Tomorrow, 10 November 2026, is Patch Tuesday. For most Windows 11 PCs that means another round of updates. For PCs still on Windows 11 version 23H2 Enterprise or Education, it means the last one. After that, Microsoft stops sending security fixes to that version.
Home and Pro editions of 23H2 already lost updates a year ago, on 11 November 2025. Enterprise and Education got an extra year, and that year is now up. In offices and schools I still come across machines that have quietly stayed on old versions because an update policy was set years ago and nobody looked again. Here's how to find them and move them on.
Quick answer
Windows 11 23H2 Enterprise, Education and IoT Enterprise get their final security update on 10 November 2026. Check with winver: build 22631 is 23H2. Move those PCs to a supported version. Windows 11 26H2 (the 2026 Update) is the newest, and installing it gives Enterprise and Education 36 months of support. Coming from 23H2, it's a full feature update, so plan time and back up first.
Which versions are affected
| Windows 11 version | Build | Status |
|---|---|---|
| 23H2 Home and Pro | 22631 | Ended 11 November 2025 |
| 23H2 Enterprise, Education, IoT Enterprise | 22631 | Last update 10 November 2026 |
| 24H2 | 26100 | Supported |
| 25H2 | 26200 | Supported |
| 26H2 (2026 Update) | 26300 | Newest, rolling out since late September 2026 |
| 26H1 | 28000 | Supported, but can't move to 26H2 |
The dates come from Microsoft's Windows 11 23H2 release health page, which says Enterprise and Education keep getting monthly security updates until 10 November 2026.
What "end of updates" really means
The PC won't stop working tomorrow. It will boot, run apps and connect to the internet like before. What stops is the monthly security fix. Every bug found after November stays open on that machine for good.
That matters more this year than it used to. Vendors are finding and fixing bugs faster, partly because of AI-assisted testing, and attackers use the same tools to work out what each patch fixed. An unpatched PC falls behind faster than it would have a few years ago.
How to check which version a PC is on
On one machine, press Win + R, type winver and press Enter. The box shows the version and build. Build 22631 means 23H2.
For a quick check from PowerShell, including the edition:
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' |
Select-Object EditionID, DisplayVersion, CurrentBuildA small trap: the ProductName value in that same registry key still says "Windows 10" on many Windows 11 PCs. Don't trust it. Go by the build number.
To check several machines at once, run it remotely (this needs PowerShell remoting turned on):
$pcs = 'PC-ACCOUNTS-01','PC-HR-02','PC-LAB-03'
Invoke-Command -ComputerName $pcs -ScriptBlock {
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' |
Select-Object EditionID, DisplayVersion, CurrentBuild
} | Format-Table PSComputerName, EditionID, DisplayVersion, CurrentBuildIf you manage PCs with Intune, the device list can show the OS version as a column, and you can filter on it. I covered more PowerShell basics like this in how to automate Windows admin tasks with PowerShell.
Which version to move to
I'd go straight to 26H2, the Windows 11 2026 Update. According to BleepingComputer's coverage of Microsoft's release, installing it resets the support clock: 24 months for Home and Pro, 36 months for Enterprise and Education. Going to 24H2 or 25H2 instead just means doing this again sooner.
One thing to know before you plan: 24H2, 25H2 and 26H2 share a newer code base than 23H2. For a PC already on 24H2 or 25H2, 26H2 arrives as a small enablement package and installs like a normal monthly update. A PC on 23H2 doesn't get that shortcut. It needs the full feature update, which is a bigger download and a longer install with a couple of restarts.
The odd one out is 26H1. It shipped on certain new devices, and Microsoft says PCs on 26H1 can't update to 26H2. They'll get a path to a later release instead. If you have new laptops on 26H1, leave them where they are.
How to upgrade without surprises
- Check the hardware still qualifies. Anything that ran 23H2 normally meets the Windows 11 requirements, but run PC Health Check on older or unusual models.
- Back up first. User files to OneDrive or a file server, and a restore point on each machine for a quick way back.
- Test a few PCs first. One from each department or model, with the apps people actually use. Old printer drivers and VPN clients are the usual trouble.
- Use your management tool. In Intune, create a Feature updates for Windows policy targeting the new version. With WSUS, approve the feature update for the right group. Standalone PCs can use Settings > Windows Update.
- Check BitLocker recovery keys are saved in Entra ID or Active Directory before you start, in case a PC asks for one after the upgrade.
- Run it outside working hours. A full feature update can take an hour or more on slower machines.
If Intune devices don't pick up the policy, forcing a sync usually helps. I wrote that up in how to force an Intune sync on Windows.
What else is coming on 10 November
It's a busy Patch Tuesday. Supported versions get the November security update. A preview of the next non-security update has been in testing with a customizable File Explorer right-click menu and better recovery options, though features in previews don't always land on schedule. Fortinet has also said it will publish the details of the critical firewall flaws it fixed in October on the same day. If you look after both Windows PCs and firewalls, block out some time this week.
A few things I've learned from upgrades like this
- The PCs that get missed are the ones nobody uses daily. Reception PCs, lab machines, a spare laptop in a drawer. Check the full device list, not just the ones that show up in tickets.
- Old deferral policies are the usual cause. A Group Policy or Intune setting that pinned a target version years ago will keep a PC on 23H2 forever. Look for "Select the target Feature Update version".
- Don't upgrade on a Friday afternoon. If something goes wrong, you want a working day to fix it.
If your office needs a hand getting every PC onto a supported version, or setting up update policies so this doesn't happen again, that's something I do as part of my IT services.
Frequently asked questions
When does Windows 11 23H2 Enterprise stop getting updates?
Windows 11 version 23H2 Enterprise, Education and IoT Enterprise get their final monthly security update on 10 November 2026. Home and Pro editions of 23H2 stopped getting updates on 11 November 2025.
How do I know if my PC is on Windows 11 23H2?
Press Win + R, type winver and press Enter. Version 23H2 shows OS build 22631. In PowerShell, check DisplayVersion and CurrentBuild under the Windows NT CurrentVersion registry key.
Will my PC stop working after Windows 11 23H2 end of support?
No. It keeps working, but it no longer receives security updates, so any new vulnerability stays unpatched. Upgrade to a supported version such as 26H2.
Can I upgrade from Windows 11 23H2 directly to 26H2?
Yes, but from 23H2 it is a full feature update, not the small enablement package that 24H2 and 25H2 PCs get. Allow more time and back up first. Installing 26H2 gives Enterprise and Education 36 months of support.
Can Windows 11 26H1 update to 26H2?
No. Microsoft says devices on version 26H1 cannot update to 26H2. They will get a path to a future Windows release instead.