Windows 11 25H2: What Changed for IT Admins

By Stackvora Team · 2026-06-10 · 7 min read

Windows 11 25H2 is an enablement package on top of 24H2 — small download, but the policy and management surface changed in ways worth understanding before you flip the switch.

Copilot is now separable

Copilot is no longer a preinstalled inbox app; it's a Store app. That means you can:

Block it via Turn off Windows Copilot policy (already existed, now more reliable).
Uninstall it per device or via Intune configuration profile.
Deploy Microsoft 365 Copilot side-by-side without conflict.

Passkeys graduate from preview

Cross-device passkey sync using the Microsoft account is now GA. For enterprise, this matters because:

Windows Hello can now be a first-class passkey authenticator for Entra ID.
FIDO2 keys, phone passkeys and Hello all coexist through the same platform authenticator API.

Deprecations you need to watch

WordPad — fully removed.
PowerShell 2.0 — removed (already deprecated for years, but the last remnants are gone).
NTLM v1 — disabled by default; you'll need an explicit policy to bring it back for legacy apps.
WMIC — being replaced by PowerShell CIM cmdlets. Time to rewrite those old scripts.

Management changes

Intune settings catalog now has 300+ new 25H2-specific settings. Recreate your baselines from the catalog rather than legacy ADMX where possible.
Windows Update for Business now supports feature-update pause per ring, up to 35 days.

Rollout checklist

Confirm your app inventory is 24H2-compatible (25H2 shares the same core).
Update your Autopilot profiles for the 25H2 image if you deliver via WUfB Deployment Service.
Test any script that touches WMIC or PowerShell 2.0.
Communicate the WordPad removal to end users who still use it (usually finance).