What Changed in Windows 11

Windows 10 reached the end of support on 14 Oct 2025, and 22H2 was its last version, so Windows 11 is the baseline to know, the picture of a clean machine you compare others with. Versions 24H2 and 25H2 take the same monthly updates, so their core trees should match. 26H1, preinstalled only on select new devices, is built on a different Windows core, so check what it shares before reusing a baseline.

Normal now depends on the set-up as much as the build. Credential Guard, on by default from 22H2 on eligible domain-joined Enterprise and Education devices, turns on virtualisation-based security and runs LsaIso.exe beside lsass.exe. Added LSA protection, on by default only on new, enterprise-joined installs that can run hypervisor-protected code integrity (HVCI), makes lsass.exe a protected process.

WMIC is removed from every supported Windows 11 version by the August and September 2026 preview updates, though WMI itself stays. Windows PowerShell 2.0 is gone from 24H2, so a script that asks for it runs in 5.1. From 22H2, Windows Terminal is the default for command-line programs unless someone chose another terminal.

Elevation, running a program with administrator rights, looks different too. Sudo for Windows, from 24H2, opens an elevated command in a new window by default, and in its inline and input-closed modes links the unelevated sudo.exe to a second, elevated one. Administrator protection, off by default but on in the October 2026 Windows security baseline, gives each elevated program a token (the record of who a process runs as) from a hidden, system-generated account.

Two older changes still shift what you compare against. Fast Startup keeps session 0 from the last full boot, so its processes can predate the sign-in by days, and above 3.5 GB of RAM most services run in an svchost.exe of their own. For the tools, built-in Sysmon has been an optional feature since February 2026, and Volatility 3 handles Windows 11 images better from version 2.28.0, so use its current release, 2.28.2.

Each row is a change that alters what a clean machine looks like, or what your tools can read. The last column says what to expect on a machine that has it, so you do not flag a normal change as a finding, or miss a finding because a baseline from another build hid it.