Windows 11 23H2 Enterprise Support Ends November 2026: Upgrade to 25H2 or 26H2

The deadline​

Microsoft's release health dashboard says Windows 11, version 23H2 Enterprise and Education editions will reach end of updates on November 10, 2026. After this date, devices running these editions will no longer receive monthly security updates containing protections from the latest security threats.

That date falls on November's Patch Tuesday, so the November 2026 cumulative update is the final one. The Message Center wording BleepingComputer quoted also shows up in an earlier notice. In that notice, Microsoft wrote that "The November 2026 Windows security update will be the last update available for these editions."

Microsoft's IoT Enterprise release history gives Windows 11 IoT Enterprise version 23H2 (build 22631) the same end date of November 10, 2026. The Windows 11 release information table lists Enterprise multi-session alongside Enterprise, Education and IoT Enterprise in the affected column, so pooled virtual desktops are covered too.

The November 10 vs. November 11 question​

Microsoft's lifecycle page for Windows 11 Enterprise and Education gives a slightly different end date. As WindowsForum noted in earlier coverage, it lists version 23H2 with an end timestamp of November 11, 2026 at 6:59:59 AM Pacific Time, which differs from the November 10 date used in the Message Center and release-information pages. The lifecycle page says its dates are in Pacific Time.

In practice, both dates point to the same thing: November Patch Tuesday is the last scheduled update. Nobody should plan around the extra few hours. If your migration plan depends on that gap, the migration is already late.

Section summary: The November 2026 Patch Tuesday release is the last update for 23H2 Enterprise, Education, IoT Enterprise and Enterprise multi-session.

Who is not affected​

• Home and Pro users: Microsoft says Windows 11, version 23H2, Home and Pro editions reached end of updates on November 11, 2025. If you're running a consumer edition of 23H2 today, your PC has already gone a year without patches.
• IoT Enterprise LTSC: Microsoft lists Windows 11 IoT Enterprise LTSC 2024 as a separate product under the Fixed Lifecycle Policy, with servicing through October 10, 2034. Kiosks and fixed-function devices on that LTSC release aren't affected by this deadline. Only the General Availability Channel IoT Enterprise 23H2 release is.
• Newer Windows 11 versions: Each release has its own dates. As one summary of Microsoft's policy puts it, Windows 11 Enterprise and Education editions get 36 months of updates for each annual feature update; Home and Pro editions get 24 months. Version 23H2 shipped on October 31, 2023, so November 2026 is the end of its 36 months.

Should you upgrade to 25H2 or 26H2?​

BleepingComputer's coverage tells users to move to Windows 11 26H2, the Windows 11 2026 Update. Microsoft's own 23H2 reminder from earlier in the countdown named a different target. It said that to keep getting updates, we recommend updating eligible devices running Windows 11, version 23H2 Enterprise and Education editions to Windows 11, version 25H2. It also said Windows 11, version 25H2 Enterprise and Education editions will continue to receive updates until October 11, 2028.

That difference makes sense. The reminder went out before 26H2 shipped on September 29, 2026. Microsoft's current wording on the 23H2 status page just recommends a "supported version," and both releases qualify.

A note on BleepingComputer's statement that 26H2 support ends for consumers in October 2029: Microsoft's lifecycle and IoT pages give October 9, 2029 for the Enterprise, Education and IoT Enterprise editions. Under the 24-month policy above, Home and Pro editions of a given release get a shorter window, so check the edition before you put the 2029 date in a planning spreadsheet.

Microsoft's lifecycle page also says 26H2 is the last version that will support devices with Snapdragon 850 processors. That's worth knowing if you still have early Arm laptops in the fleet.

Section summary: Both 25H2 and 26H2 are valid targets. 26H2 buys an extra year of support, and 25H2 has a longer track record.

The enablement package won't help 23H2​

This is where the "quick update" message can mislead people. Microsoft's IT pro documentation says 26H2 arrives through a small enablement package for eligible devices running 24H2 or 25H2, because those three versions share a common servicing branch. In its status notes, Microsoft says 26H2 is rolling out in phases to eligible 24H2 and 25H2 devices, and that on those machines a single restart finishes the install.

Version 23H2 isn't on that branch. Microsoft's release tables show 23H2 on build 22631, while 24H2, 25H2 and 26H2 are on the 26100, 26200 and 26300 builds. Our reading of Microsoft's documentation, not an explicit Microsoft statement, is that a 23H2 machine needs a full feature update rather than the one-restart eKB. Budget accordingly: longer installs, bigger downloads, more compatibility testing and a real rollback plan.

A practical 30-day checklist​

1. Inventory by edition and channel. One planning guide from i3solutions recommends you list every 23H2 device by edition and by the channel that updates it today: WSUS, Configuration Manager, Intune or Windows Autopatch. Look for build 22631 in your reports.
2. Pick the target per device group. Use 25H2 for conservative or regulated rings and 26H2 where the extra year of support is worth adopting a brand-new release.
3. Check feature update policies. If you use deferral or target-version policies, make sure they allow the version you picked. Otherwise the device will stay on 23H2.
4. Test against current 26H2 known issues. Microsoft's 26H2 status page lists several:
   • Credential Guard–protected domain machines that lose their domain trust when Machine Identity Isolation enforcement was configured without Windows Server 2025 domain controllers. Microsoft says this is resolved by the September 22, 2026 update (KB5124010) and later updates.
   • Black screens after sign-in, seen mainly on Azure Virtual Desktop hosts using FSLogix. Microsoft offers a Known Issue Rollback for this.
   • Some older apps that rely on Windows' built-in AC-3 (Dolby Digital) decoding crashing after KB5124010. A fix is still pending.
5. For unmanaged or lightly managed PCs, Microsoft's status page says you can go to Settings > Windows Update and select Check for updates. If your device is ready for the update, you'll see the option to Download and install. Microsoft's support documentation says the "Get the latest updates as soon as they're available" toggle only changes how quickly non-security and feature updates arrive. Security updates come either way. On managed devices, administrators control that toggle through policy.
6. Install the November 2026 update anyway. It's the final patch for 23H2, and any machine that misses the migration window should at least be fully patched.

What happens if you miss the deadline?​

Nothing dramatic happens right away. As Windows Report put it, this does not mean Windows 11 23H2 will suddenly stop working on November 10. The PCs keep running, but every vulnerability fixed after November's Patch Tuesday stays open on them for good. Over months, that adds up to a real risk for exactly the kinds of machines these editions run on: school labs, hospital workstations and retail terminals.

It's also not the last date of this kind. Microsoft's lifecycle table lists 24H2 Enterprise and Education support ending in October 2027. Teams that move 23H2 machines to 24H2 now are setting up the same project for next year, which is one more reason to go straight to 25H2 or 26H2.

Bottom line: You have about four weeks and one Patch Tuesday left. Find your build 22631 machines, choose 25H2 or 26H2, plan for a full feature update instead of an enablement package, and check the 26H2 known issues list before you deploy widely.