We're planning to move our managed systems from Windows 11 24H2 to 25H2 and want to prepare a production rollout checklist. We're especially interested in changes to features and settings, security and privacy controls, services that should be disabled or restricted, removed or deprecated functionality, new Group Policy and Intune settings, updated security baselines, and anything that could affect existing applications or policies. Has anyone created a checklist, spreadsheet, or template for reviewing these items before deployment?
5 Answers
You can generally begin with your current deployment settings and update them where the newer security recommendations or policy templates call for it. The enablement package itself is usually straightforward, but your support lifecycle matters too, so confirm the exact servicing timeline for your edition. A focused pilot, application testing, policy comparison, and staged rollout should provide more value than treating 25H2 like a completely new operating-system deployment.
For most organizations, 24H2 to 25H2 is a small enablement-package update rather than a traditional full feature upgrade. The systems share the same underlying baseline, so installation and rebooting should be quick. We still tested it with a small group across several departments, checked our specialized applications, and then rolled it out in batches. The larger compatibility review is usually needed when moving from older releases such as 23H2.
That makes sense. We’ll treat it as a smaller change, but still validate our line-of-business software and deployment workflow before expanding the rollout.
For policy changes, review Microsoft’s Group Policy settings reference spreadsheet and filter the Administrative Templates section by settings marked as new for 25H2. Also compare your existing security baseline and Intune configuration rather than assuming every new setting should be enabled. Pay particular attention to privacy-sensitive features such as Recall or other local AI functionality, and explicitly configure them according to your organization’s requirements.
Don’t overlook compatibility changes that may affect older applications. Administrators have reported issues involving Remote Desktop behavior, Mark-of-the-Web restrictions that affect file previews, and legacy VBScript dependencies. Inventory applications that use scripts or older platform components, confirm vendor support, and test common file-handling and remote-access workflows before production deployment.
Start with a test device or pilot group and use it for several days before broad deployment. In our environment, the update mostly produced minor interface and Settings changes, but a pilot is still useful for catching application-specific issues and unexpected prompts. Deploying to a few dozen devices at a time after the pilot worked well.
We’ll also check the servicing terms for the editions we run, since they may not all have the same support window.