Tomorrow, June 15, Internet Explorer 11 goes dark as a supported desktop application on most Windows 10 editions — the tail end of a retirement Microsoft announced last year and one more shove toward a browser and OS baseline a lot of our clients have been quietly avoiding. Most of the calls we fielded this month were about IE, not Windows 11. But underneath nearly every one of them sat the question nobody wants to put on a steering committee agenda yet: when do we actually move to Windows 11.
Eight months past general availability, our honest field answer for the large majority of the Microsoft-centric estates we run is "not yet, on purpose." That is not the caution of people who haven't looked at Windows 11 — we've imaged and piloted it on new hardware since the fall. It's the caution of people who've read the hardware requirements list enough times to know it isn't a marketing suggestion, and who've checked Windows 10's support date and found October 2025 sitting there with no reason to sprint past it.
This note is the deployment reality we're actually running this quarter across a regional bank, a state agency, and a 6,000-seat manufacturer we support: a hardware floor that doesn't negotiate, an app-compat tail that's shorter than people fear but not zero, and a ring structure built on co-management already running for Windows 10. None of it needed a keynote. It needed inventory, a patience budget, and a refresh conversation with finance.
The hardware wall nobody gets to negotiate around
Windows 11's floor is not the same conversation as "will Office run on this." The published minimum is TPM 2.0 — not 1.2, and many five-year-old laptops carry only a 1.2 firmware TPM — a UEFI implementation capable of Secure Boot, roughly eighth-generation Intel Core or AMD Ryzen 2000-series (Zen+) or newer on the approved processor list, 4 GB of RAM, 64 GB of storage, and a DirectX 12 / WDDM 2.0 graphics driver. Microsoft's PC Health Check app tells one user pass or fail; it won't tell an IT director what share of a 3,000-device fleet is stranded, so that's not the tool we lead with.
The tool we actually run at scale is Microsoft's own hardware-readiness script, wrapped as an Intune proactive remediation or an SCCM configuration baseline, with results rolled into a single fleet report. Under the hood it's close to this:
$tpm = Get-CimInstance -Namespace "root\cimv2\security\microsofttpm" -ClassName Win32_Tpm
$secureBoot = Confirm-SecureBootUEFI
$cpu = (Get-CimInstance Win32_Processor).Name
[PSCustomObject]@{
TpmSpecVersion = $tpm.SpecVersion
SecureBootReady = $secureBoot
Processor = $cpu
}
That's the first artifact we hand a client: not an opinion about Windows 11 readiness, a device-by-device compatibility table with a reason code on every failure — TPM version, CPU generation, Secure Boot state, or all three at once.
Every one of these clients has also asked about the bypass — either the LabConfig keys on install media or the AllowUpgradesWithUnsupportedTPMOrCPU registry value for in-place upgrades. Our answer is consistent: fine for a single lab VM, not for anything that will ever carry a support ticket. Microsoft has said bypassed devices may not qualify for future updates; "the install completed" is not "this device is supported." We don't build production rings on an unsupported registry key, and we won't own the pager for one that does.
Why October 2025 means nobody has to sprint
Windows 10 is supported into October 2025. That date matters more to this year's roadmap than anything in a Windows 11 keynote, because nothing forces a fleet-wide cutover in 2022: no end-of-support cliff, no compliance mandate we're tracking, no vendor deprecation notice tied to the OS itself. The urgency people feel is mostly manufactured — an account rep's renewal pitch, a peer company's press release, or plain fatigue after eight months of "have you moved yet."
We push back on manufactured urgency the same way we push back on it anywhere else: name the actual forcing function or don't fund the project like an emergency. For an existing fleet, the real forcing functions are hardware refresh cycles already on the books, specific line-of-business dependencies on a Windows 11-only feature, and — the one people miss — new procurement. Every laptop ordered today from Dell, Lenovo, or HP ships with Windows 11 by default; downgrading a new machine to Windows 10 for consistency fights a current not worth fighting. The honest policy for most of these clients this year is two-track: new procurement lands on Windows 11 from day one, and the existing fleet moves on its normal refresh cadence, not on a calendar compressed to satisfy a slide.
Rings we already had, not a parallel Windows 11 program
Every client in this note already ran SCCM (Configuration Manager, Current Branch) and Intune in co-management for Windows 10 — devices split across workloads, with Windows Update policy and compliance already living in Intune while imaging and complex app deployment stayed on ConfigMgr. Windows 11 slots into that same structure. We didn't stand up a separate "Windows 11 project" with its own governance; we added an operating system version to rings that already had owners, a support rotation, and a rollback habit.
Ring 0 is desktop engineering and IT, running Windows 11 on their own daily-driver hardware for weeks before anyone else sees it. Ring 1 is one business unit that complains constructively, with a manager who escalates real problems. Ring 2 is the broad population, gated on ring 1's ticket volume staying flat. Ring 3 is VIP and white-glove — executives, and anything running specialized peripherals or lab equipment, deliberately last.
Mechanically, eligible hardware taking a clean reload goes through Autopilot for existing devices; machines staying domain-joined with a heavy local app footprint go through an SCCM in-place upgrade task sequence, gated by the same hardware-readiness collection query so ineligible devices never enter the sequence. A simplified version of that collection query:
select SMS_R_SYSTEM.ResourceID, SMS_R_SYSTEM.Name
from SMS_R_System
inner join SMS_G_System_TPM on SMS_G_System_TPM.ResourceID = SMS_R_System.ResourceID
where SMS_G_System_TPM.SpecVersion like "%2.0%"
and SMS_R_System.OperatingSystemNameandVersion like "%Workstation 10.0%"
Feature-update deferral for anything outside an active ring runs through Windows Update for Business rings inside Intune, so devices waiting their turn keep receiving Windows 10 quality updates without quietly upgrading themselves.
App-compat triage, starting with the browser everyone forgot
IE11's retirement this week is the app-compat problem that was hiding in plain sight. Every client we've touched this spring has at least one internal line-of-business tool — a scanner interface or a finance portal — built against IE11's rendering engine or an ActiveX control, and "we'll deal with it eventually" ran out of runway this week regardless of Windows 11. Edge's IE mode is the practical bridge: an Enterprise Mode Site List pushed by policy that silently reopens specific internal URLs in IE11's engine inside Edge. Most of these clients hadn't built that list until this deadline forced the conversation — and once it exists, it also removes the single biggest app-compat objection we hear about Windows 11, since IE mode works the same way there too.
Past the browser, our triage order is: line-of-business apps with a vendor still in business (call the vendor, get a Windows 11-certified build, budget the upgrade fee); apps with no vendor left to call (candidates for a Desktop App Assure engagement or, for messier questions, a validation pass through Test Base for Microsoft 365 before we write custom remediation); print drivers (Windows 11 tightened Point and Print defaults after PrintNightmare, breaking some non-domain scenarios that worked on Windows 10 — test actual print queues, not just driver installs); and endpoint security agents, the quiet blocker: several widely deployed EDR agents and VPN clients shipped Windows 11-certified builds well after general availability, so pinning a certified version is now part of every ring-0 checklist.
We also moved one client off Desktop Analytics, since Microsoft is retiring that ConfigMgr-connected compat-telemetry service later this year in favor of Endpoint analytics inside Intune — a migration a couple of clients hadn't noticed they needed until their dashboards went stale.
The failure mode we've actually seen: at one distribution client, a well-intentioned ring 2 expansion pushed the SCCM Windows 11 task sequence to forty warehouse scanning stations running a labeling application that still expected IE11's ActiveX control. Nobody had tested it against Windows 11 because it wasn't on the tracked line-of-business list. The task sequence had no tested rollback step, so the fix took two days of manual reimages while pickers worked from paper. The lesson wasn't about IE11 specifically — it was that the app inventory feeding ring 2 has to include the software nobody remembered to register, not only the software with an owner in the CMDB.
Sorting the fleet into four buckets, then paying for it on the normal cycle
Once the hardware-readiness data and the app-compat triage are both in hand, every device in these fleets sorts into one of four buckets, and the bucket — not enthusiasm — decides what happens next.
| Bucket | What's true about it | What happens next |
|---|---|---|
| Hardware-eligible, apps clear | Passes the TPM, CPU, and Secure Boot check; no blocking app | Enters the active ring now |
| Hardware-eligible, app blocked | Passes the hardware check; one or more apps not yet certified | Stays on Windows 10 until the app owner clears it, or gets a scoped exception with a review date |
| Hardware-ineligible | Fails TPM version, CPU generation, or Secure Boot | Rides the existing refresh or lease cycle; no forced early retirement |
| Ineligible but needed sooner | Hardware-blocked user who needs the Windows 11 experience ahead of their refresh date | Windows 11 session published through AVD or a Windows 365 Cloud PC as a bridge |
That fourth bucket stays small on purpose. We use it for genuinely time-sensitive cases — a state agency with a large batch of otherwise-fine older hardware bought right before the pandemic, for instance — and we're explicit with the client that a published Windows 11 desktop or Cloud PC, with FSLogix carrying the profile between pools, is a bridge and not a destination. The physical endpoint still gets refreshed on schedule; we haven't yet seen a client for whom permanent VDI was cheaper than eventually replacing the laptop.
None of this needs a dedicated capital project labeled a Windows 11 migration. It rides the refresh and lease cycles finance already budgets every year, with Windows 11 as the default image on anything refreshing from this point forward. The only new spend most of these clients are approving this quarter is an occasional accelerated refresh for a business-critical but hardware-ineligible group, framed to finance as moving eighteen months of a five-year cycle forward, not a surprise line item.
If you're facing this
If your Windows 11 conversation is stuck somewhere between "we already piloted it" and "we have no idea what share of our fleet can even run it," that gap is the actual project — not a keynote, not a rebrand, and not a registry bypass. We help Microsoft-centric estates turn hardware inventory and app-compat triage into a ring plan finance will actually fund. Bring us your device data and your worst line-of-business app; we've probably already met its cousin.