Windows 11 November Update: 5 Changes MSPs and IT Teams Need to Know

Microsoft’s latest Windows 11 update fixes several IT headaches, but it also brings a major deadline for businesses running older systems.

Released on Nov. 10, the update addresses Remote Desktop failures, printer installation issues, and security weaknesses, while marking the end of regular security updates for Windows 11 23H2 Enterprise and Education. It also introduces changes affecting authentication and PowerShell scripts that could require additional testing before deployment.

For managed service providers and channel partners, the stakes go beyond routine patching. With hundreds or thousands of customer endpoints to manage, the challenge is keeping businesses secure, avoiding costly disruptions, and identifying which customers need an upgrade before outdated systems become a liability.

What changed in the November Windows 11 update?

Microsoft released KB5132061 for Windows 11 versions 25H2 and 26H2, as well as the Enterprise and Education editions of version 24H2. The company also released KB5131087 for Windows 11 version 23H2.

The updates include security improvements and fixes affecting everyday MSP operations. Some changes apply to particular Windows versions, making it important to review the relevant release notes.

Here are five changes worth watching.

1. Remote Desktop fixes could reduce connection problems

Remote access is essential for MSPs supporting distributed workforces, troubleshooting customer devices, and maintaining business systems.

Microsoft says the November update for Windows 11 versions 24H2, 25H2, and 26H2 addresses Remote Desktop Protocol (RDP) connection failures caused by certificate mismatches following an October 2026 preview update.

Windows 11 23H2 receives a different fix. Microsoft corrected an issue preventing administrators from configuring trusted RDP publisher certificate policies through Microsoft Intune.

For MSPs, both fixes matter. The first could reduce connection-related support tickets, while the second improves administrators’ ability to manage trusted remote connections.

What MSPs should do:

• Identify customers experiencing RDP connection failures.
• Test remote access on affected Windows versions.
• Verify trusted RDP publisher certificate policies in Intune.
• Monitor connection failures after deployment.

Channel Insider previously examined how NinjaOne’s Microsoft Intune integration could help MSPs improve device visibility and management efficiency.

For partners, better endpoint visibility can make it easier to diagnose Windows compatibility issues across customer environments.

2. Printer installation fixes address an enterprise IT headache

Printers rarely generate excitement until they stop working.

Microsoft’s November update fixes an issue that could prevent administrators from adding printers published through Active Directory. Affected devices could display error 87, indicating an incorrect parameter, when users attempted to add printers through Windows Settings.

Microsoft says the problem was introduced by the October 2026 update and generally did not affect printers that were already installed. The fix applies to the Windows versions covered by the cumulative updates, including 23H2, 24H2, 25H2, and 26H2.

For MSPs supporting offices, schools, healthcare organizations, and other printer-dependent environments, that distinction matters. Existing printers may have continued working normally while new installations encountered problems.

What MSPs should do:

• Test Active Directory printer discovery and installation.
• Prioritize customers reporting recent printer setup failures.
• Verify printer access on newly provisioned Windows devices.
• Investigate remaining driver or configuration problems separately.

Identifying these issues before large workstation deployments could prevent unnecessary support calls and installation delays.

3. NTLM security improvements could affect legacy authentication

One of November’s more significant security changes involves NTLM, an authentication technology still used in some Windows environments. Microsoft says the update improves NTLM security by enabling clients to offer NTLM message signing by default for non-anonymous connections.

The change is designed to reduce exposure to NTLM relay attacks while improving auditing of connections that do not use signing. Importantly, Microsoft is not eliminating NTLM or universally requiring signing for every connection.

For MSPs, the security improvement is welcome, but compatibility remains important. Some customers still rely on older applications, devices, or authentication workflows that use NTLM.

What MSPs should do:

• Identify applications and devices that depend on NTLM.
• Review authentication logs and signing audit information.
• Test critical legacy applications before widespread deployment.
• Investigate authentication failures before changing security settings.

This also creates an advisory opportunity for channel partners. MSPs can help customers identify outdated authentication dependencies, evaluate security exposure, and develop modernization plans. Those assessments could support broader identity security and infrastructure consulting services.

4. PowerShell security changes may require script updates

PowerShell is central to many MSP operations, including endpoint configuration, software deployment, maintenance, and automated troubleshooting.

Microsoft’s November update strengthens script signing and signature verification through stricter encoding validation. As a result, scripts containing invalid UTF-8 encoding may fail signature validation even if they were previously accepted. Microsoft advises administrators to review affected scripts, save them using valid UTF-8 encoding with a byte order mark (BOM), and sign them again.

For MSPs who use automated scripts across multiple customer environments, the potential impact warrants attention.

A script that fails validation could interrupt scheduled maintenance or deployment workflows, depending on how the automation is configured.

What MSPs should do:

• Inventory signed PowerShell scripts used in customer environments.
• Test critical scripts on updated Windows devices.
• Check for encoding-related signature failures.
• Correct and re-sign affected scripts.
• Monitor automated maintenance jobs after deployment.

The update highlights a broader challenge for MSPs: automation improves efficiency, but it also requires testing and recovery planning.

Channel Insider previously reported on endpoint management recovery risks, including operational problems that can arise when automated configurations fail.

For partners, maintaining tested scripts and reliable recovery procedures can help prevent small compatibility issues from becoming larger service disruptions.

5. Secure Boot updates continue as certificate changes approach

Microsoft is continuing its transition to newer Secure Boot certificates as older ones expire.

The November updates include additional device-targeting information intended to expand the number of eligible systems that can automatically receive replacement certificates. However, installing the updates does not guarantee every device immediately receives the new certificates.

Microsoft says it will continue delivering replacement Secure Boot certificates to eligible devices through Windows Update over the coming months. Devices that have not yet received the newer certificates can continue to start normally and receive standard Windows updates.

For MSPs, the transition is an ongoing maintenance priority rather than an immediate universal device failure.

What MSPs should do:

• Review Microsoft’s Windows release health guidance.
• Identify devices requiring additional Secure Boot attention.
• Verify firmware compatibility and update readiness.
• Monitor certificate deployment across managed fleets.

These assessments can also inform hardware refresh conversations.

Channel Insider previously explored how AI PCs are changing refresh decisions, with partners balancing security, hardware costs, and business requirements.

Secure Boot readiness adds another consideration when determining whether existing devices should remain in service.

Windows 11 23H2 reaches its final security update

Beyond the five technical changes, November brings an important support deadline. Microsoft confirms that Windows 11 23H2 Enterprise and Education reached the end of regular updates on Nov. 10, 2026.

The security update is the final regular security update for those editions. Devices running these editions will continue functioning, but Microsoft will no longer provide regular monthly security updates. The company recommends upgrading eligible devices to a supported version of Windows 11 to maintain security.

The Home and Pro editions of Windows 11 23H2 had already reached end of support in November 2025.

For MSPs, the deadline creates an immediate need to identify customers still running unsupported versions. Partners should inventory affected endpoints, evaluate upgrade compatibility, and establish migration plans to supported Windows 11 releases.

What MSPs should prioritize before deploying the update

Microsoft reports no known issues with the cumulative updates as of Nov. 11, although individual customer environments may still encounter compatibility problems.

A staged deployment strategy can help MSPs identify problems before they affect entire customer fleets.

Priority	Recommended action
High	Identify unsupported Windows 11 23H2 devices and plan upgrades
High	Test RDP, NTLM authentication, and critical PowerShell scripts
High	Deploy security updates through controlled rollout groups
Medium	Validate printer installations and peripheral compatibility
Medium	Review Secure Boot certificate readiness

Administrators should also verify installation prerequisites, which vary by Windows version.

• Windows 11 26H2: Requires a Windows update released on or after September 22, 2026, and servicing stack update (SSU) version 26100.9539 or later.
• Windows 11 24H2 and 25H2: Require a Windows update released on or after June 10, 2025, and SSU version 26100.4193 or later.
• Windows 11 23H2: Requires a Windows update released on or after July 8, 2025, and SSU version 22621.5619 or later.

These requirements are especially important for MSPs maintaining devices across multiple Windows versions.

MSPs maintaining custom Windows installation images should also heed Microsoft’s deployment warning. When applying Dynamic Updates to existing Windows installation images, administrators must ensure the appropriate boot.stl file is included in the installation media.

Microsoft warns that omitting the file could prevent devices from starting from the installation media and trigger error 0xc0430001. The file must match the Windows version and architecture of the image being updated. Microsoft recommends using its Update WinPE script or manually copying the appropriate file into the installation media.

This warning concerns updating Windows installation images, rather than ordinary cumulative updates installed on running PCs.

For MSPs managing large deployments, overlooking this requirement could delay customer workstation installations or recovery operations.

Why this Windows 11 update matters for channel partners

November’s Windows 11 update demonstrates why patch management remains an important managed service.

The release addresses security concerns and fixes issues that can interfere with remote access, printer installations, and administrative workflows. Meanwhile, the Windows 11 23H2 support deadline gives MSPs another reason to review customer environments and identify devices requiring upgrades.

The immediate priority is straightforward: determine which customers are affected, test critical systems, and deploy updates without unnecessary disruption. The longer-term opportunity is helping businesses improve endpoint security, modernize aging infrastructure, and reduce operational risks.

For channel partners, that combination of technical support and proactive planning can demonstrate the value of managed services well beyond routine patch installation.

Also read: For more on how MSPs can strengthen endpoint security and reduce deployment risks, see Channel Insider’s guide to managed patch management best practices.