How to Update Devices to Windows 11 through Automox

Issue

An organization needs to move devices to Windows 11, or move existing Windows 11 devices to a newer feature release (for example, 23H2 to 24H2 or 24H2 to 25H2). Windows feature updates (version upgrades) are not delivered by an Automox Patch policy the same way monthly cumulative updates are, so administrators are often unsure which mechanism to use, how to target a specific release, and how to confirm that a device is actually eligible for the upgrade before attempting it.

Environment

• Automox (current agent release)
• Windows 10 and Windows 11 devices
• Automox console: Manage > Worklets, Worklet Catalog, Patch policies

Overview

There are two different kinds of Windows updates involved, and Automox handles them differently:

• Cumulative updates (CUs) — the monthly quality/security rollups for the release a device is already on. Automox Patch policies deliver these normally; they appear in the console under the Security Updates classification. No Worklet is required for CUs.
• Feature updates — version upgrades such as Windows 10 → Windows 11, or Windows 11 23H2 → 24H2. These are full OS upgrades and are performed through an Automox Worklet, using one of two approaches:
  1. Windows Update targeting (registry) approach — a Worklet sets the Windows Update for Business target-release registry values so Windows Update itself offers and installs the desired release. See Microsoft's documentation of the TargetReleaseVersion policy.
  2. ISO-based upgrade approach — a Worklet downloads the Windows 11 installation media and runs the upgrade directly, with a built-in readiness (eligibility) check. This is the more deterministic option and works even when Windows Update offer timing is unpredictable.

After a device lands on the target release, ordinary Patch policies resume delivering that release's monthly CUs as Security Updates — feature-update targeting does not replace normal patching.

Windows 11 releases map to OS build numbers, which is how a Worklet decides whether a device is already compliant:

As of 2026, 24H2 and 25H2 are the current Windows 11 servicing releases; earlier releases (21H2, 22H2, and in many editions 23H2) are at or approaching end of servicing. Confirm the current lifecycle status in Microsoft's Windows 11 release information before choosing a target release.

Resolution

Option 1: ISO-based upgrade Worklet with an eligibility gate (recommended)

1. In the Automox console, open Manage > Worklets and add the catalog Worklet Windows - Maintenance Tasks - Windows 10 to Windows 11 Upgrade via ISO (Worklet Catalog link); this catalog Worklet requires an Automox premium/paid Worklet Catalog entitlement. The same Worklet pattern also handles Windows 11 → Windows 11 feature upgrades (for example, 23H2 → 24H2) because it compares OS build numbers.

2. Set the target release at the top of both the Evaluation and Remediation code. The Worklet maps the release name to its build number:

   # --! Target Release !--
   $release = "24H2"
   
   switch ($release) {
       "22H2" { $build = 22621 }
       "23H2" { $build = 22631 }
       "24H2" { $build = 26100 }
       "25H2" { $build = 26200 }
       default { $build = $null }
   }
   

3. Understand how the Evaluation code decides which devices to flag:
   • If the device's current build is greater than or equal to the target build, it exits 0 — the device is already compliant and is skipped.
   • Otherwise the Worklet runs its Windows 11 readiness check (the eligibility function defined in the Worklet). If the device passes, the Evaluation exits 2, which flags the device for remediation.
   • If the device fails the readiness check (for example, unsupported CPU or TPM), it exits 0 and is left alone rather than attempting an upgrade that would fail.
4. On remediation, the Worklet re-runs the same compliance and eligibility gate, then calls its upgrade function to download the installation media and start the in-place upgrade.
5. Verify readiness requirements before broad rollout: devices must meet the Windows 11 system requirements and have sufficient free disk space for the installation media plus the upgrade working set.
6. Assign the Worklet to a pilot group first, run it with Run on Assigned Devices (or on the policy schedule), and confirm results in the device's Activity Log before expanding scope.

Option 2: Windows Update targeting via a registry Worklet

Use this approach when devices should receive the feature update from Windows Update itself rather than from installation media.

1. Deploy the catalog Worklet Windows - Configuration - Set Registry Keys for Windows 11 Feature Upgrades (Worklet Catalog link) — included with the standard (base) Worklet Catalog — or your own Worklet that sets the target-release values under HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate:

   • ProductVersion (string) = Windows 11
   • TargetReleaseVersion (DWORD) = 1
   • TargetReleaseVersionInfo (string) = the target release, for example 24H2

   These are the standard Windows Update for Business values documented in Microsoft's TargetReleaseVersion policy reference. Deploying them through a Worklet avoids manual regedit work on each device; if editing manually for testing, back up the registry first per Microsoft's registry backup guide.

2. Allow time for the offer to appear. The device must be online and checking in with Windows Update; the feature update may take one or more scan cycles to become visible.
3. Validate on the device: open Settings > Update & Security > Windows Update (Windows 10) or Settings > Windows Update (Windows 11) and confirm the "Upgrade to Windows 11" (or target-release) offer appears.
4. After devices reach the target release, keep the pinned values current or remove them. A stale TargetReleaseVersionInfo pin pointing at an older release can prevent devices from being offered newer feature updates, and in some configurations can interfere with how updates are offered to the device.

Confirm normal patching continues

1. After the upgrade, confirm the device checks in on the new build (Device Details shows the updated OS version after the next scan).
2. Verify that the device's regular Patch policy continues to deliver the new release's monthly cumulative updates — these appear under the Security Updates classification. If CUs stop appearing after a feature-update rollout, review any Windows Update registry pins or deferral policies set on the device (Option 2, step 4).

Troubleshooting

• Windows 11 / target release is not offered (Option 2): Confirm the registry values are exactly as listed above, restart the device, and confirm it meets the Windows 11 system requirements. Also confirm the Worklet ran successfully in the device's Activity Log.
• Worklet flags no devices (Option 1): Devices already at or above the target build exit compliant by design. Ineligible devices also exit compliant so they are not flagged — check the Evaluation output in the Activity Log to see which branch a device took.
• Upgrade attempts fail on specific devices: Re-check eligibility (CPU generation, TPM 2.0, Secure Boot, disk space). The eligibility gate exists precisely to keep these devices out of the remediation path; if a device was flagged and still fails, its readiness state may have changed between evaluation and remediation.
• Registry changes do not persist: Group Policy or MDM (for example, Intune) settings that manage Windows Update can overwrite locally written values. Check for competing management of the WindowsUpdate policy key.

Notes

• Choose one approach per device group. Mixing ISO-based upgrades with Windows Update target-release pins on the same devices makes behavior harder to predict.
• The eligibility-gate pattern (compliant → exit 0, eligible and behind target → exit 2) is a general Worklet Evaluation convention: exit code 0 means compliant, and a non-zero exit flags the device for remediation. See the Automox Worklet documentation on docs.automox.com for Evaluation/Remediation mechanics.
• Windows 11 version-to-build mapping is published in Microsoft's Windows 11 release information; new releases (after 25H2) will need a new entry in the Worklet's switch block.