Windows 11 23H2 End of Support: 30-Day Countdown — Enterprise Migration and Detection Guide

---
title: Windows Update Service Disabled or Tampered
description: Detects attempts to disable or delete the Windows Update service (wuauserv), which can strand systems on end-of-support builds such as Windows 11 23H2 and prevent feature updates from being applied.
references:
  - https://attack.mitre.org/techniques/T1562/001/
  - https://learn.microsoft.com/en-us/windows/release-health/windows11-release-information
author: Security Arsenal
date: 2026/10/09
status: experimental
id: 8c2e4a71-3b6f-4d92-a517-9e0c2f7b1d45
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_sc:
    Image|endswith: '\sc.exe'
    CommandLine|contains|all:
      - 'wuauserv'
    CommandLine|contains:
      - 'stop'
      - 'disabled'
      - 'delete'
  selection_net:
    Image|endswith: '\net.exe'
    CommandLine|contains|all:
      - 'stop'
      - 'wuauserv'
  selection_ps:
    Image|endswith:
      - '\powershell.exe'
      - '\powershell_ise.exe'
      - '\pwsh.exe'
    CommandLine|contains|all:
      - 'wuauserv'
    CommandLine|contains:
      - 'Stop-Service'
      - 'Set-Service'
  condition: 1 of selection_*
falsepositives:
  - Legitimate servicing scripts run by desktop engineering during maintenance windows
  - WSUS/Intune troubleshooting activity
level: medium
---
title: Registry-Based Windows Update Suppression
description: Detects registry modifications that disable automatic Windows Update behavior via policy keys, a common cause of fleets silently remaining on end-of-support builds such as Windows 11 23H2.
references:
  - https://attack.mitre.org/techniques/T1112/
  - https://learn.microsoft.com/en-us/windows/deployment/update/waas-wu-settings
author: Security Arsenal
date: 2026/10/09
status: experimental
id: 2f7b9c53-8e41-4a6d-b308-5d1a6c9e2f77
tags:
  - attack.defense_evasion
  - attack.t1112
logsource:
  category: registry_set
  product: windows
detection:
  selection_key:
    TargetObject|contains:
      - '\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\NoAutoUpdate'
      - '\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\AUOptions'
      - '\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\AUOptions'
  selection_value:
    Details|contains:
      - '1'
      - '2'
  condition: selection_key and selection_value
falsepositives:
  - Intentional WSUS-managed update ring configurations set by GPO
  - Legacy baseline images with stale policy residue
level: low

// Enumerate all Windows 11 23H2 (build 22631) endpoints still active in the last 14 days
let eosBuild = "22631";
DeviceInfo
| where Timestamp > ago(14d)
| where OSPlatform startswith "Windows11" or OSPlatform =~ "Windows 11"
| where OSBuild startswith eosBuild
| summarize LastSeen = max(Timestamp), arg_max(Timestamp, OSVersionInfo, OSDistribution, OSArchitecture, MachineGroup) by DeviceName, DeviceId
| extend DaysUntilEOS = datetime_diff("day", datetime(2026-11-10), now())
| project DeviceName, OSBuild, OSVersionInfo, OSDistribution, MachineGroup, LastSeen, DaysUntilEOS
| order by LastSeen asc;
// Companion query: catch devices reporting via Log Analytics heartbeat that may lack Defender onboarding
Heartbeat
| where TimeGenerated > ago(14d)
| where OSType == "Windows"
| summarize arg_max(TimeGenerated, OSName, OSMajorVersion, OSMinorVersion) by Computer
| where OSName contains "22631" or (OSMajorVersion == 10 and OSName contains "23H2")
| project Computer, OSName, OSMajorVersion, OSMinorVersion, TimeGenerated;

-- Inventory Windows build, release, and servicing state to identify Windows 11 23H2 (22631) hosts
LET reg <= SELECT FullPath AS RegPath,
       { SELECT Data.value AS Value FROM read_reg_key(key=FullPath, value_name="ProductName", accessor="registry") } AS ProductName,
       { SELECT Data.value AS Value FROM read_reg_key(key=FullPath, value_name="DisplayVersion", accessor="registry") } AS DisplayVersion,
       { SELECT Data.value AS Value FROM read_reg_key(key=FullPath, value_name="CurrentBuildNumber", accessor="registry") } AS BuildNumber,
       { SELECT Data.value AS Value FROM read_reg_key(key=FullPath, value_name="UBR", accessor="registry") } AS UBR
FROM glob(globs="HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows NT/CurrentVersion", accessor="registry")
SELECT ProductName[0].Value AS ProductName,
       DisplayVersion[0].Value AS DisplayVersion,
       BuildNumber[0].Value AS BuildNumber,
       UBR[0].Value AS UBR,
       if(condition=BuildNumber[0].Value =~ "22631", then="EOS-IMMINENT (23H2)", else="Supported") AS ServicingStatus
FROM reg

# Verify Windows 11 servicing status and feature-update readiness
$os = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
$build = [int]$os.CurrentBuildNumber
$displayVersion = $os.DisplayVersion
$ubr = $os.UBR
$fullBuild = "$build.$ubr"

Write-Output "OS: $($os.ProductName) | Version: $displayVersion | Build: $fullBuild"

# Flag end-of-servicing builds (23H2 = 22631)
if ($build -eq 22631) {
    Write-Warning "This system is on Windows 11 23H2 and loses security updates on the November 2026 Patch Tuesday. A feature update to 24H2/25H2 is REQUIRED."
} elseif ($build -ge 26100) {
    Write-Output "System is on a supported build ($displayVersion)."
}

# Confirm Windows Update service is healthy and not disabled
$wuauserv = Get-Service -Name wuauserv
if ($wuauserv.StartType -eq 'Disabled') {
    Write-Warning "wuauserv is DISABLED - re-enabling to permit feature update delivery."
    Set-Service -Name wuauserv -StartupType Manual
    Start-Service wuauserv
}

# Check for update-suppression policy residue
$auPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU'
if (Test-Path $auPath) {
    $noAuto = (Get-ItemProperty $auPath -Name NoAutoUpdate -ErrorAction SilentlyContinue).NoAutoUpdate
    if ($noAuto -eq 1) { Write-Warning 'NoAutoUpdate=1 policy is blocking updates. Review GPO/Intune configuration.' }
}

# Check for feature-update deferrals or target-release pinning to 23H2
$wuPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate'
if (Test-Path $wuPath) {
    $targetRelease = (Get-ItemProperty $wuPath -Name TargetReleaseVersionInfo -ErrorAction SilentlyContinue).TargetReleaseVersionInfo
    if ($targetRelease -eq '23H2') { Write-Warning 'TargetReleaseVersionInfo is PINNED to 23H2. Remove this policy or update it to 24H2/25H2 before the deadline.' }
}

# Verify latest cumulative update install date
$lastHotfix = Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 1
Write-Output "Last cumulative update installed: $($lastHotfix.HotFixID) on $($lastHotfix.InstalledOn)"