Detect Windows Versions Reaching End Of Service On October November 2025
Query
DeviceInfo
| where Timestamp > ago(1d)
| extend OSaffected = strcat(OSDistribution, " ", OSVersionInfo)
// filter by the affected OS distributions
| where OSaffected has "22H2" or OSaffected has "23h2"
| extend Windows10_22H2 = iff(OSaffected has "Windows10 22h2", "🚨 October 14,2025","")
| extend Windows11_22H2 = iff(OSaffected has "Windows11 22h2", "🚨 October 14,2025","")
| extend Windows11_23H2 = iff( OSaffected has "Windows11 23h2" and OSBuild == 22631,"November 11,2025 (⚠️ If are Home or Pro versions,if not 2026-11-10)","")
| summarize Total_Devices= dcount(DeviceId) by OSPlatform,OSaffected, Windows10_22H2,Windows11_22H2,Windows11_23H2
//| summarize by DeviceName, DeviceId, OSaffected, Windows10_22H2,Windows11_22H2,Windows11_23H2
| order by OSaffectedAbout this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1082 | System Information Discovery |
Author: Sergio Albea (16/09/2025)
Detect Windows Versions reaching end of service on October&November 2025
This query helps you quickly see the number of affected devices or get a detailed list of machines still running versions that are approaching end of support:
Windows 10 & 11 version 22H2 → end of support on October 14, 2025
Windows 11 version 23H2 (Home & Pro) → end of support on November 11, 2025
Explanation
This query is designed to identify and summarize Windows devices that are running operating system versions nearing the end of their support period in October and November 2025. Here's a simplified breakdown of what the query does:
-
Data Source: It starts by looking at device information from the last day (
Timestamp > ago(1d)). -
OS Version Identification: It creates a new field called
OSaffectedthat combines the operating system distribution and version information. -
Filter for Specific Versions: The query filters for devices running Windows 10 or 11 with version "22H2" or "23H2", which are the versions approaching end of support.
-
End of Support Alerts: It adds alert markers for:
- Windows 10 and 11 version 22H2, which will reach end of support on October 14, 2025. - Windows 11 version 23H2, specifically for Home and Pro editions, which will reach end of support on November 11, 2025. Other editions will end on November 10, 2026.
-
Summarization: The query summarizes the total number of affected devices by operating system platform and version, along with the respective end-of-support alerts.
-
Ordering: Finally, it orders the results by the affected operating system version for easy review.
This query helps organizations quickly identify and manage devices that need updates or upgrades before their operating systems reach end of support, ensuring continued security and compliance.
