Windows 11 Upgrade with Intune: Prerequisites and Troubleshooting

 As Microsoft ends support for Windows 10 in October 2025, organizations must start preparing to upgrade their Windows 10 devices to Windows 11. Devices that do not meet the hardware requirements for Windows 11 must either be replaced or covered under an Extended Security Update (ESU) program, which will come at an added cost.

This guide will walk you through the upgrade readiness, hardware prerequisites, known compatibility issues, and how to troubleshoot feature upgrade deployments using Microsoft Intune.

---

⚙️ Upgrade Options

Organizations have three primary choices moving forward:

1. Upgrade to Windows 11 – For supported hardware.
2. Replace hardware – Devices that do not meet Windows 11 requirements.
3. Purchase ESU (Extended Security Updates) – For legacy systems that must remain on Windows 10.

---

✅ Windows 11 Hardware Requirements

To ensure a smooth upgrade to Windows 11, devices must meet the following minimum system requirements:

• RAM: 4 GB or more
• Storage: 64 GB or more
• Firmware: UEFI capable with Secure Boot enabled
• TPM: Trusted Platform Module (TPM) version 2.0
• CPU: 8th Gen Intel or newer (Note: Devices purchased before 2017 are likely unsupported)

💡 Tip: Use Intune’s Windows 11 readiness report under:

Reports → Endpoint Analytics → Work from anywhere → Windows 11 readiness

This will help you quickly identify unsupported devices.

---

⚠️ Application Compatibility and Known Issues

1. Credential Guard Impact on MSCHAPv2-Based Wi-Fi

• Issue: Breaks traditional MSCHAPv2 authentication (common in enterprise WPA2).
• Workaround: Migrate to EAP-TLS using Intune to deploy PKCS or SCEP-based certificates.

2. Memory Integrity and Driver Incompatibility

• Issue: Memory Integrity (HVCI) can block old or unsigned drivers, causing blue screen errors (BSOD) or app failures.
• Solution: Update or replace legacy drivers before enabling Memory Integrity.

---

📊 Intune Reports to Review Before Upgrading

Before deploying the Windows 11 Feature Upgrade policy, review the following reports in Intune:

1. Windows feature update device readiness
2. Windows feature update compatibility risks

If the device does not appear in these reports or is flagged with compatibility risks, upgrading via Intune may fail or remain in an “offering” state.

---

🧰 Troubleshooting Windows 11 Feature Upgrade Failures with SetupDiag

If an upgrade appears to stall or fail, Microsoft’s SetupDiag tool is your best diagnostic resource.

Use On-Demand Remediation Scripts via Intune

Create a Proactive Remediation script in Intune to automate SetupDiag log collection. Here's a sample PowerShell script you can deploy:

🔧 Remediation Script Sample – Collect SetupDiag Logs

# Remediation Script to run SetupDiag and collect logs

$setupDiagUrl = "https://aka.ms/SetupDiag"

$destination = "$env:ProgramData\SetupDiag"

 

# Create directory if not exists

if (!(Test-Path -Path $destination)) {

    New-Item -ItemType Directory -Path $destination -Force

}

 

# Download SetupDiag.exe

Invoke-WebRequest -Uri $setupDiagUrl -OutFile "$destination\SetupDiag.exe"

 

# Run SetupDiag and save logs

Start-Process -FilePath "$destination\SetupDiag.exe" -ArgumentList "/Output:$destination\SetupDiagResults.xml" -Wait

 

# Optional: Copy logs to network share (example path)

# Copy-Item -Path "$destination\SetupDiagResults.xml" -Destination "\\yourfileserver\logs\$env:COMPUTERNAME.xml"

✅ Detection Script Sample – Check if SetupDiag Log Exists

$logPath = "$env:ProgramData\SetupDiag\SetupDiagResults.xml"

 

if (Test-Path -Path $logPath) {

    Write-Output "SetupDiag log exists."

    exit 0

} else {

    Write-Output "SetupDiag log missing."

    exit 1

}

How to Deploy in Intune:

1. Go to Endpoint Security → Proactive Remediations.
2. Create a new script package.
3. Upload the detection and remediation scripts.
4. Assign it to the target device group.
5. Review the execution status in Intune > Reports.

Once logs are collected, open the .xml file and review the blockers or compatibility errors (e.g., drivers, apps, or TPM issues) that caused upgrade failures.

---

🚀 Force Windows 11 24H2 Upgrade via PowerShell

If the device is eligible and the upgrade is still not applying, you can use the following script to force the 24H2 Windows 11 upgrade:

🔗 GitHub: Force Windows 11 24H2 Update Script

This script is ideal for:

• Remote remediation
• One-time on-demand upgrade
• Skipping upgrade delays in Windows Update for Business (WUfB)

---

📝 Summary Table

Area	Details
Deadline	Windows 10 EOL: October 2025
Upgrade Options	Windows 11, New Hardware, or ESU Licensing
Pre-checks	Use Intune readiness and compatibility reports
Known Issues	Credential Guard Wi-Fi issues, Memory Integrity blocking old drivers
Troubleshooting Tool	SetupDiag + Intune remediation
Force Upgrade Script	GitHub: Windows 11 24H2 Upgrade Script

---

📌 Final Recommendations

• Start auditing today with Intune readiness reports.
• Replace or repurpose unsupported devices ahead of Q3 2025.
• Pilot Windows 11 upgrades in phases using Feature Update Rings in Intune.
• Use SetupDiag automation for ongoing upgrade issue visibility.
• Communicate the upgrade strategy across the organization early.