Windows 11 23H2 and 24H2: Support Ends in 2026

Still on Windows 11? The version matters

Moving to Windows 11 is not a one-off job. Each release has its own support window, so a laptop can run Windows 11 and still be approaching the end of regular updates. For an organisation, the useful question is which edition and release each device is running, rather than whether the fleet has moved away from Windows 10.

This guide was checked on 1 October 2026. It explains the approaching deadlines and a practical way to organise the work without turning an update into an unexpected interruption.

Which editions are affected?

Microsoft publishes support dates by both version and edition. Use the full names below rather than relying on inventory abbreviations such as E or W.

• Windows 11 24H2 Home, Pro, Pro Education and Pro for Workstations: 13 October 2026.
• Windows 11 23H2 Enterprise and Education: 10 November 2026.
• Windows 11 24H2 Enterprise and Education: 12 October 2027; these editions are not affected by the October 2026 deadline.

These dates concern the General Availability Channel. LTSC editions have separate lifecycles. Windows 11 23H2 Home and Pro have already reached end of updates, so do not group them with the Enterprise deadline.

What end of support means in everyday terms

An affected PC does not suddenly stop working on the deadline. Staff may still be able to sign in, use email and open their usual applications. The problem is what happens afterwards: the release no longer receives its regular Windows security fixes and quality updates. Continuing to use it can allow newly discovered weaknesses to remain unresolved.

Antivirus, a firewall and an updated browser remain useful, but they do not replace fixes to the operating system. A Microsoft 365 subscription does not extend the lifecycle of the installed Windows release.

Why organisations should treat this as planned maintenance

A missed deadline can leave an awkward gap between the systems a business depends on and the systems its IT team can maintain. Application vendors may also require a supported operating system when investigating faults. That can make an ordinary support incident harder to resolve.

There may be implications for customer security questionnaires, internal policies, certification or insurance requirements. Check the requirements that actually apply to your organisation; reaching a support deadline does not automatically establish a legal breach or invalidate every insurance policy. The practical aim is to keep an accurate device record and an agreed upgrade plan.

How this affects Cyber Essentials

Cyber Essentials requires software within the assessment scope to be licensed and supported. Once the relevant Windows release reaches end of updates, leaving it in scope prevents an organisation from meeting that supported-software requirement. Antivirus or endpoint detection does not restore vendor support.

• Move 24H2 Home, Pro, Pro Education and Pro for Workstations devices to a supported release before 13 October 2026.
• Move 23H2 Enterprise and Education devices to a supported release before 10 November 2026.
• Apply the high-risk or critical vulnerability fixes required by the scheme within 14 days of release. This is a patching deadline, not an extra 14 days of permission to run an unsupported release.

If a legacy system cannot be upgraded, discuss its treatment with your assessor. The scheme allows a defined out-of-scope subset that prevents all traffic to and from the internet. Simply omitting a device from the inventory, moving it to another VLAN or blocking inbound connections is not enough. A certificate issued earlier does not make later unsupported software meet the requirements.

Cyber Essentials Plus: the same baseline, independently tested

Cyber Essentials Plus uses the same technical control areas as Cyber Essentials and adds independent technical testing. The Windows support dates do not change for Plus. Prepare accurate version records and evidence that upgrades and security updates have completed, rather than relying on a rollout being scheduled.

Arrange the work ahead of the assessment and include remote laptops and devices that rarely connect. Passing an upgrade pilot is useful, but it does not show that every affected device has been remediated.

ISO/IEC 27001:2022 and IASME Cyber Assurance

ISO/IEC 27001:2022 is an internationally recognised information security management system standard. Its approach is based on assessed risks, applicable requirements and the controls selected by the organisation. An unsupported Windows release should therefore trigger a review of asset records, vulnerability management and the treatment plan within the ISMS scope.

This is a practical implication of the risk-management approach, not a claim that Microsoft automatically cancels an ISO certificate on a support date. Record the affected assets, risk owner, justified interim controls and migration deadline, then review the position with your certification body. For UK organisations pursuing IASME Cyber Assurance, an up-to-date Cyber Essentials certificate is a prerequisite; keeping that baseline in place matters to the wider assurance programme too.

PCI DSS and sector-specific requirements

Organisations with systems in PCI DSS scope also need to consider payment-security obligations. PCI DSS is a payment-industry security standard, not a general-purpose certification every business needs. Requirement 6.3.3 requires critical security patches and updates within one month of release, with other applicable patches addressed within appropriate risk-based timeframes.

If an affected Windows device is in, or can affect, the cardholder data environment, review the migration plan and scope with your payment provider or qualified assessor. Do not assume that using a payment terminal puts every office PC in scope. Likewise, do not assume that isolating a device for Cyber Essentials automatically resolves its PCI DSS obligations. Sector and customer contracts can add requirements; choose assurance schemes according to your operations and contractual needs.

Keep evidence for your next assessment

A useful evidence pack connects the support deadline to completed maintenance. It should show what was affected, what changed and how the organisation verified the result.

• An inventory with device owner, Windows edition, version and support deadline.
• Update reports showing successful installation and any failed or offline devices.
• Application test results, approved maintenance windows and recovery arrangements.
• A tracked exception register with an owner, review date and agreed treatment for unresolved systems.

An upgrade helps address one part of security assurance. It does not by itself demonstrate compliance with all the controls in Cyber Essentials, ISO/IEC 27001 or a sector-specific standard.

Start with an accurate device list

On an individual PC, open Settings > System > About and read Windows specifications. Record the edition and version. Running winver also helps confirm the installed release. In a managed organisation, use your endpoint inventory to build the same picture across office PCs, remote laptops and spare devices.

• Record the device, assigned user, Windows edition and version.
• Identify the applications, printers, VPN and specialist peripherals each team depends on.
• Flag devices that have not checked in recently or repeatedly fail updates.
• Give each affected device an owner, a target upgrade date and a way to confirm completion.

For example, an office with 24H2 Pro laptops and 23H2 Enterprise desktops has two deadlines. Prioritise the October group first while testing the November group in parallel.

Test the upgrade before rolling it out

Choose a supported Windows release that is suitable for your hardware, applications and management tools. Check Microsoft release-health information and vendor guidance before deployment. Do not assume every device should move to a release simply because its number is higher.

1. Back up important data and test that it can be recovered. Check access to BitLocker recovery keys before maintenance.
2. Pilot the upgrade on a small, representative group, including a remote worker and anyone using specialist software.
3. Test sign-in, email, printing, file access, VPN connections and your main business applications.
4. Schedule the wider rollout in manageable batches with clear restart instructions and time for support.
5. Check the installed version and update status afterwards. Track failed or offline devices until they are resolved.

Keep a recovery plan for failed upgrades and check the rollback options available on the actual devices. Replacing every computer is not automatically necessary; assess hardware readiness before committing to new equipment.

Check whether update policies are holding devices back

If devices are pinned to an older feature release, review the policy in the tool that manages them. That might be Intune, Group Policy or another endpoint platform. Pause settings, target-version policies and application compatibility concerns can all affect the rollout.

Change deployment settings through the agreed management process and test them first. If an update is blocked by a compatibility safeguard, investigate the cause rather than forcing the installation just to meet a date. Assign unresolved devices a documented plan and review them regularly.

Need help planning the next step?

For organisations in Croydon and South London, a useful first step is a focused review of the affected devices, the applications they run and the work needed before the deadline. Techno Life can help with business IT support, Windows troubleshooting and upgrade planning. Bring your device list and any known compatibility concerns so the scope can be discussed clearly.