By David,
Windows 11, version 26H2 is out, and you don't need a fresh install to put it on your AVD golden image. If the image is already on Windows 11 24H2 or 25H2, 26H2 arrives as an enablement package: a small update that switches on features already staged by your monthly cumulative updates. Install it, restart once, and the image reports 26H2. No reinstall, no in-place upgrade to babysit, and your apps, agents and settings stay as they are.
This guide covers what to check before you start, where to get the enablement package, how to install and verify it on the image's source VM, and how to publish the result as a new image version you can roll back from.
The short version: start the image's source VM, confirm it runs Windows 11 24H2 or 25H2, and install the September 22, 2026 cumulative update (KB5124010) or any later one. Then download and install the Windows 11, version 26H2 enablement package (KB5121794) from Windows Update or WSUS, restart, and confirm the version reads 26H2. Run Windows Update once more, generalize, capture a new image version, and test it on a validation pool before it reaches production.
Microsoft details below reflect Microsoft's support pages as of October 2026, with links in the Sources section at the end.
New to image management? AVD Golden Image Management covers what belongs in an image and how to version it.
1. Prerequisites
Check every item before you touch the image. Most failed upgrades come from a missed prerequisite, not from the package itself.
| Prerequisite | How to check | If it's not met |
|---|---|---|
| The image runs Windows 11 24H2 or 25H2 | Run winver. Version 24H2 or 25H2, build 26100 or 26200 | 23H2 and earlier can't take the enablement package. Rebuild from a newer Marketplace image or run a full feature update first |
| The September 22, 2026 cumulative update (KB5124010) or later is installed | Settings → Windows Update → Update history | Install the latest cumulative update from Windows Update and restart. The enablement package won't apply without it |
| You have the image's source VM, not just the captured image | The VM you build the image from still exists and isn't generalized | Create a VM from the current image version and use that as the build VM. Never upgrade a VM that Sysprep has already generalized |
| A way back | A snapshot of the source VM's OS disk, and the current image version kept in Azure Compute Gallery | Take the snapshot first. It's the fastest undo if anything goes wrong on the build VM |
| The VM can reach Windows Update or your WSUS server | Settings → Windows Update → Check for updates | Open the route. The package isn't offered in the Microsoft Update Catalog, so an offline .msu install isn't an option |
| No policy pins the image to an older version | gpresult /h or Intune: look for Select the target Feature Update version set to 24H2 or 25H2 | Change the target to 26H2 or remove the setting on the build VM. A pinned version hides the upgrade |
| The edition is supported | winver or Settings → System → About | KB5121794 covers Enterprise, Enterprise multi-session, Education, Pro and IoT Enterprise |
| Your agents support 26H2 | Vendor release notes for security, monitoring and backup agents | Update the agent first, or wait. An unsupported endpoint agent is the most common cause of a bad image |
| No known issue blocks it | Windows release health, Windows 11 version 26H2 known issues | Wait for the fix if a known issue affects your configuration |
Two of these deserve a second look:
- Start from the source VM. An enablement package needs a running, ungeneralized Windows install. If your process captures the image directly from a VM and deletes it, create a new VM from the latest image version first, upgrade that, and capture again.
- Check your agents. The AVD agent and FSLogix update themselves, but third-party endpoint protection drivers often have a supported-version list. Confirm 26H2 is on it before you build.
2. Download the 26H2 enablement package
The package is KB5121794: Feature update to Windows 11, version 26H2 by using an enablement package. Microsoft delivers it through two channels:
| Channel | Where to find it | Notes |
|---|---|---|
| Windows Update | Settings → Windows Update → Windows 11, version 26H2 is available → Download & install | Simplest for a single build VM |
| WSUS | Product Windows 11, classification Upgrades. The update is named Windows 11, version 26H2 | Approve it for the computer group your build VMs belong to |
| Microsoft Update Catalog | Not offered | Microsoft lists the catalog as not available for this package |
Download the Windows 11, version 26H2 enablement package (KB5121794) →
Microsoft rolls 26H2 out gradually, so the offer can take a while to appear on a given VM. If it doesn't appear after you've installed the latest cumulative update and checked for updates:
- Confirm no policy targets 24H2 or 25H2 (see the prerequisites table).
- If you manage feature updates with Windows Update for Business, set Select the target Feature Update version to Windows 11, 26H2 on the build VM.
- If you use WSUS, approve Windows 11, version 26H2 for the build VM's group.
3. Install it on the image's source VM
- Snapshot the OS disk of the source VM. Name it after the current image version so you know what it restores.
- Start the VM and sign in with a local administrator account.
- Install the latest cumulative update. Settings → Windows Update → Check for updates, install everything offered and restart. Confirm KB5124010 or a later cumulative update is in Update history.
- Install the enablement package. Back in Windows Update, select Download & install next to Windows 11, version 26H2 is available, or install the approved update from WSUS.
- Restart when prompted. Microsoft requires a restart to finish the upgrade. Because the features are already on disk, it's a normal restart, not a lengthy upgrade.
4. Verify the upgrade
After the restart, confirm the image really is on 26H2 before you capture it:
winvershows Version 26H2 and a build number starting with 26300.- Settings → Windows Update shows no pending restart and no failed installs.
- Your apps start. Open Microsoft 365 Apps, Teams and your line-of-business apps once, and check that the security agent reports healthy.
To check the version from a script, this PowerShell line returns 26H2:
(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').DisplayVersion
Then run Windows Update once more to pick up anything released for 26H2 since the cumulative update you installed.
5. Capture a new image version and roll it out
From here it's your normal monthly image process, with one extra test pass because the version changed:
- Clean up the image. Clear temporary files and run your usual pre-capture steps.
- Generalize and capture. Run Sysprep and capture the VM as a new version in Azure Compute Gallery. Never overwrite the current version. It's your rollback.
- Test on a validation pool. Deploy a few hosts from the new version to a validation host pool and have real users sign in. Check sign-in time, FSLogix profile attach, Teams media optimization and printing.
- Roll out in stages. Replace production hosts in batches, draining each one before it's replaced, and keep the previous version until the new one has run a full working week.
Replace hosts or staged rings? compares the two rollout patterns in detail.
With Atlas AVD
Atlas AVD's golden image builder captures the upgraded source VM, publishes it as a new numbered version in your Azure Compute Gallery and replicates it to every region your host pools use. Once the version is published, the rollout replaces hosts in batches that drain first, and the previous version stays one click away if the validation pool turns something up.
6. Troubleshooting
| Symptom | Likely cause | Fix |
|---|---|---|
| 26H2 isn't offered in Windows Update | Missing cumulative update, gradual rollout or a target-version policy | Install KB5124010 or later, check the policy, or approve the update in WSUS |
| The offer appears but the install fails | A pending restart or a damaged component store | Restart, run DISM /Online /Cleanup-Image /RestoreHealth, then retry |
winver still shows 24H2 or 25H2 | The restart hasn't happened yet | Restart the VM and check again |
| Sysprep fails after the upgrade | A per-user Store app update that isn't provisioned for all users | Check the Sysprep log for the package name, remove it for the affected user and run Sysprep again |
| Hosts from the new image misbehave | An agent or app that doesn't support 26H2 yet | Roll the pool back to the previous image version and update the component before rebuilding |
Prerequisites checklist
- Image runs Windows 11 24H2 or 25H2
- KB5124010 (September 22, 2026) or a later cumulative update installed
- Working on the ungeneralized source VM
- OS disk snapshot taken, previous image version kept in the gallery
- Windows Update or WSUS reachable from the VM
- No target-version policy pinning 24H2 or 25H2
- Security, monitoring and backup agents support 26H2
- No open known issue on Windows release health affects your setup
Sources
- Microsoft Support: KB5121794: Feature update to Windows 11, version 26H2 by using an enablement package
- Microsoft Support: September 22, 2026—KB5124010 Preview
- Microsoft Learn: Windows release health
- Microsoft Learn: Create a managed image of a generalized VM in Azure
- Microsoft Learn: Store and share images in an Azure Compute Gallery