Here’s what caught my attention this week.
Windows 11 23H2 Enterprise and Education are almost at the end of servicing, Intune has added more control over Windows update timing, and there’s an explanation of a certificate-renewal issue that can leave the Intune Management Extension unable to do its job.
Windows 11 23H2 Enterprise and Education reach end of support next week
November 10 is the last update release date for Windows 11 23H2 Enterprise, Education, and IoT Enterprise editions. After that, these devices will no longer receive monthly security updates.
If you still have 23H2 in your environment, this is a good time to check your remaining device counts and upgrade progress. Windows 11 25H2 is a supported destination, with Enterprise and Education support running through October 2028.
Microsoft’s Windows 11 23H2 release health page · Windows 11 release and lifecycle information
Intune can now control timing separately for different quality update types
Benoit Hamet spotted a useful change in the Intune Quality Updates experience. Administrators can now configure different deployment timing for monthly updates, non-security updates, and out-of-band updates.
Previously, these update types shared the same Windows Update policy behavior, which made it harder to handle preview and out-of-band releases differently from the normal monthly security update.
You can find the controls under Devices > Manage Updates > Windows Updates > Quality Updates. If you’re already using a quality update policy, including one configured for hotpatch, check the existing policy for the new options.
A good use case for this would be to keep monthly security updates moving while being more deliberate about optional and emergency releases.
Windows Ready Print driver ranking is worth reviewing
Peter van der Woude published a walkthrough of the Windows Ready Print driver ranking setting, which is now part of the Windows 11 26H2 security baseline.
The setting, ConfigureWindowsReadyPrintDriverRanking, controls whether Windows prefers the Microsoft IPP Class Driver when installing compatible printers. It’s enabled by default in the baseline and can be configured through the Intune Settings Catalog under Printers.
One thing go note is that this doesn’t completely block manufacturer drivers like Windows Protected Print Mode does. It changes the driver ranking for new printer installations that support IPP. Existing printers and printers installed directly using TCP/IP aren’t affected.
A missing ValidNodePaths entry can break Intune certificate renewal
Rudy Ooms investigated a case where the Intune Management Extension kept disappearing and the device’s MDM certificate wasn’t renewing. The investigation led to an incomplete registry list under HKLM\SOFTWARE\Microsoft\Enrollments\ValidNodePaths.
During certificate renewal, Windows checks the settings returned by Intune against this allowlist. If the CertificateStore node isn’t present, Windows can reject the provisioning response with 0x83750005 (Failed to Parse Provisioning XML), even though Intune successfully returned the replacement certificate.
The particularly interesting detail is how Windows handles an incomplete list. If the registry key has no entries, Windows uses a built-in fallback list. But if even one entry remains, Windows uses the entries it finds and doesn’t fill in the missing defaults. A partially deleted list can therefore cause a problem that an entirely missing list doesn’t.
This is worth keeping in mind when troubleshooting devices with certificate renewal problems, especially if you’ve used scripts to clean up old enrollment records. The key is shared across enrollments, so cleanup routines need to be careful not to remove it or its contents.
Rudy’s investigation and troubleshooting details
Microsoft wants organizations to measure patching in days, not cycles
Microsoft published an update on its vulnerability management approach, including how AI is being used to accelerate vulnerability discovery, remediation, and validation.
There’s one statistic that stood out. In a measured Windows enterprise sample from August 2026, fewer than half of devices had installed the security update two weeks after release. About one in four still hadn’t installed it after four weeks.
Microsoft’s recommendation is to measure protection in days from release rather than thinking only in terms of patch cycles. A deployment can be technically successful and still leave a significant portion of the environment exposed for weeks.
Microsoft’s update on vulnerability management
That’s it for this week.
Do you have a suggestion for this newsletter? Let me know in the comments.