Windows 11 23H2 Enterprise is out of support: November patch checks

What Microsoft shipped on 10 November

Microsoft released its November 2026 cumulative updates on 10 November US time, which put them on New Zealand machines on Wednesday 11 November. For Windows 11 version 23H2, the update is KB5131087 (OS Build 22631.7711). On that page Microsoft says: "The November 2026 Windows security update is the last update available for these editions." The editions in question are 23H2 Enterprise and Education. The Home and Pro editions of 23H2 lost support in November 2025, so any organisation still running 23H2 now has devices that won't receive another monthly security fix.

The newer versions get KB5132061, which covers 26H2 and 25H2 in all editions plus 24H2 Enterprise and Education. Both packages repair problems caused by October's releases. One was error 87 when adding a printer published in Active Directory. The other was Remote Desktop connections failing on a certificate mismatch after the October preview update. Both packages also bring two security behaviour changes that service desks should plan for: stricter checks on signed PowerShell scripts and NTLM message signing by default.

The behaviour changes most likely to raise tickets

PowerShell now validates UTF-8 encoding more strictly when it checks script signatures. Microsoft's notes for KB5132061 say signed scripts containing invalid UTF-8 may now fail signature validation, and the fix is to re-save each affected script as UTF-8 with a byte order mark and sign it again. Organisations that enforce an AllSigned execution policy, or that push signed scripts through Intune, Group Policy logon scripts or an RMM tool, carry the most exposure. A script that ran for years can stop with an error the morning after a device updates. Microsoft hasn't published any way to find affected scripts in advance, so the practical test is to run your signed script library on a patched machine before the update reaches every device.

The NTLM change is quieter. Windows clients now offer NTLM message signing by default on non-anonymous connections, which Microsoft says reduces exposure to relay attacks, and the 23H2 notes add auditing for unsigned connections. Microsoft isn't removing NTLM or requiring signing on every connection, so we don't expect much to break. The audit data is the useful part. Older NAS boxes, multifunction printers and line-of-business applications that still use NTLM will show up there, and that list is the starting point for any later move to tighten NTLM.

Known issues already logged

Microsoft lists a problem on 24H2 Enterprise and Education where some devices fail to install the November update, retry repeatedly, or report error codes 0x80070306, 0x800f0989 or 0x800f0993. According to the KB5132061 page, an automatic repair should reach affected devices within 24 to 48 hours from 10am Pacific time on 11 November, which was 7am on Thursday 12 November in New Zealand. Staff can also install the update manually. Service desks should expect a short spike in "update keeps failing" calls from 24H2 fleets this week and can give callers a clear answer.

On 23H2, the KB5131087 notes say the slmgr.vbs /skms-domain and slmgr.vbs /ipk commands may fail with error 0x80041008. Devices that are already activated stay activated. The issue mostly affects machines being set up for KMS activation or activated by script, so imaging and deployment teams will notice it before end users do. A workaround is available through Microsoft Support for business.

Microsoft has also said there won't be a December 2026 non-security preview update in the second half of the month. Teams that normally test the preview release before the January patch can plan their holiday change freeze around that gap.

The security patches sit outside Windows Update

Qualys counted 63 critical vulnerabilities and one exploited zero-day in the November release. Its headline total of 1,235 includes Edge and doesn't match its own product table, which adds up to 1,094. The zero-day, CVE-2026-124194, is an Outlook spoofing flaw. A crafted message can make Outlook connect to a network location controlled by an attacker without showing the usual warning, and that connection can leak authentication information. CISA has added the flaw to its Known Exploited Vulnerabilities catalogue and set US federal agencies a deadline of 24 November 2026.

The Outlook fix isn't included in the Windows cumulative update. Windows Mode reports that the fix ships in the Microsoft 365 Apps and Office LTSC security updates. Organisations that track patch compliance only through Windows Update rings could show 100 percent compliance while Outlook stays exposed. For many NZ businesses, Office updates come through a separate update channel and nobody looks at them closely, which makes this month's Office update a good one to verify.

What it means for NZ organisations

Most of the small and mid-sized NZ organisations we talk to don't run Enterprise or Education editions, but schools, tertiary providers and larger firms with volume licensing often do. Machines left on 23H2 Enterprise or Education now sit outside support. Insurers and auditors who ask about patch currency will treat those devices as unpatched from December onward. KB5131087 being the final update also means the 23H2 known issues listed above will probably never get a permanent fix on 23H2 itself.

The upgrade path is straightforward. Microsoft recommends moving eligible devices to a supported Windows 11 version, and 26H2 became available in September 2026 as an enablement package. Moving within Windows 11 is usually a lighter change than the Windows 10 migration many teams finished last year. It still needs a proper change record, a pilot group and a rollback plan, which is exactly the discipline an ITIL 4 aligned change and release practice is meant to provide.

Practical next steps

• Pull a version report from Intune, Configuration Manager or your RMM tool and list every device still on 23H2, by edition and by owner.
• Raise a standard change to move those devices to 26H2 or 25H2, starting with laptops that leave the office network and machines used for finance or admin work.
• Run your signed PowerShell scripts on a patched test device. Re-save any that fail as UTF-8 with a BOM and re-sign them before broad deployment.
• Turn on or review NTLM audit logging and record which servers, printers and applications still negotiate unsigned NTLM.
• Confirm that the November Microsoft 365 Apps or Office LTSC security update has reached every device running Outlook, and report that separately from Windows Update compliance.
• Add the 24H2 install error codes and the 23H2 slmgr error to your service desk knowledge base so first-line staff can close those calls quickly.
• Change your December test plan to reflect that no preview update is coming, and set the date for January patch testing before staff go on leave.

If you'd like help building patch and change processes that catch issues like these before staff notice them, our IT service management team works with NZ and Australian organisations on exactly that.