Start with the licensing, not the software
Almost every deployment that goes wrong goes wrong here, because the licensing decision quietly determines which deployment methods are even available to you.
The first question is edition. Windows 11 Pro is the practical minimum for business use, and not for the reasons the marketing pages give. Pro is what lets a machine join a domain or Microsoft Entra ID, be managed centrally, and use BitLocker device encryption. Windows 11 Home cannot be enrolled in Windows Autopilot and cannot be managed by Intune in any meaningful way. If you buy Home machines to save money, you will pay it back in manual configuration time within the first week. Our comparison of Windows 11 Home and Pro covers the feature split in detail.
The second question is where the licences come from, and there are three realistic answers for a business of this size.
| Route | What it suits | The catch |
|---|---|---|
| OEM, pre-installed | Buying new PCs that arrive with Windows 11 Pro already licensed | The licence is tied to that machine for life and cannot be reused when you replace it |
| Retail keys, one per machine | Upgrading existing hardware, or PCs bought without an OS | You are managing a list of keys, so keep a record from day one |
| Volume licensing | Larger estates with an agreement already in place | Minimum commitments and an agreement to administer — rarely worth it below about 50 seats |
For most businesses in the five-to-fifty range the answer is a mix: OEM licences on new hardware, and individually bought Pro keys for machines being upgraded rather than replaced. If the terminology in that table is doing more harm than good, our Microsoft licensing glossary defines each term in a sentence.
A lot of deployment guides assume you will activate machines through a KMS server. Most small businesses cannot: KMS requires a minimum of 25 Windows client machines checking in before it will activate anything at all. Below that threshold it does nothing. If you have fewer than 25 PCs, you are activating per device — with the key that came with the machine, or one you bought for it.
Pick one Windows version and freeze it
The second decision is which Windows 11 feature update every machine will run. Standardising this is the difference between a fleet and a collection of computers, because it means one set of instructions, one known set of behaviours, and one support answer.
As of August 2026, version 25H2 is the right target. It became generally available on 30 September 2025 and, on the 24-month servicing window that applies to Home and Pro editions, receives updates until 12 October 2027.
| Version | Available from | Pro updates end |
|---|---|---|
| 24H2 | 1 October 2024 | 13 October 2026 |
| 25H2 | 30 September 2025 | 12 October 2027 |
| 26H1 | 10 February 2026 | 14 March 2028 |
Two things worth knowing about that table. New machines may well arrive on 24H2, which has barely a year of updates left — check and update before rolling them out, not after. And 26H1 shipped on new devices in early 2026 rather than as an in-place update, so a fleet standardised on 25H2 stays coherent even if a few newer machines arrive on something else.
Enterprise and Education editions get 36 months rather than 24 on the same releases. That difference is one of the genuine arguments for Microsoft 365 E3 in a growing business, though it rarely justifies the cost on its own.
Choose a deployment method by how many machines you have
This is where most guidance goes wrong, because it recommends a single method regardless of scale. The honest answer depends almost entirely on the number of PCs and whether you already pay for Microsoft 365.
| Fleet size | Sensible method | Roughly what it involves |
|---|---|---|
| 1–5 PCs | Manual setup, documented | Set each machine up by hand from a written checklist. Automation costs more than it saves at this size. |
| 5–15 PCs | Provisioning package | Build a small configuration file with Windows Configuration Designer, put it on a USB stick, apply it during setup on each machine. |
| 10–50 PCs | Windows Autopilot with Intune | Machines are registered to your tenant, and configure themselves on first boot wherever the user opens them. Intune is included in Microsoft 365 Business Premium. |
| 50+ PCs | Autopilot, or Configuration Manager OSD | Cloud-first estates use Autopilot; sites with existing on-premises Configuration Manager infrastructure use OSD task sequences. |
The Microsoft Deployment Toolkit was for many years the default way to build and deploy Windows images in smaller organisations. Microsoft retired MDT with immediate effect in an announcement last updated in January 2026. It receives no further updates, fixes or support, and specifically no compatibility updates for new Windows releases — so an MDT process will drift out of step with Windows 11 as new versions ship.
Existing MDT deployments keep working, and there is no in-place upgrade path to anything else. Microsoft’s recommended replacements are Windows Autopilot for cloud-managed estates and Configuration Manager OSD where on-premises infrastructure already exists. If you are starting a deployment project now, start on one of those.
Autopilot or do it by hand?
Most of these are true
- You have more than about ten machines
- You already pay for Microsoft 365 Business Premium
- Staff work from more than one location
- You replace or reissue machines regularly
- You want a lost laptop wiped remotely
Most of these are true
- Fewer than ten machines, all in one office
- No Microsoft 365 subscription with Intune
- The machines rarely change hands
- Nobody has time to learn a new console this month
The honest framing is that Autopilot is an investment in the second deployment, not the first. Setting it up for eight machines you will never touch again is effort you do not get back. Setting it up for a fleet you will keep adding to, reissuing and eventually replacing pays for itself the first time a new starter’s laptop configures itself without anyone driving to an office.
A practical order of work
Whichever method you choose, the sequence is much the same. Doing it in this order avoids the two expensive mistakes: discovering a compatibility problem after you have bought hardware, and discovering a licensing gap after you have deployed.
- Audit what you have. Every machine, its age, its specification, and whether it meets the Windows 11 requirements. Split the list into replace, upgrade and retire. Our guide to the Windows 11 system requirements covers what actually disqualifies a machine.
- Decide the standard build. One edition, one version, one list of applications, one set of settings. Write it down — this document is the deployment, everything else is mechanics.
- Sort the licences before you touch a machine. Count the licences you need for the upgrade group and buy them as one batch, so you are not stopping mid-rollout to place another order.
- Build and test on one machine. Configure a single PC exactly as the standard build describes, then have the person who will actually use that kind of machine work on it for two or three days. Problems surface in use, not in testing.
- Prepare the data migration. Decide where user files live — OneDrive Known Folder Move is the least painful answer for most businesses — and confirm files are actually syncing before any machine is wiped.
- Roll out in waves. Two or three machines first, then a week’s pause, then the rest. The pause is not caution for its own sake; it is when the problems you did not anticipate arrive.
- Record the keys and the configuration. Which key went on which machine, where the standard build document lives, and who to ring. This is the step everyone skips and everyone later needs.
Standardising what sits on top
Deploying Windows is only half of it. A machine that boots to a clean desktop and has none of the software the job needs has not been deployed, it has been unwrapped.
Applications. If you are using Intune, applications are assigned to groups and install themselves. If you are not, winget — the package manager built into Windows 11 — will install a defined list from a single command, which turns an afternoon of clicking Next into a few minutes per machine.
Office. Perpetual volume editions such as Office Professional Plus install through the Office Deployment Tool with an XML configuration file, which is also how you pin every machine to the same Office version. Retail editions install from the consumer setup page per machine. Both are fine at this scale; the difference is that the volume route is scriptable.
Settings and security. BitLocker, Windows Update behaviour, local administrator rights and screen locks are the four that matter most and the four most often left at defaults. With Intune these are policies; without it, they are items on the standard build checklist, applied by hand and ticked off.
Windows 10 reached end of support on 14 October 2025, and machines still on it are unpatched unless enrolled in Extended Security Updates. ESU is a bridge for the machines you cannot replace in this round, not a plan — see our guide to Windows 10 Extended Security Updates. If some of your hardware fails the Windows 11 requirements, the options for unsupported PCs are worth reading before you write those machines off.
The mistakes that cost the most time
- Buying Home editions for business machines. The saving per machine is small and the management cost is permanent.
- Deploying before the data plan exists. Wiping a machine whose user had three years of files in a local folder is the single most expensive mistake on this list.
- Letting versions drift. Machines set up months apart end up on different feature updates, and every support question then needs qualifying with “which one is it?”
- Not recording keys. A year later, nobody can prove which licences the business owns, and a rebuild becomes a repurchase.
- Rolling out everything on a Friday. Whatever goes wrong, goes wrong over the weekend.
How many machines, how many are being replaced rather than upgraded, and whether you already have Microsoft 365. That is usually enough for us to work out the licence count and flag anything that will cause a problem — before you order.
Frequently asked questions
No. A standard Windows 11 licence covers one device. Volume licensing uses shared MAK or KMS keys, but each activation still consumes one licence — the key is shared, the entitlement is not. Using a single retail key across several machines will fail activation.
In practice, yes. Windows 11 Home cannot join a domain or Microsoft Entra ID, cannot be enrolled in Windows Autopilot, and cannot be centrally managed with Intune. Pro is the minimum edition for any managed business deployment.
Microsoft retired MDT in an announcement last updated in January 2026 and recommends Windows Autopilot for cloud-managed deployments, or Configuration Manager OSD where on-premises infrastructure already exists. Existing MDT installations keep working but receive no updates or compatibility fixes for new Windows releases.
KMS requires a minimum of 25 Windows client machines checking in against the KMS host before it will activate any of them. Below that threshold it will not work at all, which rules it out for most small businesses.
Version 25H2, which is supported on Home and Pro editions until 12 October 2027. Check what new machines arrive with — some still ship on 24H2, which reaches end of servicing on 13 October 2026.
Autopilot itself is not sold separately, but it requires Microsoft Entra ID and a management service such as Intune, which is included in Microsoft 365 Business Premium and the E-series plans. If you already pay for one of those, Autopilot is available at no extra cost.
For ten to twenty machines, plan on a fortnight from audit to completion — most of which is planning, testing on one machine and migrating data rather than installing Windows. The installation itself is under an hour per machine.
It depends on the licence. Retail licences can generally be transferred once removed from the old machine. OEM licences supplied pre-installed on a PC stay with that hardware permanently and cannot be moved.
Gary Walsh is the Head of Tech Support at Software Supplies, with more than 20 years in the IT industry. Fully Microsoft-certified and experienced across the full business software stack — from Windows and Office to cloud infrastructure and device management — Gary delivers practical, no-nonsense advice that helps users and businesses get the most from their technology.
