If you manage Windows Servers, plan for removal of Windows Internet Name Service (WINS). WINS was officially deprecated since Windows Server 2022 and will be removed from all Windows Server releases following Windows Server 2025. Standard support will continue through the lifecycle of Windows Server 2025, until November 2034. We encourage you to migrate to modern Domain Name System (DNS)-based name resolution solutions before then. When will this happen: WINS deprecation was announced in Windows Server 2022. Deprecation means the feature remains supported and maintained, but there is no further active development or new functionality planned. November 2034 is the end of the lifecycle for Windows Server 2025, which also marks the end of support for WINS. How this will affect your organization: Once removal takes effect, the following components will no longer be part of Windows Server: WI
Microsoft has identified an issue affecting some organizations using hotpatch updates on devices running Windows 11 Enterprise, version 25H2. After installing the hotpatch update KB5068966 released November 11, 2025, affected devices repeatedly download and install the same update when a Windows Update scan is run. This behavior does not impact device functionality; only the update history will reflect the latest installation timestamp. An out-of-band (OOB) update was released today, November 20, 2025, to address this issue. This is a cumulative update, so you do not need to apply any previous updates before installing this update, as it supersedes all previous updates for affected versions. If you have not yet deployed the November 2025 hotpatch update (KB5068966) on Windows 11, version 25H2 devices in your environment, we recommend you apply this OOB update (KB5072753) instead.
The November 2025 non-security preview update is now available for all supported editions of Windows 11, version 23H2. The non-security preview update for Windows 11, versions 25H2 and 24H2 will be available soon. Information about the contents of this update is available from the release notes, which are accessible from the Windows 11 update history page. To learn more about the different types of monthly quality updates, see Windows monthly updates explained. Looking to explore upcoming features and improvements in Windows 11? Check out the Windows roadmap. It includes what’s coming to the Windows Insider Program, what’s gradually rolling out, and what’s generally available. Highlights for the Windows 11, version 23H2 update: This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. This update addresses an issue where File Exp
Introduction Starting October 2027 and ending November 2027, we will retire the isAttestationEnforced and keyRestrictionsproperties from the existingfido2AuthenticationMethodConfiguration API schema. This change aligns with the latest update to the passkey policy API schema, which introduces support for granular group-based configurations with passkey profiles. During the retirement period, isAttestationEnforced and keyRestrictions will remain in sync with their counterparts attestationEnforcement and keyRestrictions within the Default passkey profile. When this will happen Retirement begins in mid-October 2027 and is expected to complete by early November 2027. How this affects your organization: You are receiving this message because our reporting indicates your organization may be using this feature. Who is affected: Admins managing FIDO2 authentication configurations and any custom a
Windows is embedding intelligence into systems, silicon, and hardware so you can move from AI experimentation to execution at scale. Because every organization approaches AI differently, Windows gives you the choice and control to decide how agents fit into your workflow so when you use them, you can do so with confidence and transparency. Catch up on the Windows AI innovations we’re sharing at Microsoft Ignite and find out what they mean for your organization. When will this happen:This week at Microsoft Ignite, we announced:Windows security and resiliency innovations to help mitigate risk The ability to scale resiliency with new recovery tools Ways to improve your update experience with Windows Autopatch update readiness, quality update reports, and automatic or manual approvals for security, non-security, and out-of-band updates Sysmon functionality coming natively to Windows 11 and W
(Update: This message was updated to reflect the availability of the updated November 2025 Scan Cab.) Microsoft has identified an issue where some Windows 10, version 22H2 devices enrolled in Extended Security Updates (ESU) for commercial customers might fail to install the November 2025 security update (KB5068781) with error 0x800f0922 (CBS_E_INSTALLERS_FAILED). This issue is isolated to devices whose Windows OS licenses were activated via Windows subscription activation through the Microsoft 365 admin center. The organizations affected by this issue can resolve it by installing KB5072653: Extended Security Updates (ESU) Licensing Preparation Package for Windows 10, which was released on November 17, 2025. Once you install this preparation package (KB5072653), you will be able to deploy the November 2025 security update (KB5068781). Note: A new Scan Cab including metadata for KB5072653
IMPORTANT: This notice is only relevant for environments where:Windows Server Update Services (WSUS) is used to deploy Windows security updates to Windows 10, version 22H2 devices enrolled in Extended Security Updates (ESU). Scan Cab is used to check for update compliance The November 2025 Scan Cab was deployed before 12:00 PM PT on November 18, 2025. An updated version of the November 2025 Scan Cab was made available at 12:00 PM PT on November 18, 2025. This Scan Cab includes new metadata for KB5072653 corresponding to a new update released for Windows 10, version 22H2 devices enrolled in ESU. This release (KB5072653) contains a new Extended Security Updates Licensing Preparation Package for Windows 10, and it addresses a recent known issue. See the additional information section of this message for details. How this affects your organization:IT administrators who downloaded the Scan Ca
Secure Boot helps ensure that only trusted software runs during the boot sequence. It uses cryptographic keys, known as certificate authorities (CAs), to validate that firmware modules come from a trusted source. After 15 years, the Secure Boot certificates that are part of many Windows systems will start expiring in June 2026. These certificates were originally issued in 2011. Many Windows PCs manufactured since 2024 already have updated (2023) certificates. For the remaining devices, we recommend that you start monitoring the progress of certificate updates today as well as prepare for and install new certificates on devices that aren’t automatically getting them through Windows updates. An initial set of tools and guidance is now available to support you in this effort. When will this happen:While Microsoft will deliver the new 2023 Secure Boot certificates through Windows monthly upd
If you are an IT admin with questions about managing and updating Windows, we want to help. Every third Thursday of the month, we host a live chat-based event on the Tech Community called Windows Office Hours. Members of the Windows, Microsoft Intune, Windows Autopilot, Windows Autopatch, and Windows 365 engineering teams will be standing by to answer your questions. We also have experts from FastTrack, the Customer Acceleration Team, and Microsoft public sector teams. Want to attend the November 20 session of Office Hours? Add it to your calendar and select Attend on the event page to let us know you’re coming. There is no video or live meeting component. Simply visit the event page, log in to the Tech Community, and leave your questions in the Comments section. You can also bookmark https://aka.ms/Windows/OfficeHours for upcoming dates (and the ability to add this event to your calenda
The power of automated Windows update management is coming to government SKUs. This cloud-based service has now been approved to be added to the Azure FedRAMP High Provisional Authorization to Operate. If you manage Government Community Cloud (GCC) devices, this service became part of Microsoft 365 Government this month. When will this happen: Windows Autopatch is available to US government organizations starting November 2025. How this will affect your organization: This is what Windows Autopatch allows you to accomplish for your GCC devices: Control over which content is approved for deployment to which devices Automation of a safe rollout process Faster security with hotpatching Pausing or expediting monthly quality updates or drivers Simplified update compliance reporting Policy management and reporting through the Microsoft Intune admin center What you need to do to prepare: Review
Today, November 11, 2025, Windows 11, version 23H2 (Home and Pro editions) has reached end of servicing. The November 2025 monthly security update is the last update available for these editions. Devices running these editions will no longer receive monthly security and preview updates containing protections from the latest security threats. As always, we recommend that you update your devices to the latest version of Windows 11. For detailed information, see the Windows 11, version 23H2 reaching end of updates (Home, Pro) lifecycle page. For information about servicing timelines and lifecycle, see Windows 11 release information, Lifecycle FAQ - Windows, and Microsoft Lifecycle Policy search tool.
Microsoft has identified an issue in the Windows 10 Consumer Extended Security Update (ESU) enrollment process where the enrollment wizard may fail during enrollment. If you have a personal device running Windows 10 and have not yet enrolled your device in the Consumer ESU program, here are the steps you need to take to ensure you continue receiving security updates:Navigate to the Windows Update settings page and select “Check for updates.” Install the out-of-band (OOB) update (KB5071959) and reboot your device to complete installation. Run the Windows 10 Consumer ESU enrollment wizard to enroll your device in the ESU program. After you have successfully enrolled your device, navigate once more to the Windows Update settings page and select “Check for updates.” Your device will now be offered the latest monthly security update. Install the update and reboot your device to complete insta