hardware crisis like the Windows 10 deadline last year. Microsoft's advice is to move eligible 23H2 devices to a supported version of Windows 11, so for most PCs the fix is a feature update, not a new laptop. The work is in finding the stragglers and making sure the update does not break the applications your staff rely on.

Who this actually affects in India

The Enterprise and Education editions are the ones that matter here. They are typically found in three kinds of Indian organisations:

• Companies with Windows Enterprise E3 or E5 user subscriptions, bought on their own or inside a Microsoft 365 bundle, where Pro devices were stepped up to Enterprise through subscription activation.
• Schools, colleges and universities using Education editions through Microsoft's academic licensing.
• Firms that deliberately hold feature updates back through Intune, Group Policy or WSUS so that accounting, ERP, banking-token or industrial software is not disturbed.

The third group is where 23H2 devices tend to linger. A deferral policy set two years ago "until the ERP vendor certifies the next version" is easy to forget, and nothing visibly breaks on the day support ends. The device simply stops getting patched.

Find the 23H2 machines first

Before deciding anything, get an accurate count. Depending on how you manage devices:

• Intune: filter the device list by OS version and export it, then check each feature update or update ring policy for a target version or deferral that pins devices to 23H2.
• WSUS or Configuration Manager: report on operating system version and review which feature updates have been approved or declined.
• No central management: run winver on each PC or ask your IT partner for an asset report. Small offices are often surprised by the one reception PC or factory-floor system nobody remembered.

Record the edition as well as the version. A 23H2 Pro machine has been out of support for a year and is a higher priority than a 23H2 Enterprise machine that dropped off today.

Choosing the version to move to

Microsoft's lifecycle page for Windows 11 Enterprise and Education lists these servicing windows for the versions still in support:

The page also lists a 26H1 release with its own dates. Microsoft displays these dates in Pacific Time, so check the page itself for exact cut-off times.

Moving to 24H2 buys less than a year before you repeat this exercise. For most businesses the sensible targets are 25H2, which has been in the field for over a year and is likely to be supported by your line-of-business vendors, or 26H2 if your software suppliers have already confirmed compatibility and you want the longest runway. Pick one version for the whole fleet where possible; mixed versions make troubleshooting and patch reporting harder.

One niche point from Microsoft's lifecycle notes: 26H2 is the final version that will support devices built on the Snapdragon 850 processor. If you still have early Arm-based Windows laptops, plan their replacement alongside this upgrade.

Test what usually breaks

Feature updates rarely fail on the operating system itself. The problems come from the software around it. Before a broad rollout, put a small pilot group on the target version for a week and check:

• accounting and ERP clients, and anything that prints to a specific driver or label printer;
• digital signature tokens and banking utilities used by finance teams;
• your endpoint security agent, VPN client and any data-loss or device-control tools, confirming the installed versions officially support the target Windows release;
• scanners, biometric attendance readers and other USB peripherals;
• remote-support tools your IT partner uses.

If you use Intune, its feature update device readiness and compatibility risk reports give a per-device view of likely problems for a chosen target version, which is a quicker starting point than guessing. Keep the pilot group mixed: someone from finance, someone from operations and a manager who travels. If the pilot is clean, widen to the rest of the fleet in two or three waves rather than all at once.

If you cannot upgrade every device this month

Microsoft's release health page for 23H2 recommends moving eligible devices to a supported version and does not describe a paid extension for this release. Do not plan around one unless Microsoft confirms it for your agreement. If a handful of PCs must stay on 23H2 for a few weeks while a vendor catches up, reduce their exposure: keep them off the internet where the job allows, make sure your endpoint protection is current and reporting, remove local administrator rights, and put a dated exception in your risk register with an owner. That record matters when an auditor or a customer security questionnaire asks why an unsupported operating system is on the network.

The licensing angle

Feature updates do not cost anything extra, but this is a good moment to confirm that the devices running Enterprise still have the licence that entitles them to it. If a Microsoft 365 E3 or Windows Enterprise subscription was reduced at renewal while the number of Enterprise PCs stayed the same, the gap is better found by you than in a licence review. Match your device count against the subscription count in the Microsoft 365 admin centre while you have the inventory open.

Common questions about the 23H2 deadline

Next step

If you would like a second pair of eyes, share your device export (or ask us to pull one with your consent) and we will flag every 23H2 machine, the update policy holding it back, and a suggested target version. Our Microsoft 365 licensing page covers the subscription side, and our device management page explains how update rings are set up so this does not recur. You can also see the wider Microsoft portfolio we support.