Microsoft has initiated an automated, machine-learning-driven rollout to upgrade unmanaged Windows 11 devices to version 24H2. While the security improvements in 24H2 are substantive, the forced nature of this rollout creates operational, compliance, and security governance challenges that enterprise teams must address proactively.
What Is Changing and Why It Matters
Windows 11 24H2 introduces several significant security enhancements: improved Smart App Control capabilities, expanded Windows Protected Print Mode, enhanced Credential Guard defaults, and Rust-based kernel security improvements that reduce memory safety vulnerabilities. For organisations still on earlier Windows 11 builds, these improvements are meaningful — particularly the kernel hardening changes that address a class of vulnerabilities that have been actively exploited by APT actors in recent years.
However, Microsoft’s use of ML-based automatic upgrade targeting for unmanaged devices introduces risks of its own. Devices that receive the upgrade outside of a managed change management process may:
- Experience compatibility issues with legacy enterprise applications not yet validated against 24H2.
- Bypass configured Windows Update for Business Group Policies in misconfigured environments.
- Receive the upgrade during production hours, causing unexpected reboots and operational disruption.
- Introduce configuration drift if 24H2-specific security defaults differ from organisational baselines.
Security Governance Considerations
For organisations operating under APRA CPS 234, ISO/IEC 27001:2022, or ASD Essential Eight requirements, uncontrolled OS upgrades on endpoints represent a configuration management risk. The ASD Essential Eight’s Application Control and Patch Operating Systems controls both depend on known, validated endpoint states. An automated OS upgrade that has not been through the organisation’s change management process violates the foundational assumption of those controls: that the environment is known and intentionally configured.
Organisations using Microsoft Endpoint Manager (Intune) or WSUS for update management should verify that their deferral policies are applied correctly and that the 24H2 automatic rollout is not bypassing them. The ML-based targeting reportedly applies to devices Microsoft determines are “ready for upgrade” — but the criteria used by Microsoft’s algorithm may not align with organisational readiness criteria.
Practical Steps for Security and IT Teams
- Audit endpoint compliance status: Identify all devices currently on Windows 11 builds prior to 24H2. Determine which are managed versus unmanaged.
- Verify Update policy enforcement: Confirm that Windows Update for Business deferral settings are correctly applied and are not being overridden.
- Validate CIS Benchmark alignment: Microsoft has published a CIS Benchmark for Windows 11 24H2. Review the delta from the prior benchmark and identify any new security defaults that require explicit configuration.
- Test application compatibility: Run compatibility validation against business-critical applications before allowing the 24H2 upgrade to proceed in production.
- Update your CIS L1/L2 baseline documentation to reflect 24H2 configurations, particularly for Credential Guard, Smart App Control, and kernel protection settings.
The Broader Observation: Vendor-Driven Change Management Risk
This event illustrates a recurring challenge in enterprise security: the tension between vendor-driven update cadences and organisational change management processes. Cloud-era software increasingly assumes continuous, automatic updates — a model that conflicts with the controlled, evidence-based change management that security governance frameworks require.
The resolution is not to resist updates — prompt patching is a core security control. It is to ensure that the managed update process is fast enough that unmanaged devices represent a genuinely small population, and that the governance frameworks acknowledge and manage the risk of vendor-initiated changes.
References and Further Reading
- Microsoft — Windows 11 24H2 Release Notes and Security Changelog
- CIS Benchmark for Windows 11, Release 24H2 — cisecurity.org
- ASD Essential Eight Maturity Model — Patch Operating Systems (2023)
- Microsoft Learn — Windows Update for Business Configuration
- NIST SP 800-128 — Guide for Security-Focused Configuration Management
CISSP Made Easy 