Windows 11 24H2 and Windows 10 LTSB 2016 just hit end of updates — here's what you should do now
Today is the last day these Windows versions get security fixes. If you are still on an affected edition, this is the month to move to a supported Windows 11 release.
Microsoft on October 13, 2026 marked the end of updates for two Windows versions: Windows 11, version 24H2 (Home and Pro editions), and Windows 10 Enterprise LTSB 2016.
Microsoft says explicitly: “Today, October 13, 2026, Windows 11, version 24H2 Home and Pro, and Windows 10 Enterprise LTSB 2016 have reached end of updates. The October 2026 monthly security update is the last update available for these editions.” From now on, these versions stop receiving security fixes.
What ‘end of updates’ actually means
On the support timeline, versions move through three phases. Mainstream support is when a version gets new features, feature updates and security fixes from Microsoft. That phase ended earlier: mainstream support for the current 23H2 and 25H2 channel of Windows 11 is still on, and Windows 11, version 22H2 moved to Extended Support back in July 2025. Today’s milestone marks the point at which 24H2 Home/Pro and 10 LTSC 2016 are the last of their group to fall off the update track, and Windows Server 2025 will stop receiving Windows Defender updates on the same date.
In practical terms, once a version leaves the update track it no longer gets security patches. Any vulnerability discovered later — from a browser exploit to a Zero-Day — will not be fixed for it. Systems that stay on an unsupported Windows build become a growing security liability: exactly the kind of target attackers prefer, because defenders know patching has stopped.
A last patch with real teeth: AD FS enforcement mode
This is not an ordinary ‘last patch’. The same October 2026 Windows security update moves the Active Directory Federation Services (AD FS) Distributed Key Manager (DKM) container ACL hardening into Enforcement mode. Microsoft notes this is “addressed for the elevation of privilege vulnerability described in CVE-2026-56155”.
AD FS is the identity gateway many organizations use for single sign-on and federated access. DKM is a key-management component it can lean on. “Enforcement mode” matters because Microsoft moves a previously relaxed access-control check from advisory (monitor-only) into hard (enforced), closing off a privilege-escalation path rather than just flagging it. For a version that is about to stop being patched, this enforcement change is the strongest nudge it gets: apply the October update to keep the AD FS hardening in effect.
Who is most at risk
- Home and Pro desktops still on Windows 11 24H2 — the mainstream consumer and many business fleets
- Windows 10 Enterprise LTSB 2016 machines in long-lived, rarely-refreshed enterprise environments
- AD FS servers that were relying on the DKM container ACL hardening before it moved to Enforcement
- Any on-premises identity or authentication infrastructure that skips Windows security releases
Once you are on an unsupported build, the only protection left is compensating controls (network isolation, EDR, hardening) — not vendor patches. Upgrade, or accept a higher risk posture for as long as you stay put.
What this means for you
- If your desktops run Windows 11 24H2 Home or Pro, plan a move to a Windows 11 release that is still receiving updates
- If IT owns Windows 10 LTSC 2016 machines, treat them as out-of-support and re-evaluate refresh, isolation or a maintained alternative
- If you operate Azure or on-premises AD FS, apply the October 2026 security update and verify the DKM container ACL hardening is in Enforcement mode
- Verify your build under Windows > Settings > System > About to confirm the version and build number
End-of-update milestones are a quiet, recurring reminder that an OS version is not a permanent address. The fix is straightforward — move to a supported Windows 11 release and keep applying the monthly security updates you do have. The cost of doing nothing is the accumulated, unpatched exposure that builds the longer you stay on a build the vendor has stopped protecting.
Sources: Microsoft Windows Message Center; Spiceworks: Windows 11 24H2 hits end of updates Oct. 13; BleepingComputer: Microsoft security news.
Corrections: Report an error at corrections@wireshaman.com.