Windows 11 Upgrade Checklist for Small Business (TPM, Apps, and Rollout Order)

Most Windows 11 upgrade guides tell you what Windows 11 is. This one assumes you already know and just need to move a fleet without generating a week of support tickets.

There is one detail that reframes the whole project, and it is the thing most articles get wrong: if you upgrade machines to Windows 11 version 24H2 right now, Home and Pro editions stop receiving updates on October 13, 2026. That is roughly two months away. The correct target for any migration starting today is 25H2. Land on the wrong version and you will do this twice.

Know which version you are targeting

As of August 2026 the servicing picture looks like this:

• 25H2 — released September 2025. Home/Pro supported to October 12, 2027; Enterprise/Education to October 2028. This is your target.
• 24H2 — Home/Pro end October 13, 2026; Enterprise/Education October 2027.
• 23H2 — Home/Pro already ended; Enterprise/Education November 2026.
• 26H1 — released February 2026, and not what it sounds like.

26H1 is a specialized silicon-enablement release, shipped preinstalled only on select new devices starting with Qualcomm Snapdragon X2. It is not offered through Windows Update and cannot be installed as an in-place upgrade. It sits on a different Windows core and does not roll forward to the next annual release through the normal path. Microsoft’s own guidance is to deploy 24H2 and 25H2 for broad organizational deployment.

Practical consequence: if someone buys a Snapdragon X2 laptop this year, it may arrive on 26H1 and sit on a different servicing track than everything else you own. Note it, plan around it, do not fight it.

Support runs 24 months for Home and Pro, 36 months for Enterprise and Education, with cumulative updates on the second Tuesday of each month.

Two very different upgrade paths

Getting from 24H2 to 25H2 is an enablement package. The files are already staged on a patched 24H2 machine; the package flips them on. One restart, a couple of minutes.

Getting from Windows 10 22H2 to Windows 11 25H2 is a full feature-update install. Multi-gigabyte download, full upgrade experience, 45 to 90 minutes on an SSD and two to three hours on a spinning disk. Budget accordingly — these are not the same operation.

Phase 1: inventory before you touch anything

Microsoft publishes a free hardware readiness script that returns structured output — a return code, a reason string naming exactly what failed, and a plain CAPABLE or NOT CAPABLE verdict. For a shop without Intune, this is the right tool. Grab it from aka.ms/HardwareReadinessScript.

One warning: there is a module on the PowerShell Gallery named HardwareReadiness that is not published by Microsoft — it is a third-party adaptation. Use the aka.ms link for the genuine article.

For the remediable items, PowerShell is faster:

Get-Tpm    # presence, enabled, activated

# TPM spec version -- Get-Tpm does NOT give you this
(Get-CimInstance -Namespace 'root\CIMV2\Security\MicrosoftTpm' `
                 -ClassName Win32_Tpm).SpecVersion

# Secure Boot -- THROWS on legacy BIOS, so wrap it
try { $sb = Confirm-SecureBootUEFI } catch { $sb = 'NotUEFI' }

$env:firmware_type                      # UEFI or Legacy
Get-Disk | Select Number,PartitionStyle # GPT or MBR
Get-CimInstance Win32_Processor | Select Name
Get-Volume -DriveLetter C | Select Size,SizeRemaining
reagentc /info                          # WinRE health

Fan it out with Invoke-Command -ComputerName (Get-Content hosts.txt) and export to CSV.

Two things to know. Confirm-SecureBootUEFI throws an error on legacy BIOS rather than returning false — an unguarded loop will blow up on exactly the machines you most need to find. And hand-rolled PowerShell cannot properly judge CPU eligibility; it gives you a model string, but eligibility means matching Microsoft’s published supported-processor list. Use the readiness script for the CPU verdict and PowerShell for everything fixable.

Free space: the documented minimum is 64GB capacity, but clear 20–25GB before attempting an in-place upgrade. That is operational advice, not a Microsoft number.

End of this phase you should have a CSV with every device sorted into four buckets: ready, firmware-fixable, needs disk conversion, and replace. Our laptop management guide covers building that list, and the IT Asset & Inventory Tracker has the columns ready if you would rather not build the spreadsheet.

Phase 2: recover the machines that look ineligible

Most “failing” business machines from 2016 onward are fixable. Two interventions do the heavy lifting.

Enable the firmware TPM. Get-Tpm reporting TpmPresent: False usually means switched off, not absent. On Intel it is Platform Trust Technology (PTT), typically under Security or Advanced → PCH-FW Configuration. On AMD it is fTPM. Update the BIOS first on older AMD boards — enabling fTPM on some Ryzen systems caused periodic stuttering until AMD shipped a firmware fix.

Convert MBR to GPT. For machines still booting legacy:

manage-bde -protectors -disable C: -RebootCount 0
mbr2gpt /validate /disk:0 /allowFullOS
mbr2gpt /convert /disk:0 /allowFullOS

Validation fails if the disk has more than three primary partitions, any extended or logical partitions, or missing free space at either end. OEM images carrying both a recovery partition and a diagnostics partition hit this routinely — which is exactly why you validate first.

Then get the order right, because this is where machines stop booting:

1. Back up or image the machine
2. Suspend BitLocker and have the recovery key in hand
3. Validate, then convert
4. Reboot straight into firmware setup — not into Windows
5. Switch boot mode to UEFI and disable CSM/legacy boot
6. Enable Secure Boot (you may need to restore factory keys first)
7. Enable PTT or fTPM
8. Boot Windows and verify: Confirm-SecureBootUEFI returns True, Get-Tpm shows present and enabled, spec version reads 2.0
9. Check reagentc /info — confirm WinRE survived
10. Re-enable BitLocker by deleting and recreating the protectors, not just resuming

The number one failure is converting and then booting normally without switching the firmware to UEFI. The disk is GPT, the firmware is still legacy, and there is no boot device. Microsoft’s own output warns about it and people skip past it every time.

Anything with a pre-8th-gen Intel or pre-Ryzen-2000 CPU is not recoverable. That is a purchase decision, and the ESU clock is the forcing function.

Phase 3: find what will actually break

Microsoft cites App Assure data showing 99.7% of Windows 10 apps are compatible. That is their figure, and broadly it holds. The 0.3% is where your week goes.

What genuinely breaks in a small business:

• WMIC was uninstalled by the 25H2 feature update. Any .bat or .cmd calling wmic.exe stops working. WMIC is buried in old inventory scripts, printer scripts, and vendor installers. It is reinstallable as an optional feature, but Microsoft explicitly says do not — it is going away entirely.
• PowerShell 2.0 was removed in 25H2. Anything invoking powershell -version 2 fails.
• Print drivers — the live one. Since July 1, 2026, Windows prefers the inbox IPP class driver over third-party printer drivers. On Windows 11 and newer only. A machine moving from Windows 10 may silently pick up the class driver instead of the manufacturer’s, losing finishing, stapling, tray selection, and departmental accounting on your MFP. Test every copier feature after the first upgrade — this deserves its own checklist line.
• NTLMv1 was removed in 24H2, which breaks authentication to very old NAS boxes and appliances. DES went in September 2025.
• WordPad is gone (October 2024), as are Paint 3D, IE11, and HomeGroup. Mail and Calendar are replaced by new Outlook.
• Legacy VPN clients. Multiple Windows 11 cumulative updates have broken third-party VPN connectivity, generally older IKEv2/L2TP clients and aging network filter drivers. Treat “confirm the VPN client is a currently supported version” as a hard gate before any ring goes out.

One myth to kill: Windows 11 did not break 32-bit applications. They run fine under WOW64. 16-bit applications do not run on any 64-bit Windows, including Windows 10, so that is not a regression. The real-world failure people misattribute here is a 32-bit Access database driver against 64-bit Office — an Office bitness problem, not a Windows problem.

Free tooling: run setup.exe /compat scanonly from the Windows 11 media on one machine per hardware and software profile. Exit code 0xC1900210 means clean, 0xC1900208 means compatibility issues found. When an upgrade fails, SetupDiag root-causes it from the Setup logs.

Microsoft’s App Assure program will help remediate app compatibility at no cost, but its own documentation says it provides no emergency support and no response-time SLAs, and Microsoft’s pages conflict on whether there is a 150-device minimum. Submit the request — it takes five minutes and costs nothing — but do not build the project plan around getting help.

Phase 4: rings, in the right order

Microsoft publishes a five-step planning framework but gives no specific ring counts or percentages, so treat the numbers below as a working recommendation rather than vendor guidance.

Phase	Scope	Soak
Ring 0 — pilot	2–3 devices: you, plus one power user in the most application-heavy role	10–14 days
Ring 1 — early adopters	10–20% of fleet; one device per distinct role and hardware model	2 weeks
Ring 2 — broad	60–70%, in batches of about five per night	2–3 weeks
Ring 3 — critical	Owner, finance lead, the machine running the ancient LOB app	1–2 weeks

Two rules worth following. Never put leadership in Ring 0 — you want a tolerant user who will describe a problem accurately, not one whose bad morning becomes a meeting. And pick the most application-heavy role, usually accounting or operations, because that is where breakage surfaces.

Realistic total elapsed time for 25 to 50 seats: 8 to 12 weeks. Not two weekends.

Schedule batches Tuesday through Thursday evenings. Never Friday — nobody is there Saturday to fix it. Never Monday — you will spend the whole week firefighting. Avoid month-end close, payroll runs, and year-end entirely.

In-place or wipe-and-load

Default to in-place. It takes 45 to 90 minutes instead of three to five hours, preserves local accounts and profiles, and — critically for a shop with no test lab — it can be rolled back.

Wipe-and-load only when the machine is already misbehaving, ownership is changing, or MBR2GPT validation failed and the partition layout needs rebuilding. Note that a rebuild means going through OOBE, where the Microsoft account requirement now bites. In-place upgrades sidestep that entirely because existing local accounts carry forward.

For a scripted in-place upgrade:

setup.exe /auto upgrade /quiet /eula accept /compat ignorewarning ^
  /migratedrivers all /dynamicupdate enable /noreboot ^
  /copylogs \\server\share\upgradelogs

/eula accept is required with /quiet. /copylogs to a share is what saves you when a machine fails at 3am.

Rollback, and how people accidentally lose it

You get 10 days by default. Extend it:

DISM /Online /Get-OSUninstallWindow
DISM /Online /Set-OSUninstallWindow /Value:30    # valid range 2-60
DISM /Online /Initiate-OSUninstall

Run the extension as a post-upgrade task on first login of every machine. Values below 2 or above 60 are silently ignored and revert to 10.

Rollback dies when the window expires, when someone deletes C:\Windows.old, or — most commonly — when Disk Cleanup or Storage Sense removes “Previous Windows installation(s).” Storage Sense does this automatically on low-disk machines, which means your tightest machines lose the safety net first. Windows.old runs roughly 10–25GB.

And be clear about what rollback is: it reverts the OS. Applications installed after the upgrade and some profile changes do not survive cleanly. It is a business-continuity tool, not a backup. Image Ring 0 and Ring 3 machines properly regardless.

How to actually push it

For 20 to 50 seats, manual and USB is genuinely fine. Beyond that:

• Windows Update for Business policies — free, works on Pro, set the target release version to 25H2 with deferrals. Best free control plane for a small AD shop.
• Intune feature update policies — if you are already on Intune. Set feature-update deferral in your update rings to 0 or the policy will not apply.
• Windows Autopatch — the sleeper. Microsoft 365 Business Premium now qualifies, and Business Premium already includes the Entra ID P1 and Intune prerequisites. Devices must be corporate-owned and Intune-enrolled; BYOD is blocked. There is no documented minimum device count.
• WSUS — do not stand up a new one. It is deprecated and no longer in development, and a July 2026 metadata incident took WSUS sync down for over a week.

What your users will complain about

Get ahead of these in the announcement email and you will halve your ticket volume:

1. The right-click menu is truncated. Shift+F10, or “Show more options.” This generates more tickets than everything else combined.
2. The taskbar cannot be moved to the top or sides. Not configurable. Just tell people.
3. The Start menu pins and searches differently.
4. WordPad is gone — have an answer ready for whoever still opens .rtf files.
5. Task Manager reports memory speed in MT/s rather than MHz and realigns CPU metrics.

On the admin side: Recall is disabled and removed by default on commercially managed devices, and it requires Copilot+ hardware most fleets do not have. The clean message to staff is “it is off, we are not turning it on, and your laptop cannot run it anyway.”

Key takeaways

• Target 25H2, not 24H2 — 24H2 Home/Pro loses support October 13, 2026.
• 26H1 is a hardware-specific preinstall release, not an upgrade path.
• Firmware TPM and MBR2GPT recover most “ineligible” machines for free; CPU generation is the only unfixable barrier.
• Convert, then boot to firmware and switch to UEFI — skipping that step is the top cause of unbootable machines.
• WMIC and PowerShell 2.0 are gone in 25H2; check your scripts. Test every MFP feature after the first upgrade.
• Default to in-place upgrades and extend the rollback window to 30 days on first login.
• Storage Sense silently deletes your rollback option on low-disk machines.
• Realistic timeline for 25–50 seats is 8–12 weeks.

Frequently asked questions

Can I upgrade straight from Windows 10 to 25H2? Yes. Windows 10 22H2 upgrades directly to Windows 11 25H2 as a single feature-update install — you do not stop at 24H2 first. Which is exactly why targeting 25H2 costs you nothing extra.

What about machines that fail only on TPM? Check whether the firmware TPM is simply disabled before assuming anything. On business machines from roughly 2016 onward, a BIOS toggle recovers a surprising number of them at zero cost.

Should I wait for 26H2? No. It is expected in the fall and will arrive as a small enablement package on top of 25H2 — one restart. Land on 25H2 now and 26H2 becomes trivial later.