Windows 11 End of Support Audit
A read-only PowerShell script that lists every Intune-managed Windows device with its edition and the real last day of security updates for that edition.
What it does
- Reads Intune's managed Windows devices through Microsoft Graph, with your own account
- Works out each device's release (21H2 to 26H2) and edition: Home/Pro, Enterprise/Education, SE or LTSC
- Applies the matching Microsoft lifecycle date: 24H2 Home/Pro ends 13 October 2026, Enterprise/Education 12 October 2027
- Never flags LTSC, which shares build 26100 but has its own long-term lifecycle
- Flags Pro devices in a tenant licensed for Enterprise (when the token can read licences): a sign that subscription activation isn't working
- Exports a CSV and exits 1 when anything is out of support or ending soon, so it can run on a schedule
- Read-only: it changes nothing in your tenant. Needs only
DeviceManagementManagedDevices.Read.All
Configuration
You edit one block:
PowerShell
Preview snippet. The full, tested script lives in the vault.
# ===== CONFIG =====
$OutputPath = Join-Path $env:USERPROFILE 'Desktop\Atliso-Win11-EndOfSupport.csv'
$WarnDays = 60 # flag devices whose support ends within this many days
$LogPath = Join-Path $env:LOCALAPPDATA 'Atliso\Win11EndOfSupportAudit.log'
# ==================Run it
It runs on your own workstation, not on devices, with Windows PowerShell 5.1 or PowerShell 7:
PowerShell
Preview snippet. The full, tested script lives in the vault.
Install-Module Microsoft.Graph.Authentication -Scope CurrentUser
.\Atliso-Win11EndOfSupportAudit.ps1
# MSPs: run once per customer tenant
.\Atliso-Win11EndOfSupportAudit.ps1 -TenantId contoso.onmicrosoft.comFull walkthrough, including how to move devices to 25H2 or 26H2 with an Intune feature update policy: Windows 11 24H2 end of support: find every Intune device on it
Get Windows 11 End of Support Audit
We'll send the script, and updates when Microsoft changes the lifecycle dates. No spam.