Windows 11 25H2 showed up without much fanfare at the end of September, and I've already heard the usual sigh of relief from IT teams. Like 24H2 earlier this year, it comes as an enablement package, so the upgrade is quick and low-risk: one reboot, no in-place reinstall, and the support clock starts over. Windows 11 Enterprise and Education now get a full 36 months of support, which helps a lot if you plan your device lifecycle well ahead. For the fine print, bookmark the official Windows 11 release health page and the overview of what's new in 25H2.
25H2 adds little on the surface but removes PowerShell 2.0 and WMIC
At first glance 25H2 looks like a minor update. Underneath, Microsoft has done some serious housekeeping, because PowerShell 2.0 and WMIC are gone completely. Plenty of environments still run old scripts or tools that depend on these components, so audit your scripts before you start the upgrade. Everything else is what we've come to expect: security fixes, bug fixes and a stable, unified servicing branch without major UI changes. The bigger news is the 36-month lifecycle for Enterprise and Education. In heavily regulated industries, that by itself is reason enough to move to 25H2 early.
Intune feature update policies and Autopatch both handle the rollout
In my projects I see two practical ways to get Windows 11 25H2 out to devices. The first is Intune feature update policies. You target the new version, stage the deployment and throttle it across test and production groups, much as you did for the 24H2 rollout. The second, which larger tenants use more and more, is Windows Autopatch. It takes care of deployment rings, testing and monitoring as a service. Whichever route you pick, the enablement package keeps downtime short and rolling back is close to painless.
Practical tip: Always start with a pilot on a controlled Azure AD group and concentrate on business-critical apps. The new 36-month support cycle doesn't help you much if you spend the weeks after the upgrade chasing legacy dependencies.
Windows 10 devices should go straight to 25H2
Many organizations are still planning their move off Windows 10, and with end of support close, they have to decide which Windows 11 release to target. For most of them I'd go directly to Windows 11 25H2. It shares its servicing base with 24H2 but starts a new support window, and it includes the latest security and compatibility updates. If you're still in the planning phase, don't spend time on older releases. I cover app readiness and migration blockers in more detail in my post on Windows 11 migration with endpoint analytics.
App testing has to cover the removed legacy components
Enablement packages have made upgrades almost boring, but that doesn't mean you can skip app validation. Without PowerShell 2.0 and WMIC, tools will break wherever the toolchain hasn't been fully modernized. Check your scripts and third-party packages before the rollout, then run a smoke test to make sure the core business workflows still work. If you have Endpoint Analytics, use it as an early warning for failures you might not spot otherwise.
This PowerShell line (run as local admin, for example through an Intune script) shows whether WMIC is actively in use:
Get-WmiObject -Class Win32_Process | Where-Object { $_.Name -like 'wmic.exe' }
Intune can strip preinstalled Store apps from the image
Enterprise admins keep asking for a Windows image without bloat. Microsoft has improved things with every Windows 11 Enterprise release, 25H2 included, yet a few Store apps you don't want will always remain. In Intune you can now remove preinstalled apps with a simple policy, either through a PowerShell script or through the dedicated setting in Endpoint Manager. That means fewer surprises and fewer support calls after the upgrade.
The enablement package switches on 25H2 with a single reboot
The diagram below shows the usual upgrade sequence for Windows 11 25H2. The enablement package activates the new features and the new support period but leaves the core system alone, which makes testing and rollback far easier to handle.
flowchart TD
A["Windows 11 24H2 installed"] --> B["Enablement package 25H2 delivered"]
B --> C["Quick install, 1 reboot"]
C --> D["25H2 active, 36 month support"]
Figure: The Windows 11 25H2 enablement upgrade as it runs in practice.
Feature updates run smoothly, but the homework still matters
Windows 11 25H2 is a maintenance release that Microsoft got right. It installs fast, behaves predictably and is easy to manage with Intune or Autopatch. If you still have Windows 10 devices around, make 25H2 your target and use the move to tidy up your environment. The teams that get the most out of it are the ones that treat feature updates and app testing as a real cleanup, not just a compliance checkbox. If you want more on staged rollouts and update management, read my article on Windows 11 24H2 rollouts with Intune and Autopatch.
