Windows 11 23H2 Enterprise and Education Get Their Last Update on November 10

Windows 11 23H2 Enterprise and Education editions reach end of updates on Tuesday, November 10, 2026. Microsoft says the November 2026 security update is the last one these editions will get. After that, Windows 11 23H2 machines in those editions stop receiving monthly security fixes.

School districts, campus labs and volume-licensed nonprofits are the readers most likely to run these editions. They get a longer support window than Home and Pro, and that window ends this week. This post covers the dates on Microsoft’s own pages, how to find the machines still on Windows 11 23H2, which version to move them to, and what to do with the ones that cannot move in time.

The short version: find every PC still on build 22631, install the November update on it, then move it to a supported version. Microsoft’s earlier reminders named 25H2, which Enterprise and Education editions can run until October 2028. Microsoft’s lifecycle FAQ lists no paid extension program for Windows 11 versions, so a machine left on Windows 11 23H2 stops getting patches.

What Microsoft says about Windows 11 23H2

The Windows message center carried a 30-day reminder on October 9. It says: "The November 2026 Windows security update will be the last update available for these editions." It adds that after November 10, these devices "will no longer receive monthly security updates containing protections from the latest security threats."

The Microsoft Lifecycle page for Windows 11 Enterprise and Education lists the end date for version 23H2 as 11/11/2026 at 6:59:59 AM Pacific time. In practice, that is the end of November 10 in Redmond. The page says the editions follow Microsoft’s Modern Lifecycle Policy.

Microsoft’s 23H2 release health page repeats the November 10 date. It also notes that Home and Pro editions of 23H2 already reached end of updates on November 11, 2025. So any Home or Pro machine still on Windows 11 23H2 has gone a year without fixes.

Per Microsoft’s Windows lifecycle FAQ, Enterprise and Education editions get 36 months of servicing per annual release. Home and Pro get 24 months. Version 23H2 came out October 31, 2023, so this is the 36-month mark.

Which Windows 11 versions are still supported

Here is where Enterprise and Education editions stand as of early November 2026, from Microsoft’s Windows 11 release information page.

The release information page says 26H1 "is scoped to support new devices that started coming to market in early 2026 and is not designed as a feature update for existing devices." So it is not a target for an upgrade.

The lifecycle page shows end dates as early-morning Pacific timestamps on the following day. For example, 25H2 shows 10/11/2028 at 6:59:59 AM. The table above uses the release information page’s dates.

Where Microsoft says to move Windows 11 23H2 machines

The 90-day reminder in August and the 60-day reminder in September both named one target. The 60-day reminder says to move 23H2 Enterprise and Education devices to Windows 11, version 25H2, which "will continue to receive updates until October 11, 2028."

The October 30-day reminder is broader. It says: "We recommend updating eligible devices running Windows 11, version 23H2 to a supported version of Windows 11." The 23H2 release health page now links to resources for 26H2, the newest release.

For most small IT teams, the choice is between 25H2 and 26H2. Both give at least two more years of updates. 24H2 is supported too, but its Enterprise and Education support ends in October 2027, so you would be doing this again in a year.

Pick the version your other managed machines already run, if you can. One version across the fleet makes testing and support simpler. If your line-of-business apps, AMS client or classroom software vendors have only certified one of the two, follow that.

For an unmanaged Windows 11 23H2 machine, Microsoft’s reminder gives the path. Go to Settings > Windows Update, select Check for updates, and look for the option to "Download and install."

How to find the machines still on Windows 11 23H2

Start with the build number. Microsoft’s release information page lists 23H2 builds as 22631, and the latest as 22631.7654, released October 26. Any machine reporting build 22631 is on 23H2. The winver command on a single PC shows the version and build.

For a fleet, use your management tool’s reports rather than walking the building:

• Microsoft Intune: the Windows feature updates reports show each device’s update state.
• WSUS or Configuration Manager: use your OS version reports and look for build 22631.
• An asset register: if you keep one, add a column for Windows version and build. Our IT asset management basics post covers what to track.

Do not forget machines that are off the network for weeks. Lab PCs, loaner laptops and kiosks often miss the report and then miss the upgrade.

Using an Intune feature update policy

If you manage devices in Intune, a feature update policy is the most direct tool. Microsoft’s Intune feature update documentation gives the path: Devices > Windows > Windows updates > Feature updates > Create profile.

According to that page, the policy sets which Windows version devices can install and keeps "that version enforced until the policy is changed or removed." It does not downgrade devices already on a newer version.

Three details from Microsoft’s documentation are worth knowing:

1. Only supported versions appear in the list, so Windows 11 23H2 will not be offered as a target.
2. Microsoft recommends you stop using feature update deferrals in update rings once you use feature update policies. Mixing the two "can delay or block feature updates."
3. Devices under a safeguard hold will not install the targeted version until Microsoft lifts the hold.

The documentation also points to the Windows feature updates (Organizational) report. Devices that are ready show as "OfferReady."

Machines that cannot move this month

Some machines will not make it. A lab image may need retesting, or an app may not be certified yet. Microsoft’s guidance is to update, and its lifecycle FAQ describes no paid extended update program for Windows 11 versions. The Extended Security Updates program it describes is for Windows 10.

That leaves practical steps:

• Install the November 10 update on every Windows 11 23H2 machine first. It is the last one.
• Make a short list of machines that cannot move, with a reason and a target date for each.
• Keep those machines off guest and public networks where you can, and limit who signs in to them.
• Move the highest-risk machines first: staff laptops that leave the building and PCs used for finance or member data.
• Retire hardware you were planning to replace anyway rather than upgrading it.

Write down what you decided and why. If an auditor, a grant funder or a cyber insurance form asks about unsupported software, you will want that record.

How this fits the rest of the fall deadlines

November 10 is a busy day for end-of-support dates. Our .NET 8 and Umbraco 13 post covers .NET 8, which leaves support the same day. Exchange Online’s EWS retirement, covered in our EWS retirement post, belongs on the same list.

In October, Windows 11 24H2 Home and Pro reached end of updates alongside Office 2021, as we reported in our Office 2021 and Windows 11 24H2 post. The 23H2 Enterprise and Education date is the other half of that story. Our Q4 2026 platform calendar collects the rest of the dates agencies and their clients need before January.

Frequently Asked Questions