BEGIN:VCALENDAR VERSION:2.0 PRODID:-//KBY Technologies//Admin Deadlines//EN CALSCALE:GREGORIAN METHOD:PUBLISH X-WR-CALNAME:KBY admin deadlines (Windows) X-WR-CALDESC:Microsoft and Apple retirements\, deprecations\, enforcement d ates and end-of-support dates for endpoint and identity admins. Each date is quoted from the vendor's own page. X-WR-TIMEZONE:UTC REFRESH-INTERVAL;VALUE=DURATION:P1D X-PUBLISHED-TTL:P1D URL;VALUE=URI:https://www.kbytechnologies.com/deadlines BEGIN:VEVENT UID:secure-boot-2011-kek-and-uefi-ca-expiry@kbytechnologies.com DTSTAMP:20261109T000000Z LAST-MODIFIED:20261109T000000Z DTSTART;VALUE=DATE:20260624 DTEND;VALUE=DATE:20260625 SUMMARY:Secure Boot 2011 certificates start expiring (KEK CA 2011 and UEFI CA 2011) DESCRIPTION:Microsoft · End of support\n\nWho is affected: Windows PCs\, s ervers and virtual machines with Secure Boot that do not yet have the 2023 certificates. They keep booting\, but cannot apply future Secure Boot upd ates signed with the new authorities.\n\nWhat to do:\n1. Check certificate status per device\, for example with the Secure Boot status report in Win dows Autopatch.\n2. Keep devices on current monthly updates\, which delive r the new certificates in phases.\n3. Ask OEMs and hypervisor vendors for firmware or template updates where the update cannot apply.\n\nSources:\n- Manage Secure Boot certificate updates (Microsoft Learn): https://learn.m icrosoft.com/en-us/azure-stack/operator/secure-boot-certificates?view=azs- 2604\n "Microsoft Corporation KEK CA 2011 | June 24\, 2026 | Microsoft Co rporation KEK 2K CA 2023 | Stored in KEK | Signs updates to DB and DBX."\n - Manage Secure Boot certificate updates (Microsoft Learn): https://learn. microsoft.com/en-us/azure-stack/operator/secure-boot-certificates?view=azs -2604\n "Microsoft UEFI CA 2011 * | June 27\, 2026 | Microsoft UEFI CA 20 23 | Stored in DB | Signs third-party boot loaders and EFI applications."\ n- Windows message center (Windows release health\, Microsoft Learn): http s://learn.microsoft.com/en-us/windows/release-health/windows-message-cente r\n "Secure Boot certificates start expiring in June of 2026."\n\nChecked 2026-11-09. Dates move\; check the source before you act.\nhttps://www.kb ytechnologies.com/deadlines/secure-boot-2011-kek-and-uefi-ca-expiry URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/secure-boot-2011-ke k-and-uefi-ca-expiry CATEGORIES:Microsoft,End of support TRANSP:TRANSPARENT STATUS:CONFIRMED END:VEVENT BEGIN:VEVENT UID:windows-administrator-protection-baseline-default@kbytechnologies.com DTSTAMP:20261109T000000Z LAST-MODIFIED:20261109T000000Z DTSTART;VALUE=DATE:20261001 DTEND;VALUE=DATE:20261002 SUMMARY:Administrator protection enabled by default in Windows 11 security baselines (October 2026) DESCRIPTION:Date: October 2026. The vendor has not published an exact day\, so this event sits on the first day of that month.\n\nMicrosoft · Change \n\nWho is affected: Organisations applying the Windows 11 security baseli ne (26H2\, 25H2 or 24H2) through Intune or Group Policy. Local admins get just-in-time elevation prompts instead of a standing admin token.\n\nWhat to do:\n1. Test the baseline on a pilot ring\, especially for apps and scr ipts that elevate.\n2. Adjust the two User Account Control baseline settin gs in Intune or Group Policy if you need a different behaviour.\n3. Brief the helpdesk on the new elevation prompt.\n\nSources:\n- Windows message c enter (Windows release health\, Microsoft Learn): https://learn.microsoft. com/en-us/windows/release-health/windows-message-center\n "If your organi zation uses Windows security baselines\, Administrator protection becomes enabled by default with the October 2026 Windows security update."\n\nChec ked 2026-11-09. Dates move\; check the source before you act.\nhttps://www .kbytechnologies.com/deadlines/windows-administrator-protection-baseline-d efault URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/windows-administrat or-protection-baseline-default CATEGORIES:Microsoft,Change TRANSP:TRANSPARENT STATUS:CONFIRMED END:VEVENT BEGIN:VEVENT UID:windows-ntlmv1-sso-hardening@kbytechnologies.com DTSTAMP:20261109T000000Z LAST-MODIFIED:20261109T000000Z DTSTART;VALUE=DATE:20261001 DTEND;VALUE=DATE:20261002 SUMMARY:NTLMv1-derived credentials for single sign-on restricted by default (October 2026) DESCRIPTION:Date: October 2026. The vendor has not published an exact day\, so this event sits on the first day of that month.\n\nMicrosoft · Enforc ement\n\nWho is affected: Windows 11 (24H2\, 25H2\, 26H2) and Windows Serv er 2025 devices with Credential Guard disabled that connect to Wi-Fi\, Eth ernet or VPN using MS-CHAPv2. Single sign-on to those networks can fail.\n \nWhat to do:\n1. Find Wi-Fi\, wired 802.1X and VPN profiles that use MS-C HAPv2 (PEAP-MSCHAPv2).\n2. Move them to certificate-based authentication\, for example EAP-TLS with Intune-issued certificates.\n3. Use the temporar y allow-and-audit registry setting in KB5066470 only while you migrate.\n\ nSources:\n- Windows message center (Windows release health\, Microsoft Le arn): https://learn.microsoft.com/en-us/windows/release-health/windows-mes sage-center\n "Beginning with the October 2026 security update\, Windows 11\, versions 26H2\, 25H2\, and 24H2\, along with Windows Server 2025\, en force restrictions on generating NTLMv1-derived credentials for Single Sig n-On by default."\n\nChecked 2026-11-09. Dates move\; check the source bef ore you act.\nhttps://www.kbytechnologies.com/deadlines/windows-ntlmv1-sso -hardening URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/windows-ntlmv1-sso- hardening CATEGORIES:Microsoft,Enforcement TRANSP:TRANSPARENT STATUS:CONFIRMED END:VEVENT BEGIN:VEVENT UID:windows-10-esu-year-1-ends@kbytechnologies.com DTSTAMP:20261109T000000Z LAST-MODIFIED:20261109T000000Z DTSTART;VALUE=DATE:20261013 DTEND;VALUE=DATE:20261014 SUMMARY:Windows 10 Extended Security Updates: Year 1 ends DESCRIPTION:Microsoft · End of support\n\nWho is affected: Organisations w hose Windows 10 Enterprise\, Education or Pro (commercial use) devices wer e covered only by Year 1 of ESU. Without Year 2\, those devices stop recei ving security updates.\n\nWhat to do:\n1. List Windows 10 devices still in use and confirm which ones have a Year 2 ESU key activated.\n2. Buy Year 2 for devices that cannot move yet\; ESU is cumulative\, so a late start s till pays for Year 1.\n3. Prioritise upgrading or replacing the devices th at have no ESU coverage.\n\nSources:\n- Extended Security Updates FAQ (Mic rosoft Lifecycle): https://learn.microsoft.com/en-us/lifecycle/faq/extende d-security-updates\n "Windows 10*** | October 14\, 2025 | October 13\, 20 26 | October 12\, 2027 | October 10\, 2028 | Critical\, Important"\n\nChec ked 2026-11-09. Dates move\; check the source before you act.\nhttps://www .kbytechnologies.com/deadlines/windows-10-esu-year-1-ends URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/windows-10-esu-year -1-ends CATEGORIES:Microsoft,End of support TRANSP:TRANSPARENT STATUS:CONFIRMED END:VEVENT BEGIN:VEVENT UID:windows-11-24h2-home-pro-and-ltsb-2016-end@kbytechnologies.com DTSTAMP:20261109T000000Z LAST-MODIFIED:20261109T000000Z DTSTART;VALUE=DATE:20261013 DTEND;VALUE=DATE:20261014 SUMMARY:Windows 11\, version 24H2 Home and Pro\, and Windows 10 Enterprise LTSB 2016 reach end of updates DESCRIPTION:Microsoft · End of support\n\nWho is affected: Devices on Wind ows 11\, version 24H2 Home or Pro\, and devices on Windows 10 Enterprise L TSB 2016. Windows 11\, version 24H2 Enterprise and Education stay supporte d until October 12\, 2027.\n\nWhat to do:\n1. Update Windows 11 Pro device s on 24H2 to 25H2 or 26H2.\n2. Move LTSB 2016 devices to Windows 11 Enterp rise LTSC 2024\, or buy ESU while you migrate.\n3. Remember that Home and Pro editions get 24 months of updates per version\, against 36 for Enterpr ise and Education.\n\nSources:\n- Windows message center (Windows release health\, Microsoft Learn): https://learn.microsoft.com/en-us/windows/relea se-health/windows-message-center\n "Today\, October 13\, 2026\, Windows 1 1\, version 24H2 Home and Pro\, and Windows 10 Enterprise LTSB 2016 have r eached end of updates."\n\nChecked 2026-11-09. Dates move\; check the sour ce before you act.\nhttps://www.kbytechnologies.com/deadlines/windows-11-2 4h2-home-pro-and-ltsb-2016-end URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/windows-11-24h2-hom e-pro-and-ltsb-2016-end CATEGORIES:Microsoft,End of support TRANSP:TRANSPARENT STATUS:CONFIRMED END:VEVENT BEGIN:VEVENT UID:secure-boot-windows-production-pca-2011-expiry@kbytechnologies.com DTSTAMP:20261109T000000Z LAST-MODIFIED:20261109T000000Z DTSTART;VALUE=DATE:20261019 DTEND;VALUE=DATE:20261020 SUMMARY:Secure Boot: Microsoft Windows Production PCA 2011 expires DESCRIPTION:Microsoft · End of support\n\nWho is affected: Windows devices whose boot manager still relies on the 2011 Windows Production PCA. The r eplacement is Windows UEFI CA 2023\, which signs the Windows boot loader.\ n\nWhat to do:\n1. Confirm devices report the Windows UEFI CA 2023 certifi cate in the Secure Boot database.\n2. Expect one extra restart on some dev ices when the Secure Boot certificate update applies.\n3. Refresh boot med ia\, PXE images and VM templates so they boot with the new certificate cha in.\n\nSources:\n- Manage Secure Boot certificate updates (Microsoft Learn ): https://learn.microsoft.com/en-us/azure-stack/operator/secure-boot-cert ificates?view=azs-2604\n "Microsoft Windows Production PCA 2011 | October 19\, 2026 | Windows UEFI CA 2023 | Stored in DB | Used for signing the Wi ndows boot loader."\n\nChecked 2026-11-09. Dates move\; check the source b efore you act.\nhttps://www.kbytechnologies.com/deadlines/secure-boot-wind ows-production-pca-2011-expiry URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/secure-boot-windows -production-pca-2011-expiry CATEGORIES:Microsoft,End of support TRANSP:TRANSPARENT STATUS:CONFIRMED END:VEVENT BEGIN:VEVENT UID:windows-11-23h2-enterprise-education-end@kbytechnologies.com DTSTAMP:20261109T000000Z LAST-MODIFIED:20261109T000000Z DTSTART;VALUE=DATE:20261110 DTEND;VALUE=DATE:20261111 SUMMARY:Windows 11\, version 23H2 Enterprise and Education reach end of upd ates DESCRIPTION:Microsoft · End of support\n\nWho is affected: Devices running Windows 11\, version 23H2 Enterprise\, Education or IoT Enterprise. The N ovember 2026 security update is the last one for these editions.\n\nWhat t o do:\n1. Find 23H2 devices (build 22631) in Intune's All devices list or your update reports.\n2. Move them to a supported version such as 25H2 or 26H2 with a feature update policy.\n3. Check safeguard holds and app compa tibility on a pilot ring first.\n\nSources:\n- Windows message center (Win dows release health\, Microsoft Learn): https://learn.microsoft.com/en-us/ windows/release-health/windows-message-center\n "On November 10\, 2026\, Windows 11\, version 23H2 Enterprise and Education editions will reach end of updates. The November 2026 Windows security update will be the last up date available for these editions."\n- Ending Support in 2026 (Microsoft L ifecycle): https://learn.microsoft.com/en-us/lifecycle/end-of-support/end- of-support-2026\n "Windows 11 Enterprise and Education\, Version 23H2 | W indows 11 IoT Enterprise\, Version 23H2 | November 10\, 2026"\n\nChecked 2 026-11-09. Dates move\; check the source before you act.\nhttps://www.kbyt echnologies.com/deadlines/windows-11-23h2-enterprise-education-end URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/windows-11-23h2-ent erprise-education-end CATEGORIES:Microsoft,End of support TRANSP:TRANSPARENT STATUS:CONFIRMED END:VEVENT BEGIN:VEVENT UID:windows-refs-removable-media-enforcement@kbytechnologies.com DTSTAMP:20261109T000000Z LAST-MODIFIED:20261109T000000Z DTSTART;VALUE=DATE:20270101 DTEND;VALUE=DATE:20270102 SUMMARY:ReFS volumes on removable media: enforcement phase (January 2027) DESCRIPTION:Date: January 2027. The vendor has not published an exact day\, so this event sits on the first day of that month.\n\nMicrosoft · Enforc ement\n\nWho is affected: Devices that use ReFS on externally attached or removable storage. The October 2026 update started the audit phase\; the J anuary 2027 update can block affected volumes.\n\nWhat to do:\n1. Review t he audit events added by the October 2026 update to find external ReFS vol umes.\n2. Reformat or move data off unsupported external ReFS configuratio ns before January 2027.\n\nSources:\n- Windows message center (Windows rel ease health\, Microsoft Learn): https://learn.microsoft.com/en-us/windows/ release-health/windows-message-center\n "January 2027 Windows security up date (Enforcement phase)"\n\nChecked 2026-11-09. Dates move\; check the so urce before you act.\nhttps://www.kbytechnologies.com/deadlines/windows-re fs-removable-media-enforcement URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/windows-refs-remova ble-media-enforcement CATEGORIES:Microsoft,Enforcement TRANSP:TRANSPARENT STATUS:CONFIRMED END:VEVENT BEGIN:VEVENT UID:windows-10-enterprise-ltsc-2021-end@kbytechnologies.com DTSTAMP:20261109T000000Z LAST-MODIFIED:20261109T000000Z DTSTART;VALUE=DATE:20270112 DTEND;VALUE=DATE:20270113 SUMMARY:Windows 10 Enterprise LTSC 2021 reaches end of updates DESCRIPTION:Microsoft · End of support\n\nWho is affected: Devices running Windows 10 Enterprise LTSC 2021\, often kiosks\, shop-floor and medical o r lab devices. The January 2027 security update is the last one.\n\nWhat t o do:\n1. Inventory LTSC 2021 devices and the line-of-business software ea ch one runs.\n2. Test the workload on Windows 11 Enterprise LTSC 2024 and schedule the rebuilds.\n3. Buy ESU for devices that cannot move before Jan uary 12\, 2027.\n\nSources:\n- Windows message center (Windows release hea lth\, Microsoft Learn): https://learn.microsoft.com/en-us/windows/release- health/windows-message-center\n "On January 12\, 2027\, Windows 10 Enterp rise LTSC 2021 will reach end of updates. The January 2027 Windows securit y update will be the last update available for this version."\n\nChecked 2 026-11-09. Dates move\; check the source before you act.\nhttps://www.kbyt echnologies.com/deadlines/windows-10-enterprise-ltsc-2021-end URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/windows-10-enterpri se-ltsc-2021-end CATEGORIES:Microsoft,End of support TRANSP:TRANSPARENT STATUS:CONFIRMED END:VEVENT BEGIN:VEVENT UID:windows-update-certificate-rotation-may-2027@kbytechnologies.com DTSTAMP:20261109T000000Z LAST-MODIFIED:20261109T000000Z DTSTART;VALUE=DATE:20270517 DTEND;VALUE=DATE:20270518 SUMMARY:Windows Update certificate rotation: Windows 10 Enterprise 2019 LTS C\, Windows Server 2019 and 2016 DESCRIPTION:Microsoft · Enforcement\n\nWho is affected: Windows 10 Enterpr ise 2019 LTSC\, Windows Server 2019 and Windows Server 2016 devices that g et updates directly from Windows Update. Devices updated through WSUS are not affected by this change.\n\nWhat to do:\n1. Install the July 2026 secu rity update or later on these devices before May 17\, 2027.\n2. Find devic es that have stopped patching: without the replacement certificates they l ose access to Windows Update.\n\nSources:\n- Windows message center (Windo ws release health\, Microsoft Learn): https://learn.microsoft.com/en-us/wi ndows/release-health/windows-message-center\n "Windows 10 Enterprise 2019 LTSC\, Windows Server 2019\, and Windows Server 2016: Install the July 20 26 security update or later before May 17\, 2027."\n\nChecked 2026-11-09. Dates move\; check the source before you act.\nhttps://www.kbytechnologies .com/deadlines/windows-update-certificate-rotation-may-2027 URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/windows-update-cert ificate-rotation-may-2027 CATEGORIES:Microsoft,Enforcement TRANSP:TRANSPARENT STATUS:CONFIRMED END:VEVENT BEGIN:VEVENT UID:windows-update-certificate-rotation-june-2027@kbytechnologies.com DTSTAMP:20261109T000000Z LAST-MODIFIED:20261109T000000Z DTSTART;VALUE=DATE:20270619 DTEND;VALUE=DATE:20270620 SUMMARY:Windows Update certificate rotation: Windows 11\, Windows Server 20 22/2025 and other in-support Windows 10 DESCRIPTION:Microsoft · Enforcement\n\nWho is affected: In-support Windows 11\, Windows Server 2022 and 2025\, and in-support Windows 10 devices tha t are behind on monthly updates. Windows 11\, version 25H2 and later need no action.\n\nWhat to do:\n1. Windows 11\, version 24H2 and Windows Server 2025: install the September 2025 security update or later.\n2. Other in-s upport Windows 11\, Windows Server 2022 and Windows 10: install the July 2 026 security update or later.\n3. Upgrade any out-of-support Windows versi on\, which will lose access to Windows Update.\n\nSources:\n- Windows mess age center (Windows release health\, Microsoft Learn): https://learn.micro soft.com/en-us/windows/release-health/windows-message-center\n "Certifica tes used to establish trusted connections to Windows Update will expire on May 17\, 2027 and June 19\, 2027. Devices must contain the replacement ce rtificates to continue receiving updates after the applicable expiration d ate."\n\nChecked 2026-11-09. Dates move\; check the source before you act. \nhttps://www.kbytechnologies.com/deadlines/windows-update-certificate-rot ation-june-2027 URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/windows-update-cert ificate-rotation-june-2027 CATEGORIES:Microsoft,Enforcement TRANSP:TRANSPARENT STATUS:CONFIRMED END:VEVENT BEGIN:VEVENT UID:windows-10-esu-year-2-ends@kbytechnologies.com DTSTAMP:20261109T000000Z LAST-MODIFIED:20261109T000000Z DTSTART;VALUE=DATE:20271012 DTEND;VALUE=DATE:20271013 SUMMARY:Windows 10 Extended Security Updates: Year 2 ends DESCRIPTION:Microsoft · End of support\n\nWho is affected: Organisations p aying for Windows 10 ESU Year 2. Year 3 is the last year available and run s to October 10\, 2028.\n\nWhat to do:\n1. Decide before renewal which rem aining Windows 10 devices justify a Year 3 purchase.\n2. Set a migration d ate for every remaining Windows 10 device and track it.\n3. Check that ESU keys are activated on the devices that need them\, not just purchased.\n\ nSources:\n- Extended Security Updates FAQ (Microsoft Lifecycle): https:// learn.microsoft.com/en-us/lifecycle/faq/extended-security-updates\n "Wind ows 10*** | October 14\, 2025 | October 13\, 2026 | October 12\, 2027 | Oc tober 10\, 2028 | Critical\, Important"\n\nChecked 2026-11-09. Dates move\ ; check the source before you act.\nhttps://www.kbytechnologies.com/deadli nes/windows-10-esu-year-2-ends URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/windows-10-esu-year -2-ends CATEGORIES:Microsoft,End of support TRANSP:TRANSPARENT STATUS:CONFIRMED END:VEVENT BEGIN:VEVENT UID:windows-11-24h2-enterprise-education-end@kbytechnologies.com DTSTAMP:20261109T000000Z LAST-MODIFIED:20261109T000000Z DTSTART;VALUE=DATE:20271012 DTEND;VALUE=DATE:20271013 SUMMARY:Windows 11\, version 24H2 Enterprise and Education reach end of ser vicing DESCRIPTION:Microsoft · End of support\n\nWho is affected: Devices running Windows 11\, version 24H2 Enterprise\, Education or IoT Enterprise.\n\nWh at to do:\n1. Plan a feature update to 25H2 or 26H2 well before the date.\ n2. Use Intune feature update policies or Autopatch rings so devices do no t sit on 24H2.\n3. Note that 24H2 non-security preview updates already end ed in September 2026.\n\nSources:\n- Ending Support in 2027 (Microsoft Lif ecycle): https://learn.microsoft.com/en-us/lifecycle/end-of-support/end-of -support-2027\n "Windows 11 Enterprise and Education\, Version 24H2 | Win dows 11 IoT Enterprise\, Version 24H2 | October 12\, 2027"\n- Windows mess age center (Windows release health\, Microsoft Learn): https://learn.micro soft.com/en-us/windows/release-health/windows-message-center\n "Windows 1 1\, version 24H2 Enterprise and Education remain supported until October 1 2\, 2027."\n\nChecked 2026-11-09. Dates move\; check the source before you act.\nhttps://www.kbytechnologies.com/deadlines/windows-11-24h2-enterpris e-education-end URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/windows-11-24h2-ent erprise-education-end CATEGORIES:Microsoft,End of support TRANSP:TRANSPARENT STATUS:CONFIRMED END:VEVENT BEGIN:VEVENT UID:windows-11-25h2-home-pro-end@kbytechnologies.com DTSTAMP:20261109T000000Z LAST-MODIFIED:20261109T000000Z DTSTART;VALUE=DATE:20271012 DTEND;VALUE=DATE:20271013 SUMMARY:Windows 11\, version 25H2 Home and Pro reach end of updates DESCRIPTION:Microsoft · End of support\n\nWho is affected: Devices on Wind ows 11\, version 25H2 Home\, Pro\, Pro Education or Pro for Workstations. Enterprise and Education editions of 25H2 are supported for a further year .\n\nWhat to do:\n1. Identify Pro-edition devices in your fleet\; they fol low the 24-month lifecycle\, not the 36-month one.\n2. Plan their move to 26H2 during 2027.\n\nSources:\n- Windows 11 release information (Microsoft Learn): https://learn.microsoft.com/en-us/windows/release-health/windows1 1-release-information\n "25H2 | General Availability Channel | 2025-09-30 | 2027-10-12 | 2028-10-10"\n\nChecked 2026-11-09. Dates move\; check the source before you act.\nhttps://www.kbytechnologies.com/deadlines/windows- 11-25h2-home-pro-end URL;VALUE=URI:https://www.kbytechnologies.com/deadlines/windows-11-25h2-hom e-pro-end CATEGORIES:Microsoft,End of support TRANSP:TRANSPARENT STATUS:CONFIRMED END:VEVENT END:VCALENDAR