Windows 11 End of Support Audit

A read-only PowerShell script that lists every Intune-managed Windows device with its edition and the real last day of security updates for that edition.

Send me the scriptView on GitHub

What it does

  • Reads Intune's managed Windows devices through Microsoft Graph, with your own account
  • Works out each device's release (21H2 to 26H2) and edition: Home/Pro, Enterprise/Education, SE or LTSC
  • Applies the matching Microsoft lifecycle date: 24H2 Home/Pro ends 13 October 2026, Enterprise/Education 12 October 2027
  • Never flags LTSC, which shares build 26100 but has its own long-term lifecycle
  • Flags Pro devices in a tenant licensed for Enterprise (when the token can read licences): a sign that subscription activation isn't working
  • Exports a CSV and exits 1 when anything is out of support or ending soon, so it can run on a schedule
  • Read-only: it changes nothing in your tenant. Needs only DeviceManagementManagedDevices.Read.All

Configuration

You edit one block:

PowerShell
Preview snippet. The full, tested script lives in the vault.
# ===== CONFIG =====
$OutputPath = Join-Path $env:USERPROFILE 'Desktop\Atliso-Win11-EndOfSupport.csv'
$WarnDays   = 60     # flag devices whose support ends within this many days
$LogPath    = Join-Path $env:LOCALAPPDATA 'Atliso\Win11EndOfSupportAudit.log'
# ==================

Run it

It runs on your own workstation, not on devices, with Windows PowerShell 5.1 or PowerShell 7:

PowerShell
Preview snippet. The full, tested script lives in the vault.
Install-Module Microsoft.Graph.Authentication -Scope CurrentUser
Install-Script Atliso-Win11EndOfSupportAudit -Scope CurrentUser   # from the PowerShell Gallery
Atliso-Win11EndOfSupportAudit.ps1
# MSPs: run once per customer tenant
Atliso-Win11EndOfSupportAudit.ps1 -TenantId contoso.onmicrosoft.com

Full walkthrough, including how to move devices to 25H2 or 26H2 with an Intune feature update policy: Windows 11 24H2 end of support: find every Intune device on it

Version history

Scripts are checked against each month's Windows and Intune changes and patched when something breaks. Every version stays available: if a newer one misbehaves in your environment, use the one before it and reply to any Atliso email to tell me.

  1. v1.1.1Latest

    • Windows 11 26H2 (build 26300) on Home, Pro, Pro Education and Pro for Workstations now shows its correct last day of updates, 10 October 2028. The table said 9 October 2028, one day early, so on that day those devices would have been reported as out of support while Microsoft was still updating them, and every DaysLeft count for them was one short. Enterprise and Education dates were already right.
    • A new test checks that every end date in the tables falls on a Tuesday, since Microsoft always ends servicing on a Patch Tuesday, so a slip like this is caught before release.
    • Date from Microsoft's Windows 11 release information page, checked 4 November 2026.
    Download v1.1.1 from GitHub

  2. v1.1.0

    • LTSC devices now get their real last day of updates instead of being skipped. Windows 10 Enterprise LTSC 2021 ends on 12 January 2027, so those devices are flagged as ending soon from mid-November 2026. IoT Enterprise LTSC (SKU 191) gets its longer date (2032 for LTSC 2021, 2034 for LTSC 2024). LTSC 2019 runs to 9 January 2029; LTSB 2016 ended on 13 October 2026.
    • Adds Windows 11 26H1 (build 28000), the release for new devices: Home and Pro until 14 March 2028, Enterprise and Education until 13 March 2029. These devices showed as Unknown before.
    • Dates from Microsoft's Windows release information pages, checked 23 October 2026.
    Download v1.1.0 from GitHub

  3. v1.0.2

    Adds PowerShell Gallery metadata (PSScriptInfo) so the script can be installed with Install-Script Atliso-Win11EndOfSupportAudit. No change to what the script does.

    Download v1.0.2 from GitHub

  4. v1.0.1

    Enterprise Evaluation (SKU 72, 84) is now on the Enterprise track and LTSC Evaluation (129, 130) is never flagged. Found on a real Windows 11 Enterprise Evaluation lab device. When Intune reports a SKU number the script doesn't list, it falls back to the edition name, and only says the edition was not reported when it really wasn't.

    Download v1.0.1 from GitHub

  5. v1.0.0

    Initial public release. MIT licensed. Download the zip below or clone the repo. See README for usage and the linked Atliso guide.

    Download v1.0.0 from GitHub

Get Windows 11 End of Support Audit

We'll send the script, and updates when Microsoft changes the lifecycle dates. No spam.