Windows 11 Version History: Security Changes From 21H2 to 25H2

Windows 11 has had five general feature updates from 21H2 (build 22000, October 2021) to 25H2 (build 26200, September 2025), and each one moved a security default. 21H2 made TPM 2.0, Secure Boot capable UEFI firmware and a supported CPU mandatory. 22H2 turned on Credential Guard and LSA protection by default on eligible machines and added Smart App Control. 23H2 rolled up native passkey management and built in Windows LAPS. 24H2 was a new platform that required SMB signing, removed NTLMv1 and brought Rust code into the kernel. 25H2 removed PowerShell 2.0 and WMIC.

If you only need the dates: as of this writing (23 October 2026), 21H2 and 22H2 are out of support on every edition, 23H2 is serviced only for Enterprise and Education until 10 November 2026, 24H2 Home and Pro got their last update on 13 October 2026, and 25H2 is the oldest release still serviced for Home and Pro. Microsoft has since shipped 26H1 (for new devices only) and 26H2, which are covered briefly at the end of the timeline.

Key takeaways

• Five feature updates, two kinds of delivery. 22H2 and 24H2 were full operating system updates. 23H2 and 25H2 arrived as small enablement packages that switch on code already shipped to the previous release. 24H2 was a full OS swap onto a new platform.
• Servicing is 24 months for Home and Pro, 36 months for Enterprise and Education, counted from each release date. The same build can be supported on one edition and dead on another.
• The hardware floor is a security decision. Microsoft tied TPM 2.0, Secure Boot and the processor list to virtualization based security (VBS), memory integrity and passwordless sign in, and cited a reliability gap: unsupported devices had 52% more kernel mode crashes.
• Most of the big security changes are defaults, not new features. Credential Guard, LSA protection, SMB signing and the vulnerable driver blocklist all existed before. What changed was who has them on without asking.
• 24H2 is the release that breaks old things. SMB signing required by default, NTLMv1 removed, Remote Mailslots off, VBScript moved to an optional feature, and LSA protection turned on after an audit period on upgraded machines.
• 25H2 cleans up legacy shells. PowerShell 2.0 is gone and WMIC is uninstalled, so old scripts that call wmic or powershell -version 2 fail.
• Administrator protection is the next big default. It arrived in an August 2026 cumulative update, ships off, and is turned on by the Windows security baselines from the October 2026 security update.
• You can check all of this from one PowerShell window. The walkthrough below reads the build, the servicing state and each security feature's real status rather than the Settings page's summary.

This post goes one level deeper than our earlier Windows posts. If you are setting up a machine from scratch, start with how to install Windows 11 from an ISO. The 24H2 SMB change has its own post, SMB signing in Windows 11 24H2: what changes and what breaks, and so does Credential Guard on Windows 11.

Windows 11 releases, builds and support dates

Microsoft's Windows 11 release information page is the authority for build numbers and dates. It states the rule plainly: feature updates come in the second half of the calendar year, with 24 months of support for Home, Pro, Pro Education and Pro for Workstations, and 36 months for Enterprise and Education. Monthly security updates arrive on the second Tuesday of each month and are cumulative.

The Home and Pro lifecycle page and the Enterprise and Education lifecycle page list end dates in Pacific time at 6:59:59 AM on the day after the last update, which is why you will see dates that look one day later than the release health page. The table below uses the date of the final update.

Timeline table

Sources: the release information page for builds and dates, and the two lifecycle pages for edition end dates. Microsoft's release page notes that Windows 11 Enterprise LTSC 2024 has no extended support and ends on 9 October 2029; only IoT Enterprise LTSC 2024 runs to 10 October 2034.

A few details in that table are easy to miss:

• The last build of each retired release is also on the release page. 21H2 ended at 22000.3260 (KB5044280, 8 October 2024). 22H2 ended at 22621.6060 (KB5066793, 14 October 2025).
• 23H2 is in its last month. Enterprise and Education 23H2 machines get their final update on 10 November 2026. After that, every supported general channel Windows 11 machine is on the 26100 platform or later.
• 24H2 Home and Pro just aged out. The 13 October 2026 update was the last one for those editions. Enterprise and Education 24H2 continues to 12 October 2027, and LTSC 2024 shares the same 26100 code base for years after that.
• The lifecycle pages carry edition notes. Windows 11 SE was last supported on 24H2, and Microsoft says 26H2 is the last version that will support devices with Snapdragon 850 processors.

What 26H1 and 26H2 are

These fall outside the 21H2 to 25H2 range in the title, but you will see them in inventory reports. The release information page says 26H1 is "scoped to support new devices" that reached the market in early 2026 and is not offered as an in-place update from 24H2 or 25H2. It uses build 28000, has no IoT Enterprise edition and does not get hotpatch. 26H2 (build 26300) reached general availability on 29 September 2026. On the October 2026 Patch Tuesday, the release page lists the same KB article, KB5127648, for 24H2, 25H2 and 26H2, which is the pattern of releases that share one servicing branch.

Why Windows 11 required TPM 2.0, Secure Boot and newer CPUs

The hardware requirements are the most argued over part of Windows 11, and the most important for security. The Windows 11 requirements page lists a 1 GHz or faster processor with two or more cores on a compatible 64-bit processor, 4 GB of memory, 64 GB of storage, UEFI firmware that is Secure Boot capable, and TPM version 2.0. To upgrade in place, a Windows 10 machine had to run version 2004 or later with the 14 September 2021 security update or later.

Microsoft explained the reasoning in an August 2021 Windows Insider post, Update on Windows 11 minimum system requirements. The argument had three parts.

Reliability. Microsoft reported that devices that did not meet the requirements had 52% more kernel mode crashes, while devices that met them had a 99.8% crash free experience. Supported processors are within vendor support windows and use modern DCH drivers, which Windows Update can service in a coordinated way.

Security. The TPM requirement was framed as what makes Windows 11 a passwordless operating system: keys for Windows Hello and BitLocker live in hardware rather than on disk. The Secure Boot requirement means the system boots only code signed by the device maker, the silicon vendor or Microsoft, with hashes recorded in hardware that can be checked remotely. The supported processors bring virtualization extensions and performance features that make VBS and memory integrity (hypervisor-protected code integrity, or HVCI) practical to run by default.

Compatibility. Newer hardware is more likely to have current drivers, and old drivers were a common cause of upgrade failures.

The same post recorded the one change after launch. Microsoft and OEMs tested Intel 7th generation and AMD Zen 1 machines, added a small set of Intel 7th generation models (for example the Core i7-7820HQ in devices shipped with DCH drivers), and concluded that no first generation Zen processors would be added.

In December 2024, ahead of Windows 10's end of support, Microsoft's Windows IT Pro blog repeated the position in TPM 2.0, a necessity for a secure and future-proof Windows 11. It describes TPM 2.0 as aligned to an ISO standard, supporting a wider range of algorithms than TPM 1.2, and tells administrators they "should not disable TPM checks on Windows 11 endpoints."

What the requirements actually changed

The practical effect is that every supported Windows 11 machine can run the protections that later releases turn on by default:

• VBS uses the Windows hypervisor to create an isolated environment. Credential Guard and memory integrity both run inside it. Hotpatch, introduced for 24H2, needs VBS turned on before a device is offered hotpatch updates.
• Memory integrity checks kernel mode code integrity inside the isolated environment. Microsoft's memory integrity page notes that from 22H2, Windows Security shows a warning when it is turned off.
• Measured and Secure Boot give BitLocker and device health attestation a trustworthy starting point.
• Pluton became an option on newer silicon. The Pluton page lists AMD Ryzen 6000 and later, Ryzen AI, Intel Core Ultra 200V and Series 3, and Qualcomm Snapdragon 8cx Gen 3 and Snapdragon X processors. Pluton can act as the system TPM and loads its firmware through Windows Update as well as UEFI capsule updates. Microsoft also notes that Pluton on 2024 AMD and Intel systems began using a Rust based firmware foundation.

The current supported Intel processor list is written for OEMs building new Windows 11 devices, and its Core series entries now start at 10th generation. That page governs what new machines may ship with. It is not the same thing as the list used when Windows 10 machines were checked for an upgrade in 2021, so do not use it alone to decide whether an existing PC was eligible.

Security changes in each feature update

Each subsection lists what Microsoft's own "What's new" page for that release says, plus changes that arrived in monthly updates during the release's life. Since 22H2, Microsoft ships features through "continuous innovation" in monthly updates, so a feature listed under 23H2 may have reached 22H2 machines months earlier. Managed devices can hold some of those features back with temporary enterprise feature control until the next annual update is installed.

21H2 (build 22000): the new baseline

The Windows 11 overview for IT pros describes the original release's security as "similar to Windows 10", built from hardware, OS, application and identity layers. The change was not a list of new features but the floor under them: every supported machine has TPM 2.0, Secure Boot capable UEFI, and a CPU that can run VBS. Windows Hello, BitLocker, the Windows Security app and security baselines carried forward from Windows 10.

The quiet consequence was that Microsoft could start planning defaults that assume this hardware, which is what 22H2 did.

22H2 (build 22621): defaults switch on

The What's new in 22H2 page has the densest security list of any release:

• Smart App Control. Blocks malicious or untrusted apps and potentially unwanted apps. It is built on App Control for Business and starts in evaluation mode. In enforcement mode, apps run only if Microsoft's app intelligence service predicts they are safe or they are signed with a certificate from a CA in the Trusted Root Program. The Smart App Control developer overview covers the modes. Originally it could only be turned on during a clean install. Microsoft's Smart App Control support article now says recent Windows updates allow it to be turned on or back on without a clean install.
• Credential Guard on by default. The Credential Guard page says that starting in 22H2, Credential Guard is enabled by default on domain-joined systems that are not domain controllers and that meet license and hardware requirements, which means Enterprise and Education. The default is set without UEFI lock, so administrators can turn it off remotely, and a machine where it was explicitly disabled before the upgrade stays disabled.
• Added LSA protection. Microsoft's LSA protection page says audit mode is on by default from 22H2, and that LSA protection (LSASS running as a protected process) is on by default for new installations of 22H2 or later that were not upgraded from an earlier release. The RunAsPPL registry value of 2 enables it without a UEFI variable, and that value is only enforced on 22H2 and later.
• Vulnerable driver blocklist. Enabled automatically on clean installs and whenever Smart App Control is on.
• Enhanced Phishing Protection in SmartScreen warns when a work or school password is typed into a phishing site or an unsafe app.
• Personal Data Encryption encrypts individual files with keys tied to Windows Hello for Business, as a layer on top of BitLocker.
• Pluton support is documented from this release.
• WebAuthn APIs support ECC keys.
• Memory integrity warning in Windows Security when it is off.

During 22H2's life, the September 2023 update (KB5030310) added native passkey management in Settings, according to the passkeys page.

If you want the operational detail on the Credential Guard change, including what it does to developer tools that cache credentials, see Credential Guard on Windows 11: what it protects on developer machines.

23H2 (build 22631): identity and credentials

The What's new in 23H2 page explains that 22H2 machines move to 23H2 with an enablement package because most of the files are already present. The security relevant additions it lists:

• Passkeys in Windows, managed from Settings.
• Windows passwordless experience, a policy for Microsoft Entra joined devices that removes the password option from some sign-in flows.
• Web sign-in for Entra joined devices.
• Windows LAPS native integration, which rotates and manages local administrator passwords without a separate agent.
• Windows Hello for Business can use peripheral face and fingerprint sensors on devices where Enhanced Sign-in Security was enabled at the factory.
• Declared configuration protocol, a desired state device management protocol.
• Dev Drive, a new volume type for developer workloads.

23H2 is a smaller security release than 22H2 or 24H2. Its importance is that it moved identity away from passwords: passkeys and LAPS were prerequisites for later changes that assume a local admin password is managed and a user can authenticate without typing a secret.

24H2 (build 26100): a new platform and the breaking defaults

The What's new in 24H2 page says 24H2 "is a full OS swap so it isn't available as an enablement package," and that 22H2 and 23H2 machines needed the May 2024 non-security preview update or later before they could take it. The security list is the longest Microsoft has published for a Windows 11 release:

• SMB signing required by default on Home, Pro, Education and Enterprise for all connections. Before this, Windows required signing only for connections to shares named SYSVOL and NETLOGON. The change was first tested in Insider build 25381 for Enterprise in June 2023, according to the SMB team's announcement. The same post traces earlier steps: SMB1 disabled by default in Home Insider builds (April 2022), the SMB authentication rate limiter (September 2022), insecure guest authentication off in Pro (January 2023) and the start of Remote Mailslot retirement (March 2023).
• SMB client encryption required option, SMB signing and encryption auditing, an SMB NTLM blocking option with an exception list, SMB dialect management, SMB over QUIC client access control, and a new File and Printer Sharing (Restrictive) firewall group that no longer opens NetBIOS ports 137 to 139.
• LSA protection enablement on upgrade. Upgraded machines audit for incompatible LSA plug-ins and drivers for a period, and if none are found, LSA protection turns on automatically.
• Remote Mailslot protocol disabled by default, after its deprecation in November 2023.
• NTLMv1 removed. The deprecated features page records it as removed starting in 24H2 and Windows Server 2025. All NTLM versions are deprecated.
• Rust in the Windows kernel. Microsoft's page says there is a new implementation of GDI region in win32kbase_rs.sys, and that you will "continue to see more use of it in the kernel."
• Windows LAPS improvements: automatic creation and naming of the managed account, passphrase settings, a readability option, a post-authentication reset and logoff action, and image rollback detection using a new msLAPS-CurrentPasswordVersion attribute.
• Personal Data Encryption for folders (Documents, Desktop and Pictures), configured from Intune.
• Windows protected print mode, which prints only through the modern print stack for Mopria certified printers (Microsoft's page spells it Morpia), so no third party print driver installers are needed.
• SHA-3 support in the Windows CNG library: SHA3-256, SHA3-384, SHA3-512, the SHAKE and cSHAKE extendable output functions and KMAC. SHA3-224 is not supported.
• App Control for Business, the new name for Windows Defender Application Control, with Intune as a managed installer.
• Sudo for Windows, off by default.
• Location and Wi-Fi access prompts for apps, and a privacy consent prompt before apps can access passkeys.
• Checkpoint cumulative updates, a servicing change covered below.

The VBScript deprecation timeline adds one more 24H2 change: VBScript became a set of features on demand that are preinstalled and on by default in 24H2. Around 2027 they will no longer be enabled by default, and VBScript will be retired completely later.

24H2 also removed WordPad, AllJoyn and Windows Mixed Reality.

What changed underneath in 24H2

Microsoft's own documentation describes 24H2 as a full OS swap and a new build line (26100 rather than 22621 and 22631). In press coverage and Insider circles, this platform release is widely referred to by the name Germanium. We could not find that name in Microsoft's IT pro documentation, so treat it as a common label rather than an official one. What Microsoft does document about the new base:

• It cannot be delivered as an enablement package from 23H2. Every 22H2 and 23H2 device had to take a full feature update.
• It is the base for LTSC 2024, so the long term servicing channel and the general channel share one code base from 2024 onward.
• It shipped Rust code in the kernel (win32kbase_rs.sys, a new implementation of GDI region).
• It is the first release eligible for hotpatch and for checkpoint cumulative updates.
• It carries the removals listed above: NTLMv1, WordPad, AllJoyn, Mixed Reality, with VBScript demoted to an optional feature.

The Windows Insider post that released 24H2 to the Release Preview Channel on 22 May 2024 (build 26100.712) listed Sudo for Windows and Rust in the Windows kernel among its headline changes, alongside energy saver and Wi-Fi 7 support.

25H2 (build 26200): removals and managed device controls

The What's new in 25H2 page says 24H2 machines move to 25H2 with an enablement package. Windows Server Update Services did not offer it until 14 October 2025. The security relevant items:

• PowerShell 2.0 removed. It is "no longer included in Windows 11, version 25H2."
• WMIC uninstalled when the 25H2 feature update is installed. The deprecated features page adds an August 2026 update: WMIC is removed and no longer available as a feature on demand on 24H2 and above.
• Policy-based removal of preinstalled Microsoft Store apps on Enterprise and Education, so removed apps do not come back.
• Quick machine recovery, which searches for cloud remediations when a device cannot boot after a widespread failure.
• Recall (preview) on Copilot+ PCs is disabled and removed by default on managed devices.
• A new privacy page under Privacy and security that shows which apps have used on-device generative AI models, and redesigned capability prompts that dim the screen.
• Wi-Fi 7 enterprise access points support.
• A redesigned passkey credential dialog and Windows Hello interface.

Administrator protection (2026 update to 24H2 and 25H2)

Administrator protection is the largest change to the Windows admin model since User Account Control. Microsoft's Administrator protection page describes it this way: a user signs in with a deprivileged token, and when an admin action is needed Windows asks the user to authorize it with Windows Hello. Windows then uses a hidden, system generated, profile separated account to create an isolated admin token, which is discarded after use. There are no auto-elevations.

Key facts from the page:

• It is available with KB5120998, which the release page lists as the 27 August 2026 optional update (2026-08 D) for 24H2 and 25H2.
• It is off by default. Organizations that use the Windows security baselines get it enabled by default with the October 2026 Windows security update; the baselines for 26H2, 25H2 and 24H2 include the new defaults.
• It covers Home, Pro, Enterprise and Education, but not Windows 365 Cloud PCs, Azure Virtual Desktop session hosts or Windows Server yet.
• It is configured with the UserAccountControl_TypeOfAdminApprovalMode setting in the LocalPoliciesSecurityOptions CSP, Group Policy, the Intune settings catalog, or a preview toggle in Windows Security.

Microsoft warns that some applications assume admin rights are always present or that the elevated profile is reachable from the unelevated one, and may need updates.

Feature by release comparison

This table answers "which release turned what on" for the features in the topic list. "Available" means you can turn it on; "default" means Windows turns it on for you under the stated conditions.

How Windows 11 servicing works

Windows 11 has three update mechanisms that matter for security, plus the Long-Term Servicing Channel.

Monthly cumulative updates. Microsoft's release cycle page describes the monthly security update on the second Tuesday at about 10:00 AM Pacific time, known as the B release. Optional non-security preview updates usually ship in the fourth week (the D release). Out-of-band (OOB) updates fix urgent problems off cycle, are always cumulative, and supersede the previous monthly and preview updates. Every Windows 11 release history row on the release page carries one of these letters.

Enablement packages. For 23H2 and 25H2, the new release's code was already shipped, dormant, in monthly updates to the previous release. A small enablement package (eKB) flips it on with a single restart. Microsoft's IT pro blog calls this "feature updates via servicing." The consequence for security teams: a 22H2 and a 23H2 machine at the same patch level run nearly identical code, and the same is true for 24H2 and 25H2. Their vulnerability exposure is close to identical; their support dates are not.

Checkpoint cumulative updates. From 24H2, cumulative updates are built as differentials against a recent checkpoint update rather than against the original release. Downloads are smaller, but a device must have the prerequisite checkpoint installed before it can take the latest update. Offline servicing scripts that assumed "one latest .msu file is enough" need to handle that.

Hotpatch. Microsoft's hotpatch page describes security updates that take effect without a restart. Requirements: Windows 11 24H2 or later, an eligible license (Windows 11 Enterprise E3 or E5, Microsoft 365 F3, Education A3 or A5, Microsoft 365 Business Premium, or Windows 365 Enterprise), enrollment in Windows Autopatch, VBS turned on, and the device on the latest baseline. Baselines are standard cumulative updates that need a restart and arrive in the first month of each quarter; the other two months are hotpatches. Arm64 devices must disable CHPE binaries to qualify. Hotpatch is not available on 26H1.

LTSC. The LTSC overview lists Windows 11 Enterprise LTSC 2024 (released 1 October 2024) as the only Windows 11 LTSC release so far. It is based on 24H2 and gets security updates without feature changes. Use it for fixed function devices, not for developer laptops; it does not receive the continuous innovation features described above.

How to check your Windows 11 build and security state

Every command below only reads state. Run them in Windows PowerShell 5.1 or PowerShell 7 as an administrator where noted.

Step 1: find the version and build

The quickest check is winver from the Run dialog. For something you can script:

# Version name (24H2, 25H2), build and revision (UBR)
$cv = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
$cv | Select-Object DisplayVersion, CurrentBuild, UBR, EditionID
"Full build: {0}.{1}" -f $cv.CurrentBuild, $cv.UBR

# The same from Get-ComputerInfo (slower, more detail)
Get-ComputerInfo -Property OsName, OSDisplayVersion, OsBuildNumber, WindowsEditionId

Compare CurrentBuild and UBR against the release information page. Build 26100 is 24H2 and 26200 is 25H2; a UBR of 9711 on either means the October 2026 security update is installed. Do not rely on the ProductName registry value, which on many Windows 11 installations still reads "Windows 10"; the build number is the reliable field.

Step 2: check the hardware baseline

# TPM presence and readiness (admin)
Get-Tpm | Select-Object TpmPresent, TpmReady, ManufacturerVersion

# TPM specification version (2.0 should appear in SpecVersion)
Get-CimInstance -Namespace root\cimv2\security\microsofttpm -ClassName Win32_Tpm |
  Select-Object SpecVersion, ManufacturerIdTxt

# Secure Boot state (admin); True means on
Confirm-SecureBootUEFI

Step 3: check VBS, Credential Guard and memory integrity

Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard |
  Select-Object VirtualizationBasedSecurityStatus,
                SecurityServicesConfigured, SecurityServicesRunning

VirtualizationBasedSecurityStatus of 2 means VBS is running. In SecurityServicesRunning, 1 is Credential Guard and 2 is memory integrity, as Microsoft's memory integrity page documents. Configured but not running usually means a firmware setting or an incompatible driver.

Step 4: check LSA protection

Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' -Name RunAsPPL -ErrorAction SilentlyContinue

A value of 1 means on with a UEFI variable, 2 means on without one (22H2 and later only). No value on a clean 22H2 or later install can still mean on by default; Windows Security under Device security, Core isolation shows the effective state. After an upgrade to 24H2, check the Code Integrity and LSA event logs for audit events naming plug-ins that would be blocked before you assume it turned on.

Step 5: check SMB signing

Get-SmbClientConfiguration | Select-Object RequireSecuritySignature, EnableSecuritySignature
Get-SmbServerConfiguration | Select-Object RequireSecuritySignature, EnableSecuritySignature

On 24H2 and 25H2 the client RequireSecuritySignature value should be True. Microsoft's SMB team also described the requirement on the server side (inbound connections) for Pro, Education and Enterprise editions, so expect True there too on those editions. If a NAS or an old appliance stops working after the upgrade, update its firmware or turn signing on there; do not turn off signing on the Windows side as the first response. Our SMB signing post covers the failure modes.

Step 6: check Smart App Control and App Control policies

# Smart App Control: 0 = off, 1 = on (enforcement), 2 = evaluation
Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\CI\Policy' -Name VerifiedAndReputablePolicyState -ErrorAction SilentlyContinue

# App Control for Business policies currently loaded (22H2 and later)
CiTool.exe --list-policies

Step 7: check legacy components that 24H2 and 25H2 removed or demoted

# VBScript as an optional capability (24H2 and later)
Get-WindowsCapability -Online -Name 'VBSCRIPT*' | Select-Object Name, State

# WMIC
Get-WindowsCapability -Online | Where-Object Name -like 'WMIC*' | Select-Object Name, State

# PowerShell 2.0 (removed in 25H2; may still appear on older builds)
Get-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2Root -ErrorAction SilentlyContinue |
  Select-Object FeatureName, State

# Rust kernel component (24H2 and later)
Test-Path "$env:SystemRoot\System32\win32kbase_rs.sys"

Step 8: check sudo and Administrator protection

# Sudo for Windows: shows the configured mode, or that it is disabled
sudo config

Administrator protection's state shows in Windows Security and in the UserAccountControl_TypeOfAdminApprovalMode policy. If your fleet uses the Windows security baselines, expect it to be on after the October 2026 security update, and test any installer or developer tool that writes to the elevated user profile.

What changed for developers and admins

App Control for Business and Smart App Control

App Control for Business (the former Windows Defender Application Control) is the policy engine under Smart App Control. Microsoft's App Control overview makes three points that matter for administrators:

• Smart App Control starts in evaluation mode and switches itself off within 48 hours on enterprise managed devices unless the user turns it on first. You can turn it off across a fleet with the VerifiedAndReputablePolicyState setting.
• The Smart App Control policy ships as an example at %windir%\schemas\CodeIntegrity\ExamplePolicies\SmartAppControl.xml, and Microsoft suggests it as a starting point for an organization's own App Control policy.
• In 24H2, Intune can act as a managed installer, so apps deployed through Intune are trusted without hand built hash rules.

For developers, the effect of Smart App Control on a personal machine is that unsigned build outputs you run locally can be blocked. That is a reason to sign internal tools, not a reason to turn the feature off on every machine.

Attack surface reduction rules

Microsoft's attack surface reduction rules reference documents rules that complement the defaults above. Two map directly onto Windows 11 changes: "Block abuse of exploited vulnerable signed drivers" (GUID 56a863a9-875e-4185-98a7-b882c64b5ce5) pairs with the driver blocklist, and "Block credential stealing from the Windows local security authority subsystem" (GUID 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2) pairs with LSA protection. Start any rule in audit mode:

# Audit first, enforce after reviewing events
Add-MpPreference -AttackSurfaceReductionRules_Ids 56a863a9-875e-4185-98a7-b882c64b5ce5 `
                 -AttackSurfaceReductionRules_Actions AuditMode
Get-MpPreference | Select-Object AttackSurfaceReductionRules_Ids, AttackSurfaceReductionRules_Actions

These cmdlets only work when the built in antivirus is the active one on the machine.

Local admin changes

The local administrator account has changed more in Windows 11 than at any time since Vista:

• Windows LAPS (built in from 23H2) rotates the local admin password, and in 24H2 can create and name the account for you and detect image rollback.
• Sudo for Windows (24H2) lets an admin elevate one command from an unelevated console. It still goes through UAC, and Microsoft's sudo page recommends the default forceNewWindow mode over disableInput or the inline normal mode unless you understand the risks of sharing a console with an elevated process. Enable it with sudo config --enable forceNewWindow or from Settings, System, Advanced.
• Administrator protection (2026) replaces the split token model with a separate hidden admin account and a Windows Hello prompt for every elevation. Tools that expect %USERPROFILE% to be the same for elevated and unelevated runs may break.

Legacy protocol and component removals

The removals are what most often break automation:

• NTLMv1 is gone in 24H2. Anything that still negotiates it, often old appliances or RADIUS configurations, fails.
• SMB signing required by default breaks connections to SMB servers that cannot sign, most often older NAS units.
• Remote Mailslots off by default breaks very old LAN applications that used them for discovery.
• VBScript as an optional feature still works in 24H2, but plan for the 2027 default off phase. Look for .vbs logon scripts and installers that call cscript or wscript.
• PowerShell 2.0 removal in 25H2 breaks scripts launched with powershell.exe -Version 2, which was sometimes used to dodge newer logging and script controls.
• WMIC removal breaks inventory scripts. Replace wmic calls with Get-CimInstance.

Windows 10 end of support and who is left behind

Windows 10 reached end of support on 14 October 2025. The Windows 10 Home and Pro lifecycle page says 22H2 is the final version and all editions got monthly security updates through that date. Windows 10 LTSC releases continue on their own lifecycles. The Windows lifecycle FAQ describes the paid Extended Security Updates (ESU) program for consumers and organizations that keep Windows 10 PCs after that date; ESU provides Critical and Important security updates only, with no new features.

The machines that cannot move to Windows 11 in a supported way are the ones that fail the hardware checks:

• No TPM 2.0 (many pre-2017 systems, or systems where firmware TPM is turned off; turning on the firmware TPM fixes many of these).
• No UEFI Secure Boot capability (legacy BIOS only firmware; switching from legacy or CSM boot to UEFI fixes many).
• A processor below the supported floor: broadly Intel 7th generation and older (apart from the few 7th generation models Microsoft added) and first generation AMD Zen and older.
• Windows 11 SE devices beyond 24H2, and Snapdragon 850 devices beyond 26H2, per the lifecycle notes.

Microsoft's December 2024 TPM post is explicit that the TPM check should not be bypassed on Windows 11 endpoints. A machine forced through the checks is on an unsupported configuration, and it will be the machine that cannot run the defaults described in this post.

Common mistakes

• Reading the version from the wrong field. ProductName can say Windows 10 on Windows 11. Use CurrentBuild and UBR.
• Treating 23H2 and 22H2, or 25H2 and 24H2, as different code. They share the same base and the same monthly fixes. Patch exposure is nearly identical; only the support dates differ.
• Assuming end of support is the same for every edition. A 23H2 Enterprise laptop is supported until 10 November 2026; the same build on Pro stopped on 11 November 2025.
• Disabling SMB signing to fix a NAS. Fix the server. Signing protects against relay and tampering on the client side.
• Assuming LSA protection is on after an upgrade. On upgraded machines it depends on the 24H2 audit finding no incompatible plug-ins. Check.
• Turning off Smart App Control "for now". It can be turned back on after recent updates, but many people forget. Sign your internal tools instead.
• Ignoring checkpoint cumulative updates in offline servicing. The newest update may need a prerequisite checkpoint.
• Expecting hotpatch on every device. It needs 24H2 or later, an eligible license, Autopatch, VBS and the current baseline.
• Leaving wmic, -Version 2 and .vbs in build and logon scripts. These fail on 25H2 now and on VBScript's default off date later.
• Using the current OEM CPU list to judge upgrade eligibility. That page tells OEMs what new devices may ship with.
• Bypassing the TPM check. It produces a machine that cannot run the protections later releases assume.

Where Safeguard fits, honestly

Most of this post is outside what Safeguard does. Safeguard does not manage Windows devices, deploy Windows updates, enforce Smart App Control or App Control policies, check firmware, TPM or Secure Boot state, or provide endpoint protection. Those jobs belong to Windows itself and to your device management tools.

The honest link is the software built and run on Windows machines. Developer laptops on Windows 11 install language packages, pull container images and build release artifacts, and those dependencies change far more often than the OS does. Safeguard's CLI can scan a repository, a container image or an SBOM file (safeguard scan --dir ., --image <name>, --sbom <file>), match components against vulnerability databases, apply reachability analysis, and the platform shows which projects contain a given component and version. Policies and gates can stop a known vulnerable dependency from shipping. None of that touches Windows servicing itself.

FAQ

What is the latest version of Windows 11?

As of 23 October 2026, the newest general release is 26H2 (build 26300), released on 29 September 2026. 25H2 (build 26200) remains the version most existing PCs get through an enablement package from 24H2. 26H1 (build 28000) exists only on new devices that shipped with it from early 2026 and is not offered as an update.

How do I check which version of Windows 11 I have?

Press Windows key and R, type winver and press Enter. For a scriptable answer, read DisplayVersion, CurrentBuild and UBR from HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion in PowerShell. Build 22000 is 21H2, 22621 is 22H2, 22631 is 23H2, 26100 is 24H2 and 26200 is 25H2.

Is Windows 11 23H2 still supported?

Only on Enterprise, Education, IoT Enterprise and Enterprise multi-session, until 10 November 2026. Home and Pro 23H2 received their last update on 11 November 2025. Move those machines to 25H2 or 26H2.

When does Windows 11 24H2 end support?

Home, Pro, Pro Education and Pro for Workstations received their final 24H2 update on 13 October 2026. Enterprise and Education 24H2 is supported until 12 October 2027. Enterprise LTSC 2024, which is built on 24H2, is supported until 9 October 2029, and IoT Enterprise LTSC 2024 until 10 October 2034.

Why does Windows 11 need TPM 2.0?

Microsoft says TPM 2.0 holds the keys behind Windows Hello, BitLocker and device health attestation in hardware, and makes passwordless sign in the default path. Together with Secure Boot and a supported CPU, it allows VBS, memory integrity and Credential Guard to run by default. Microsoft reported that devices below the requirements had 52% more kernel mode crashes.

Is Credential Guard on by default in Windows 11?

Yes, from 22H2 on domain-joined Enterprise and Education devices that are not domain controllers and that meet the hardware requirements. It is turned on without UEFI lock, so administrators can disable it remotely. If it was explicitly disabled before the upgrade, it stays disabled.

Does Windows 11 24H2 require SMB signing?

Yes. 24H2 requires SMB signing by default for all connections on Home, Pro, Education and Enterprise. Before 24H2, Windows required it only for SYSVOL and NETLOGON shares. Servers that cannot sign, often older NAS devices, stop working until they are updated or reconfigured.

What was removed in Windows 11 25H2?

PowerShell 2.0 is no longer included, and WMIC is uninstalled during the 25H2 feature update. Microsoft later noted that WMIC is no longer available as a feature on demand on 24H2 and above. 24H2 had already removed NTLMv1, WordPad, AllJoyn and Windows Mixed Reality, and turned VBScript into a feature on demand.

What is the difference between an enablement package and a full feature update?

An enablement package turns on features whose code was already delivered, dormant, through monthly updates to the previous release, so it installs with one restart. 23H2 (from 22H2) and 25H2 (from 24H2) used enablement packages. A full feature update replaces the operating system, as 22H2 and 24H2 did; 24H2 could not be delivered as an enablement package because it moved to a new platform.

What is Administrator protection in Windows 11?

It is a 2026 change to how admin rights work. Users run with a deprivileged token, and each admin action needs explicit approval with Windows Hello. Windows then creates a short lived admin token from a hidden, separate account. It arrived with KB5120998 for 24H2 and 25H2, is off by default, and is enabled by the Windows security baselines from the October 2026 security update.

Every Windows 11 release changed how the operating system itself is protected, but the machines it runs on still build and ship software made mostly of open source dependencies. A rebuilt or upgraded developer laptop pulls those packages again, and the drivers, tools and container images it uses carry open source components that need their own fixes.

Fix it without waiting for upstream

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

None of these demos change Windows settings or install Windows updates. They show how Safeguard handles the software you build and run on a Windows 11 machine.

The first demo is a real Safeguard CLI session: asked to fix a lodash CVE, the assistant reads the finding and advisory, asks before each command, edits package.json to lodash 4.17.21, runs npm install and npm test with your approval, prints a summary and pushes nothing. On a Windows developer laptop the same flow applies to the projects you build there, for example a Node or Python service whose dependency has a fixed version available.

Click through it at your own pace, or open it full screen.

The second demo sets up the local runner on your own machine, approves it with its device code, then scans from the terminal. That is the route for scanning repositories and container images from the workstation where you build them, after a Windows upgrade or a rebuild has pulled every dependency again.

Click through it at your own pace, or open it full screen.

The third demo connects Claude to the Safeguard MCP server with OAuth and chooses which tools Claude can use. Once your projects are in Safeguard, the same connection lets you ask which of them contain a given component and version when an advisory names a library your Windows build tools depend on.

Click through it at your own pace, or open it full screen.

To try the CLI, download Safeguard and follow the CLI documentation.

Quick check

Sources

• Microsoft Learn: Windows 11 release information
• Microsoft Lifecycle: Windows 11 Home and Pro
• Microsoft Lifecycle: Windows 11 Enterprise and Education
• Microsoft Lifecycle: Windows 10 Home and Pro
• Microsoft Lifecycle FAQ: Windows
• Microsoft Learn: Windows 11 requirements
• Windows Insider Blog: Update on Windows 11 minimum system requirements (27 August 2021)
• Windows IT Pro Blog: TPM 2.0, a necessity for a secure and future-proof Windows 11 (3 December 2024)
• Microsoft Learn: Windows 11 supported Intel processors
• Microsoft Learn: Windows 11 overview for IT pros
• Microsoft Learn: What's new in Windows 11, version 22H2
• Microsoft Learn: What's new in Windows 11, version 23H2
• Microsoft Learn: What's new in Windows 11, version 24H2
• Microsoft Learn: What's new in Windows 11, version 25H2
• Windows Insider Blog: Releasing Windows 11, version 24H2 to the Release Preview Channel (22 May 2024)
• Windows IT Pro Blog: Get ready for Windows 11, version 25H2
• Microsoft Learn: Credential Guard overview
• Microsoft Learn: Configure added LSA protection
• Microsoft Learn: Smart App Control overview
• Microsoft Support: What is Smart App Control?
• Microsoft Learn: Memory integrity and VBS
• Microsoft Learn: Microsoft Pluton security processor
• Microsoft Learn: Support for passkeys in Windows
• Microsoft Tech Community: SMB signing required by default in Windows Insider (2 June 2023)
• Microsoft Learn: Administrator protection
• Microsoft Learn: Sudo for Windows
• Microsoft Learn: Deprecated features for Windows client
• Windows IT Pro Blog: VBScript deprecation timelines and next steps (22 May 2024)
• Microsoft Learn: Windows monthly update release cycle
• Microsoft Learn: Hotpatch updates
• Microsoft Learn: Windows Enterprise LTSC overview
• Microsoft Learn: App Control for Business and Smart App Control
• Microsoft Learn: Attack surface reduction rules reference

Last reviewed: 23 October 2026. Windows support dates and build numbers change every month; check Microsoft's release information page before planning an upgrade.