Windows 11 Supported Versions: Which Ones Are Still Patched

Home and Pro editions get 24 months of security updates per annual release. Enterprise and Education editions get 36 months on the same release. Same build, same patch Tuesday schedule, different shelf life depending on which edition is installed. A Pro machine and an Enterprise machine on the exact same version number can be on completely different support timelines, which is the detail that trips up a lot of mixed-fleet offices.

Here's where that lands on the calendar right now, based on Microsoft's own release-information and lifecycle pages:

• 24H2 Home/Pro — support ended October 13, 2026. Enterprise and Education on 24H2 run to October 12, 2027.
• 23H2 Enterprise/Education — ends November 10, 2026. (Home and Pro on 23H2 aged out earlier.)
• 25H2 Pro — supported to October 12, 2027.
• 26H2, released September 29, 2026 as build 26300 — Pro runs to October 10, 2028, Enterprise to October 9, 2029.

There's also a release called 26H1, build 28000, that's worth knowing about but not chasing. Microsoft only ships it on new PCs — there's no in-place upgrade path to it from an existing Windows 11 install, so you won't see it as an update offer on machines you already own.

For the exact current dates on every release, Microsoft keeps the release-information page and the Enterprise/Education lifecycle page current, and the general servicing policy is laid out on the Windows lifecycle FAQ. Bookmark those three pages — dates shift as Microsoft ships new releases, and a bookmark beats trusting a blog post's numbers a year from now, including this one.

You don't need a full asset audit to know where you stand. Three methods, pick whichever matches your setup:

• Winver on a handful of machines. Press Windows key + R, type winver, hit enter. It shows the version (24H2, 25H2, etc.) and the build number. Fine for a spot check on five or ten PCs, painful past that.
• An Intune device filter. If you're managing devices through Intune, build a filter on device.osVersion and group by build. Takes a few minutes to set up and gives you a live count every time you open it — this is the method we lean on for most clients once Intune device management is in place.
• One line of PowerShell. Run Get-CimInstance Win32_OperatingSystem | Select-Object CSName, BuildNumber against a list of machines (or push it through a remote session) and sort by build number. You're looking for 26100 (24H2), 26200 (25H2), and 26300 (26H2). Anything older than those three needs attention.

Ten minutes, no fancy tooling required, and you'll know exactly which machines are sitting on a build that's about to age out or already has.

This is the scenario that bit our Katy client. Microsoft automatically moves unmanaged Home and Pro devices forward to the next supported version — that's by design, and it's why most home PCs and small-office machines without policy management quietly end up on 25H2 without anyone doing anything.

The PCs that don't move are the ones sitting behind a deferral period, a pause, or a target-version policy, whether that's through Group Policy, an MDM profile, or a leftover WSUS setting from three IT admins ago. Those settings override the automatic nudge, and the machine just sits there, still getting monthly cumulative updates for its current build right up until that build's end date — and then it stops.

If you find one of these, the fix is straightforward:

• Lift the deferral or pause, or update the target-version policy to point at 25H2 or 26H2.
• Check for a Microsoft safeguard hold on that hardware or driver combination — those block the upgrade even after you clear your own policy, and they show up in the update history as a specific error code worth googling before you assume it's fixed.
• Confirm the new build actually lands within about two weeks. If it doesn't, something else is blocking it — storage space, a stuck update agent, or a driver conflict are the usual suspects.

Whether you land on 25H2 or wait for 26H2 is a separate question with its own tradeoffs around feature rollout timing and driver maturity — we've covered that decision in detail elsewhere and won't rehash it here. The point of this post is simpler: know which build each machine is on, and know its clock.

Texas SB 2610, effective September 1, 2025, gives businesses with 20 to 99 employees protection from exemplary damages in a breach lawsuit if they've implemented the CIS Controls IG1 safeguard set — 56 controls, and patch management is one of the foundational ones. Source: Texas SB 2610 (as of 2026-08-20). It doesn't create a new right to sue and it doesn't shield you from the underlying liability, but it does mean a documented patch-management practice is now a legal asset, not just an operational one.

An unsupported build isn't a cosmetic problem. Once a version stops receiving updates, any new vulnerability found in it stays open indefinitely. The DBIR's finding that it now takes a median of 43 days to fully remediate a known-exploited vulnerability from detection — up from 32 — tells you how much slack is already baked into normal patch cycles; Verizon 2026 DBIR, Fig. 13 (as of 2026-08-20). An end-of-life build doesn't give you 43 days. It gives you zero.

If your office runs a mix of personal laptops, contractor machines, and company-owned PCs, that inconsistency is exactly where unsupported builds hide. It's one of the recurring gaps we find during a free IT assessment, right alongside missing endpoint protection and stale asset inventories.

The actual fix here isn't complicated — it's a recurring 10-minute check, not a one-time cleanup. Put it on a calendar reminder quarterly, or better, have whoever manages your device inventory pull the build-number report automatically as part of regular managed IT services. Pair it with solid endpoint security so an aging build isn't your only line of defense, and make sure your help desk process flags any machine that reports back on an old build before it becomes a support ticket nobody connects to the real cause.

For more background on how Windows updates, builds, and lifecycle timing interact, our Windows and Mac academy section and the vulnerabilities page go deeper than this post does.

How do I tell if my PC is Home, Pro, Enterprise, or Education edition?

Open Settings, go to System, then About. The edition is listed right under Windows specifications, along with the version and build number — the same screen winver shows in a lighter format.

Does Windows 11 Pro get the same patches as Enterprise on the same build?

Yes, while both are in support. The content of the monthly update is identical across editions on a given build. The difference is how long that build keeps receiving those updates — 24 months for Home/Pro, 36 for Enterprise/Education.

What happens the day a build stops getting updates?

Nothing visibly changes. The machine keeps running. It just stops receiving the monthly security patch, so any vulnerability discovered after that date stays open on that machine indefinitely until the OS is upgraded.

Can I just turn off update deferral and let Windows handle it?

For most small offices, yes — that's effectively what Microsoft's automatic enablement for unmanaged Home/Pro devices already does. If you're on Intune or Group Policy with deferral settings for a reason (testing, compatibility, bandwidth), keep the policy but set a target version so devices don't fall indefinitely behind.

If you'd rather not track build numbers and end-of-support dates across every PC in your Woodlands, Round Rock, or Katy office by hand, that's exactly the kind of recurring work we build into managed IT contracts. Get in touch and we'll tell you honestly where your fleet stands.