CH
PL
Why this is more than an update?
At first glance, a Windows feature update looks like routine work. In practice, it affects many areas at once: business applications, drivers, security software, printers and peripherals, endpoint management policies, and, not least, users' daily workflows. The larger and more heterogeneous the device fleet, the more important a structured approach becomes.
In addition, devices without security updates are a risk for the entire network. For organizations that fall under NIS2, traceable patch and lifecycle management is a basic requirement.
Step 1: Take inventory of devices.
It all starts with one question: how many devices are still running 23H2, and where are they? Tools such as Microsoft Intune, Configuration Manager, or other endpoint management solutions usually provide this overview quickly. It is important to capture not only the number but also the context:
- Location and department
- Device type and hardware generation
- Usage: standard workstation, specialized workstation, kiosk, or production environment
- Reasons why the device has not been updated yet
The last point is particularly revealing. There are often concrete obstacles: a business application, a driver, a device that is rarely connected to the network, or simply a lack of ownership.
Step 2: Check compatibility
Before a broad rollout starts, it should be clear which applications and devices are critical. These include:
- Business applications, especially older or in-house software
- Drivers for printers, scanners, card readers, and specialized hardware
- Security solutions such as endpoint protection, VPN clients, and encryption
- Group policies and configuration profiles
Vendor information on support for 24H2 or 25H2 is a good starting point. It cannot replace your own testing, though.
Step 3: Form a pilot group.
A pilot update on a small group of devices helps to check typical workflows before the wider rollout. The pilot group should be as representative as possible: different departments, device types, and application profiles. Ideally, it includes users who report issues reliably and are willing to give quick feedback.
Define in advance how you will measure the success of the pilot phase, for example, all core applications start without errors, printing works, VPN connections are stable, and there are no critical support tickets over a defined period.
Step 4: Plan and communicate the rollout.
A staged rollout in waves reduces risk. A typical sequence runs from the IT department to the pilot group, then to individual sites or departments, and finally to the entire organization. There should be enough time between waves to evaluate feedback.
Communication is just as important. Users should know when the update is coming, how long it will take, whether they need to do anything, and whom to contact with questions. Coordinate the timing with business units so that month-end closings, production peaks, or important deadlines are not affected.
Step 5: Support after the switch
After the update comes support. Experience shows that the number of requests rises in the first days after each wave. Clarify in advance who supports users when questions arise: service desk, on-site support or local contacts in the departments. A short FAQ with the most common questions provides additional relief.
Finally, check whether all devices have been updated successfully. A report from your endpoint management tool shows which devices are still missing and why.
Do not forget the special cases.
Almost every device fleet includes devices that do not fit the standard process. These include kiosk and information terminals, computers attached to production lines or lab equipment, workstations with certified software and field service laptops that rarely connect to the corporate network.
These devices need their own solutions. Sometimes a vendor first has to approve the new Windows version, sometimes an on-site appointment is required, and sometimes replacing the hardware is the better option. The key is to identify these cases early instead of dragging them along as leftovers at the end. Devices that temporarily cannot be updated should be documented, isolated in the network and monitored more closely.
Make progress measurable.
A rollout is easy to steer when a few metrics are visible regularly:
- Share of devices on supported versions, overall and per site
- Number of devices with known obstacles and their causes
- Support tickets per rollout wave
- Failed installations and the time needed to resolve them
These figures help not only the project team. They are also the basis for a short status update to management and for evidence towards auditors.
Who owns the entire process?
A Windows rollout touches many roles: client engineering, service desk, information security, business units and often external partners. Without clear ownership, gaps appear; for example, when nobody checks the compatibility of a specific business application or the follow-up of individual devices gets lost in day-to-day work.
A proven approach is to assign one person or a small team that owns the process from the device inventory to the post-update review. This role coordinates, documents, and reports, including to management.
Plan capacity realistically.
In many IT teams, it is not the plan that is missing but the capacity. Rollout, pilot group, and post-update support tie up people who are already busy with daily operations. With additional temporary specialists, for example, in client engineering, software packaging, or on-site support, such a project can be delivered without overloading ongoing operations.
A clear division of tasks is essential. External support takes on defined work packages, while the internal team keeps control and the knowledge of its own environment.
Checklist at a glance.
- Identify devices on 23H2 and document reasons for missing updates
- Test critical applications, drivers, and security solutions
- Define a pilot group and success criteria
- Plan the rollout in waves and coordinate with business units
- Inform users in good time
- Ensure support for the first days after each wave
- Create a final report and follow up on remaining devices
Frequently asked questions
Will devices running 23H2 keep working after 10 November?
Yes, the devices keep running. However, they no longer receive security and quality updates and therefore become a growing risk in the network.
24H2 or 25H2: which version is the right target?
Both versions are supported. Which one fits better depends on your update strategy, the compatibility of your applications, and the support periods Microsoft specifies for each edition.
Conclusion
The end of servicing for Windows 11 23H2 Enterprise and Education is no reason to panic, but it is a clear mandate. If you approach device inventory, compatibility, pilot phase, rollout, and support in a structured way and assign clear ownership, you will bring your clients safely to a supported version.
At Suppliance, we help you find the right IT specialists for infrastructure and rollout projects. Who owns the entire process in your organization, from the device inventory to checking devices after the update?