Windows 11 23H2 (E) End-of-Life: Your Last-Call Action Plan

Microsoft Windows 11 23H2 (E) End of Life: Your Last-Call Action Plan

Microsoft Windows 11 23H2 (E), build 10.0.22631, reaches end of life on November 10, 2026. This is an Enterprise edition, not a Long-Term Servicing Channel (LTSC) release, so the vendor will stop all security updates, bug fixes, and paid support on that date. With roughly three months left, a full migration to a supported version is no longer feasible for most estates. This action plan focuses on what you can still do: inventory, isolate, harden, document, and secure a third-party support safety net before the deadline.

What Changes on November 10, 2026?

On the EOL date, the following applies immediately:

• No more security patches or vulnerability fixes from Microsoft.
• No more bug fixes or non-security hotfixes.
• No more vendor technical support SLAs for this operating system version.
• No more compliance coverage under standard vendor update cycles (e.g., Microsoft Update Catalog removal).

The OS itself will continue to run, but it becomes an unpatched asset. Any new CVE discovered after that date will remain unaddressed unless you have a third-party support arrangement in place.

Week-by-Week Action Checklist (Last 12 Weeks)

Weeks 1–2: Inventory and Discovery

• Identify every system currently running Windows 11 23H2 (E) across your estate.
• Document device names, IP addresses, department owners, and installed software dependencies.
• Flag systems that cannot be upgraded due to hardware or application compatibility.

Weeks 3–4: Risk Assessment and Isolation Planning

• Categorize each device by business criticality and data sensitivity.
• Identify which systems can be air-gapped, placed in a segmented VLAN, or restricted to outbound-only access.
• For critical systems that must remain on 23H2, begin planning technical isolation (e.g., blocking inbound RDP, disabling SMBv1, restricting admin accounts).

Weeks 5–6: Harden Remaining Installations

• Apply any remaining available patches from Microsoft before the cutoff date.
• Review and tighten local security policies: enable AppLocker or WDAC, enforce BitLocker, disable unnecessary services.
• Ensure endpoint detection and response agents are installed and up to date.

Weeks 7–8: Document Exposure for Auditors and Insurers

• Produce a formal risk register listing each unsupported device, its location, its function, and the rationale for not upgrading.
• Include a mitigation column showing what controls you have applied (isolation, hardening, monitoring).
• Share this register with your internal audit team and any cyber-insurance provider who may request it.

Weeks 9–10: Line Up Extended Support

• Evaluate third-party maintenance providers that cover Windows 11 23H2 (E) after EOL.
• Negotiate a support contract that includes patch development (where feasible), critical bug fixes, and technical assistance.
• Ensure the contract start date is November 11, 2026 at the latest.

Weeks 11–12: Final Cutover and Validation

• Confirm all third-party support agreements are signed and accessible.
• Run a final scan to verify no remaining unpatched 23H2 systems are overlooked.
• Test that isolation controls and monitoring are functional. Document any exceptions approved by management.

What If I Do Nothing?

If your organization continues to use Windows 11 23H2 (E) after November 10, 2026 without a support contract, you accept the following risks:

• Any new vulnerability (including zero-days) will remain unfixed by the vendor.
• Audit and compliance frameworks (e.g., PCI DSS, SOC 2) may flag these systems as non-compliant.
• Cyber-insurance policies could become void or subject to higher premiums.
• Regulatory fines may apply if a breach is traced to an unpatched Windows 11 23H2 system.

How We Can Help

Third-party support keeps your Windows 11 23H2 (E) devices secure, compliant, and supported after the vendor drops them. Our team offers patches, hotfixes, and technical support for this version — including builds like 10.0.22631 — without requiring a full migration. Contact us to discuss a tailored plan before November 10, 2026.

For the vendor’s official lifecycle page, see Microsoft Software Lifecycle or the independent source at endoflife.date/windows.