Windows 11 24H2 Home and Pro got their last monthly update on October 13. Microsoft says so directly in the release notes for KB5127648: devices on those editions will no longer receive security or preview updates and should move to a newer version of Windows 11. If you missed the background, our post on the 24H2 end of updates covers who is affected.

The good news is that this upgrade is small. The bad news is that small upgrades still break things when nobody checks first. Here is the checklist we run before moving a 24H2 machine forward.

25H2 or 26H2: Pick the Newer One

You have two targets. Windows 11 25H2 shipped on September 30, 2025, and Windows 11 26H2 shipped on September 29, 2026. Both are supported, but the clock is very different. According to Microsoft’s release information, 25H2 Home and Pro get updates until October 12, 2027, and Enterprise and Education until October 10, 2028. 26H2 Home and Pro run until October 10, 2028, and Enterprise and Education until October 9, 2029.

So 26H2 buys a full extra year. Unless a line-of-business vendor has not signed off on it yet, or Windows Update is holding a specific machine back, go straight to 26H2 and skip a round of this exercise next fall. The checks below apply to either version.

Enterprise and Education machines still on 24H2 are not in a rush. Those editions keep getting updates until October 12, 2027, but they will face the same move.

Why This Upgrade Is Small

Windows 11 24H2, 25H2 and 26H2 share one servicing branch and the same core system files. That is why a single monthly update, KB5127648, covered all three in October. The new features for each version are already sitting on your 24H2 machine, delivered through the monthly updates in a dormant state.

Microsoft turns them on with an enablement package, which it describes as a small master switch. Installing it takes a single restart in most cases instead of the long reinstall a traditional feature update needs. For 26H2 that package is KB5121794, and it requires 24H2 or 25H2 with the September 22, 2026 update or anything later already installed. A PC that took October’s patches is ready. One exception: devices that shipped with Windows 11 26H1 cannot move to 26H2 and will get a path to a later release instead.

Check 1: Know What Each PC Is Running

Start with an inventory. This shows the version, edition and exact build on a machine:

$cv = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion"
[pscustomobject]@{
  Edition = $cv.EditionID
  Version = $cv.DisplayVersion
  Build   = "$($cv.CurrentBuild).$($cv.UBR)"
}

A build starting with 26100 is 24H2, 26200 is 25H2, and 26300 is 26H2. Anything on 24H2 Home or Pro goes on the list for this month.

Check 2: TPM and Secure Boot Still On

These PCs already passed the Windows 11 hardware check once, but BIOS updates, firmware resets and well-meaning troubleshooting can switch TPM or Secure Boot off without anyone noticing. Confirm both from an elevated PowerShell window:

Get-Tpm | Select-Object TpmPresent, TpmReady, TpmEnabled
Confirm-SecureBootUEFI

You want True across the board. Secure Boot matters for another reason this year: Microsoft is still delivering newer Secure Boot certificates through Windows Update to replace the ones that began expiring in 2026. Our post on the Secure Boot certificate expiration has the background.

Check 3: Escrow the BitLocker Recovery Keys

This is the check that saves you from a very bad phone call. Any time firmware, boot files or Secure Boot settings change, a BitLocker-protected PC can stop at the blue recovery screen and ask for a 48-digit key. If that key only lives on the PC, the data is gone.

Before upgrading, confirm the recovery key exists and is stored somewhere other than the machine. This lists the protectors and pushes the recovery password to Microsoft Entra ID on an Entra-joined PC:

manage-bde -protectors -get C:

$kp = (Get-BitLockerVolume -MountPoint "C:").KeyProtector | Where-Object KeyProtectorType -eq "RecoveryPassword"
BackupToAAD-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId $kp.KeyProtectorId

For machines on an on-prem domain, back up to Active Directory instead. If you need to dig a key out later, we have a walkthrough for getting a BitLocker recovery key from the command line.

Check 4: Hunt Down WMIC and PowerShell 2.0

Microsoft’s notes for 25H2 list two old tools as gone. PowerShell 2.0 is no longer included, and the WMIC command-line utility gets uninstalled when the 25H2 feature update installs. Old login scripts, inventory tools and vendor installers that call either one will fail after the upgrade, usually with no obvious error to the user.

Search your script shares and scheduled tasks before you upgrade:

Get-ChildItem "\\server\scripts" -Recurse -Include *.ps1,*.bat,*.cmd,*.vbs |
  Select-String -Pattern "wmic", "-version 2" -SimpleMatch |
  Select-Object Path, LineNumber, Line

Microsoft does let you add WMIC back as an optional feature, but it says plainly that this is not recommended because WMIC will be fully removed later. Rewrite those calls with PowerShell CIM cmdlets now. Our guide to fixing "wmic is not recognized" has the common replacements.

Check 5: Old Drivers on Old Hardware

This one is new for 26H2. Microsoft changed how the Windows kernel trusts third-party drivers: default trust for cross-signed drivers is removed. Drivers from the Windows Hardware Compatibility Program and an allow list of trusted legacy drivers keep working. Windows audits driver compatibility for at least 100 hours and three restarts before it starts enforcing.

In plain terms, the risk sits with old hardware running old drivers: label printers, check scanners, USB serial adapters, lab and shop equipment. List the third-party drivers on a machine with:

pnputil /enum-drivers

Look for anything from a small vendor with a driver date many years old, and check whether the vendor has a current signed version before you upgrade the PC that runs it.

Check 6: Back Up, Then Pilot

Make sure user files have a real backup separate from OneDrive sync, then upgrade a handful of machines first. Pick a mix: one from each department, the oldest hardware you have, and whoever runs the weird software. Give them a few days of normal work before you move everyone else.

If Windows Update does not offer the new version to a particular PC, do not force it. Microsoft uses safeguard holds to stop the update on devices where it has detected a known compatibility problem, such as one that would cause a rollback, data loss or loss of connectivity. A held machine is Windows telling you something.

How to Install It

Windows Update. On unmanaged Home and Pro PCs, the new version shows up in Settings under Windows Update as a feature update you choose to download and install. Microsoft rolls these out gradually, so not every eligible PC sees it on the same day.

Intune. Create a Windows feature update policy, select the target version, and assign it to your pilot group first. Intune handles the orchestration and lets you control when the version installs.

WSUS. Approve the feature update for the target version. Microsoft notes that 24H2 devices updating through Windows Update or WSUS get the enablement package automatically when they install the feature update.

One heads-up for 26H2 on business PCs: Windows settings backup, app actions on the taskbar and a set of File Explorer changes that used to sit behind temporary commercial controls are now on by default. Existing admin policies are still honored, but users will notice a few new things after the restart.

References

Want your 24H2 machines moved forward without a BitLocker surprise? Contact Rain City Techworks.