Windows 11 26H2 vs 25H2: Enablement Package, New Defaults and Support Dates

Same platform, new version number​

Microsoft calls 26H2 the next annual feature update and says it builds on the same servicing foundation as Windows 11, versions 25H2 and 24H2, helping organizations adopt the latest release with minimal disruption. Devices running eligible versions of Windows 11 can move to version 26H2 through a small enablement package rather than a full operating system upgrade. TechRepublic, citing Windows Central, adds that both releases run on Microsoft's "Germanium" platform with no major change to the core OS between them.

The Windows Experience Blog explains how this works. An enablement package is a lightweight update that activates new features already included in the operating system through previous monthly servicing updates. Because versions 26H2, 25H2, and 24H2 share a common servicing branch and underlying codebase, many of the components required for version 26H2 are already present on devices before the feature update becomes available.

Here are the practical details:

• The package: According to Pureinfotech, the retail enablement package is KB5121794, available as .msu files for both X64 and ARM64.
• Prerequisite: In a companion piece, TechRepublic reports that systems must already have the Sept. 22 KB5124010 preview update or a later cumulative update installed.
• Restarts: Microsoft promises fast installation with a single restart in most scenarios and reduced validation effort because supported versions share the same underlying platform.
• Build numbers: 26H2 uses OS build 26300 and 25H2 uses 26200. Microsoft's release-information page shows both received the October 13, 2026 update under the same KB number, KB5127648: build 26300.9711 on 26H2 and 26200.9711 on 25H2. One cumulative update number covering both builds shows how much the two releases share.
• Older versions: gHacks, also citing Windows Central, notes that older versions, including Windows 11 version 23H2 and Windows 10, will require a full feature update instead. It also reports that upgrading from an ISO or other Microsoft installation media will perform a full in-place upgrade even on devices running version 25H2 or 24H2. If you deploy from images, keep that in mind.

Section summary: If you're on 25H2 with current updates, most of 26H2's code is already on your disk. KB5121794 turns it on and changes the version number.

What 26H2 turns on by default​

Version 26H2 doesn't add much new code, but it does change some defaults. The Windows IT Pro Blog says some features that were behind temporary commercial control in Windows 11, version 25H2 are now enabled by default in version 26H2. Microsoft names three on its IT-pro "What's new" page:

1. Windows settings backup: on by default for eligible commercial devices. It saves supported Windows settings and Microsoft Store app lists for recovery and device replacement. Microsoft says policies administrators have already set still apply.
2. App-specific taskbar actions: on by default for commercial devices, so users can run common app actions straight from the taskbar.
3. Selected File Explorer improvements: navigation and usability changes that were held back by temporary commercial controls are now on by default.

This is where coverage of the release tends to over-simplify. Windows Central's "no new features" framing, as relayed by gHacks, is accurate if you mean new code. It misses the defaults that change on managed fleets. If your organization never set a policy for settings backup, users may notice changed behavior after the switch, even though no new code arrived. Check your Intune and Group Policy settings before the pilot, not after.

Features delivered since 25H2 (mostly not exclusive)​

Microsoft's IT-pro documentation lists features delivered since 25H2. It also notes that some of them already included in the operating system through previous monthly servicing updates may already be present on 25H2 machines. Availability also depends on hardware, licensing and configuration. Here are the highlights by category.

Security and sign-in​

• Administrator protection: replaces standing admin rights with just-in-time elevation and adds profile separation. It's off by default and can be turned on through Intune or Group Policy.
• Built-in Sysmon: System Monitor is now part of Windows. It accepts custom configuration files and writes captured events to Windows Event Log. It's also off by default.
• Smart App Control: can now be switched on or off without a clean install of Windows.
• Passkeys: Windows supports third-party credential managers as passkey plugins, and you can set a PIN for a security key during sign-in.
• Windows Hello Enhanced Sign-in Security: now works with compatible external fingerprint readers, not just built-in ones.
• Post-quantum cryptography: APIs for ML-KEM and ML-DSA (FIPS 203 and FIPS 204), available through CNG and .NET.
• Driver trust change: Windows no longer trusts cross-signed third-party drivers by default. Drivers from the Windows Hardware Compatibility Program and an allow list of trusted legacy drivers still load. Microsoft says Windows audits driver compatibility for at least 100 hours and three restarts before it starts enforcing the rule. If your fleet runs old scanner, lab-equipment or line-of-business drivers, your pilot needs to run at least that long. A one-afternoon smoke test won't catch a problem that only appears once enforcement begins.

Deployment, management and recovery​

• Autopilot device association: for Autopilot device preparation. It identifies trusted devices before enrollment, which allows device-targeted policies and automatic corporate enrollment.
• Settings restore at first sign-in: now works on Microsoft Entra hybrid-joined devices, Cloud PCs and multi-user environments. Enterprise State Roaming can also be managed through Windows settings backup policies.
• Point-in-time restore: rolls a PC back to a recent automatic restore point, including apps, settings and personal files.
• Quick machine recovery: can run a one-time remediation scan. It stays off on domain-joined or enterprise-managed devices unless you turn it on.
• Removing preinstalled apps by policy: administrators can list additional MSIX or APPX packages to remove by package family name through Group Policy.

Everyday use and admin tools​

• File Explorer: a faster Home view; View and Sort settings preserved in folders like Downloads and Documents; voice typing when renaming files; and support for uu, cpio, xar and nupkg archives. The Copilot Summarize action for OneDrive and SharePoint files requires a Microsoft 365 subscription and a Copilot license.
• Search, Start and taskbar: search previews and better handling of typos in app names; a redesigned, scrollable Start menu; and a taskbar that can sit on any edge of the screen, with a smaller size option.
• Bluetooth and USB: better reliability for Bluetooth LE Audio and for USB4 docks when devices wake from standby.
• Windows Update: fewer restarts, because eligible updates are installed together with the monthly security update when possible.
• Task Manager: optional NPU columns, plus an Isolation column that shows which apps are running in an AppContainer.
• Batch file hardening: an optional, more secure mode that stops batch files from being changed while they run, configurable by administrators and Application Control for Business policy authors.
• WMIC removed: Microsoft says WMIC is gone from 24H2 and later and is no longer available as a Feature on Demand. If old scripts still call wmic, now is the time to rewrite them for PowerShell CIM cmdlets.

Section summary: The security and management features matter most, but the two most powerful, Sysmon and Administrator protection, stay off until you turn them on. Installing 26H2 doesn't harden anything by itself.

The support runway​

The support clock is the main reason to move. According to Microsoft's release-information table, end-of-updates dates are:

Windows Latest published a similar table with dates one day earlier, such as October 12, 2027 for 25H2 Home and Pro, but differing on 26H2 and on the Enterprise column. Microsoft's lifecycle page lists end times in early-morning Pacific Time. Go by Microsoft's own table, and use the column for your edition. Using Home/Pro dates for an Enterprise fleet would make you think you have a year less than you actually do.

Microsoft's lifecycle page has two more notes. 26H2 is the last version that will support devices with Snapdragon 850 processors, which matters if you still have first-generation Arm laptops. It also confirms that 24H2 was the final version supported on Windows 11 SE.

The 26H1 exception​

Windows 11 26H1 is the exception. Microsoft's release-information page says 26H1 is limited to new devices that began shipping in early 2026, and it isn't offered as an in-place update from 24H2 or 25H2. TechRepublic reports that 26H1 devices are excluded because they use a different Windows core. They run OS build 28000 and get their own cumulative updates. TechRepublic also says Microsoft will provide an update path in a future release, but Microsoft's release-information page doesn't describe that route. Track 26H1 machines as their own group in your inventory.

Should you move now? A practical playbook​

TechRepublic's advice is sensible: a small, fast install doesn't justify a fast rollout. Here's an order of operations based on Microsoft's documentation:

1. Inventory. Check each device's version under Settings > System > About or by running winver. Separate 24H2/25H2 machines (fast path), 26H1 machines (separate path) and anything older (full upgrade).
2. Confirm the prerequisite. Make sure KB5124010 or a later cumulative update is installed before you deploy KB5121794.
3. Review the new defaults. Decide on settings backup, taskbar actions and File Explorer behavior before Windows decides for you.
4. Pilot on representative hardware. Cover critical apps, VPN and Remote Desktop workflows, security agents and especially legacy drivers. Keep the pilot running through the driver audit window of at least 100 hours and three restarts.
5. Turn on the protections deliberately. Plan rollouts of Administrator protection and Sysmon (with a tuned configuration file) as separate projects.
6. Set a deadline. Staying on 25H2 during testing is fine because it's still supported, as long as monthly security updates keep landing. Set your cutover date by the support date for your edition.

For home users, the choice is simpler. In the Windows Experience Blog, Microsoft says that to get the update early you can go to Settings > Windows Update and turn on Get the latest updates as soon as they're available. Don't expect the desktop to look different afterward.

Bottom line​

26H2 matters for its version number. A fully patched 25H2 PC already has most of its code. What changes is a handful of commercial defaults and a new support end date one year later than 25H2's. That makes the decision easier, but it doesn't remove the need to test, particularly with the stricter driver-trust rules. Microsoft has made Windows feature updates cheap to install. Planning a careful rollout still takes the same work it always has.