The news
Microsoft (MSFT) began rolling out the Windows 11 2026 Update, also called version 26H2, on September 29, 2026. For most PCs on recent versions, it arrives as a small package that switches on features Microsoft has already been shipping through monthly updates.
John Cable, Microsoft's vice president of product management for Windows servicing and delivery, wrote that version 26H2 comes as an enablement package for eligible devices running versions 24H2 and 25H2. Because the three versions share a common servicing branch and code base, the install typically needs only a small download and a single restart. Microsoft is using a controlled feature rollout, so not every PC will be offered the update at once, and it may place safeguard holds on devices with known compatibility issues.
For businesses, the update is available through Windows Autopatch and the Microsoft 365 admin center, though Microsoft said downloads in the admin center may be delayed. The company recommends targeted deployments to test applications, devices and critical workflows before a wider rollout. Installing 26H2 resets the support lifecycle: 24 months for Home and Pro editions and 36 months for Enterprise and Education. Microsoft said the first monthly security update for 26H2 is slated for October 13, 2026.
Three features that sat behind temporary commercial controls in version 25H2 are now on by default for commercial devices: Windows settings backup, which preserves supported settings and Microsoft Store app lists for device replacement, app-specific actions from the taskbar, and a set of File Explorer improvements. Microsoft said existing administrator policies for settings backup are still honored.
Microsoft's documentation also lists features gathered over the past year. They include administrator protection, which grants admin rights just in time, and a built-in version of the Sysmon event-logging tool, both off by default. Others are API support for the post-quantum encryption standards ML-KEM and ML-DSA, point-in-time restore for rolling a PC back, and AI actions in File Explorer. The Copilot Summarize action for OneDrive and SharePoint files requires a Microsoft 365 subscription and a Copilot license. Microsoft also lists the WMIC command-line tool as removed from version 24H2 and above.
BleepingComputer, which reported the release, said most users probably will not notice a big difference. It also reported that PCs that shipped with Windows 11 version 26H1, which uses a different Windows core, cannot move to 26H2, and quoted Microsoft as saying those devices will get a path to a future release.
The numbers
- Support after installing 26H2 (Home, Pro)
- 24 months
- Support after installing 26H2 (Enterprise, Education)
- 36 months
- Versions eligible for the enablement package
- 24H2 and 25H2
- First monthly security update for 26H2
- October 13, 2026
- Features newly on by default for commercial devices
- 3
Why CEOs should care
For CIOs and IT leaders, the install is the easy part. Because 26H2 behaves like a monthly patch on 24H2 and 25H2 machines, moving a fleet buys a fresh 36-month support window for Enterprise and Education editions at low deployment cost. The real work is policy review: check how the newly default-on settings backup, taskbar actions and File Explorer changes interact with your configurations, run a pilot ring, and watch Microsoft's Windows release health hub for safeguard holds before expanding.
For CISOs, several of the most useful security features do nothing until someone turns them on. Administrator protection and built-in Sysmon are off by default, so decide whether to enable them through Intune or Group Policy. Inventory kernel drivers from older hardware and niche software, since Windows now removes default trust for cross-signed drivers. Find scripts that still call WMIC, because they will need to be rewritten. Post-quantum APIs are also a prompt to start a cryptography inventory.
For CFOs and procurement teams, the AI features come with license strings attached: summarizing OneDrive and SharePoint files from File Explorer needs a Microsoft 365 subscription and a Copilot license. When buying new PCs, ask vendors which Windows version they ship with, since BleepingComputer reports that devices on 26H1 follow a separate update path.
The bigger picture
Windows has moved to continuous delivery. New features arrive in monthly updates, some of them switched off by default for business PCs, and the annual release mostly resets support timelines and flips selected defaults. That makes the yearly update less disruptive but puts the burden on IT teams to track changes month by month rather than once a year.
The driver change shows the security side of that shift. In a March 26 post, Microsoft said the cross-signed root program, introduced in the early 2000s and deprecated in 2021, had led to abuse and credential theft. It said the new kernel trust policy would apply to Windows 11 24H2, 25H2, 26H1 and Windows Server 2025 starting with the April 2026 update, with an allow list for a limited number of widely used, reputable cross-signed drivers.
What’s next
The first monthly security update for 26H2 is slated for October 13, 2026. Microsoft said it will expand availability over time and post known issues and safeguard holds on the Windows release health hub. For organizations with new 26H1 devices, the question is when Microsoft spells out their path to a future release.
What “Fact-checked” means
Fact-checking means testing a story’s facts against the evidence before it is published. This story went through at least two separate checks before this version was published.
- What we checked
- Its names, figures, dates, job titles, quotes and who said what were checked against the story’s sources, including its main source where it could be opened. The headline was checked for accuracy and overstatement.
- How
- A first check reviewed the whole story. If it passed, a second, skeptical check went back to the sources to look for mistakes in the most important facts. If a check flagged the story, it was edited to fix the problems found, and a separate re-check then reviewed the whole story again.
- Who
- The checks are made by our newsroom, as steps kept separate from the writing, under rules set by our editor, Hussein Mukhtar. A story the checks still flag is held for the editor, who decides whether it is fixed, published or dropped.
- If something is wrong
- “Fact-checked” does not mean error-free. If a material error is found after publication, we correct the story and add a note saying what changed. Report an error
Companies in this story
