computer still running Version 23H2 (os build 22631.6199)

I have a windows 11 Pro Geekom Mini PC that is still running version 23H2 (OS Build 22631.6199). I have not been online much recently and just started seeing information about a secure boot deadline of June 2026. I am not sure how to make sure if there is something that I need to do or how to check on this on my pc. I also have the feeling that my pc has not updated the version that is running on my pc and when I checked for updates the computer says that it is up to date.
As I said, I haven't been online much over the past year or so, but when I have turned it on, I do see that there are updates for Cumulative Update for Windows 11 Version 23H2 for x64-based Systems, Microsoft Defender updates. There was a Update for Windows Security platform - KB5007651 (Version 10.0.29510.1001) back in February of this year. Microsoft Office updates, 2025-11 Cumulative Update for Windows 11 Version 23H2 for x64-based Systems (KB5068865) that was installed 11/12/25.

Should I have gotten an update to a newer version or is there an update to the current version that I should have installed that Windows Update did not do?


Is this anything that I should be doing that windows update is not doing or be concerned with?

Thank You.

What matters for Secure Boot is installing the latest Monthly Update (May or June 2026).

Check with Geekom support if a newer BIOS update is available which includes the CA 2023 certs. Some PC's may have BIOS'es with the dreaded OEM "Test Key", and those are considered mostly insecure. If you have one, there is a way to delete all factory keys and install a complete set of MS keys which gets you past the CA 2023 migration problem.

But find out if there's a BIOS update which makes the update process simpler.

garlin said:

Check with Geekom support if a newer BIOS update is available which includes the CA 2023 certs.

Click to expand...

I see an update dated May 25th 2026.

IT11 – Geekom

Please perform the following steps:





1) Add WMIC:

DISM /Online /Add-Capability /CapabilityName:WMIC~~~~






2) Run Tuneup plus > post a share link








3) Run the V2 log collector > post a share link






4) Run administrative PS > post share links

Get-HotFix
UsoClient StartScan
dism /Online /Get-Packages

I'm still using version 23H2, and I've already updated my certificates without having to run any of the scripts posted on this forum.

The first thing you need to do is update your system's firmware. According to @KevTech, there's a recent update for your system, so I assume it already contains the necessary information to update the certicates.

Next, you need to update Windows. You have two options. The first one, if your system supports it, is to update to 24H2 or 25H2 via Windows Update.

The second option, which is the one I chose, is to block updates to version 23H2. Since version 23H2 is no longer supported for the Home and Pro editions, you will no longer receive updates through Windows Update. The last automatic update for 23H2 through Windows Update is KB5068865 from November 2025.

However, since the Enterprise and Education editions of 23H2 are still supported until November 2026, you can download all the necessary updates manually and install them on your system without any issues. Since December 2025, there has been a monthly update. Install all updates in chronological order. These manual updates work for any version of 23H2, whether Home, Pro, Enterprise, or Education. The most important manual update is the one from March or April (I don't remember), which includes an automatic script that officially checks and updates the 2023 certificates.

The latest version of Windows 11 23H2 is 22631.7079.

There is a second option. Install VM and run Windows 24H2/25H2 as a guest OS. Its not going to run natively but its a small tradeoff for extending an old PC's useful life. Hardware is an artificial limit.

The Secure Boot update task is present in all currently supported W10 22H2, W11 23H2, 24H2/25H2 and Windows Server releases. You don't need to upgrade Windows (stay on 23H2) to apply the Secure Boot updates.

But you should be on the latest Monthly Update after installing the BIOS update, because the boot manager's been changed several times for security reasons. Last being in April 2026.

Thanks for all the suggestions. I did go to geekom and for the XT13 PRO series it states that there is a system update.

Under BIOS & Firmware the are a few items


under drivers & Tools there are quite a few items




Looks like I am going to need to find out which BIOS is in my computer right now and what I need to update regarding the BIOS and then the other stuff.

Then see if my system supports the update to 24H2 or 25H2 . If not then it looks like I may need to find out how to download all the necessary updates manually and install them on your system as win11Raider stated.

Thanks. I will let you know how everything goes.

I think you will have no problem upgrading to version 24H2 or 25H2.

However, if you prefer to stay with version 23H2, you will first need to block updates to 24H2 or 25H2 using the InControl app (which is free, secure, and very easy to use). Updates for version 23H2 can be found here (on the left panel, you can find the updates for every month. The go down and in "How to get this update", select "Catalog").

Thanks win11raider! I did contact geekom asking which of the bios firmware I should be selecting, but have not heard back from them yet. I did notice that there is a system update on their page statingWin11Pro24H2.26100.2454 and I asked about that as well, but not sure what to do.
I will look into that InControl app and then check out that page for the those updates. I greatly appreciate it.

Sorry about not replying sooner. I was away for a couple days. Anyway, I did hear back from Geekom and they were asking what version of Bios I currently have so I got back to them about that and will see which BIOS I should select to install on my pc.
Once I update the BIOS, will that allow my system to get updated to the current version of Windows 11Pro so I will be running the most current version rather than Version23H2 (OS Build 22631.6491) ?

In the meantime, I did install that InControl app that win11raider suggested and then did a backup and started to install the updates for version 23H2 using the link at May 12, 2026—KB5087420 (OS Build 22631.7079) - Microsoft Support and then selecting first update that was not on my computer, downloaded and installed that one. Did some stuff on my computer for a couple hours and when all was still running fine, I went back and selected the next update and downloaded that one. I did another backup of my system and then installed that update. Did the same thing yesterday and then when I went to download the next update which is January 17, 2026—KB5077797 (OS Build 22631.6494) Out-of-band - Microsoft Support I had some issues. I was getting an error - This website encountered and error - error number 8DDD0020. After trying a few different browsers it did finally download. I have not installed that download / .msu file yet but will do that after I have created another complete backup of my computer (just in case)


I also asked Geekom if I should be downloading and installed the download listed on their site for system. Image below which actually stated Windows11Pro24H2.26100.2454 dated 2024-12-04

The BIOS version doesn't have anything to do with your Windows release. If you have a recent BIOS, it's more likely the Secure Boot certs are added as factory defaults and making the Secure Boot update painless.

Regardless of whether you stay on 23H2 or update to 25H2, your Windows should have the latest Monthly Update installed for that release. This guarantees you have a current version of the Windows boot manager for security reasons. The same boot files are pushed uniformly across all the supported Windows.

lnjr said:

Looks like I am going to need to find out which BIOS is in my computer right now

Click to expand...

CPU-Z on the "Mainboard" tab will show you what BIOS you're on right now.
For example... for my motherboard...

NormanF said:

There is a second option. Install VM and run Windows 24H2/25H2 as a guest OS. Its not going to run natively but its a small tradeoff for extending an old PC's useful life. Hardware is an artificial limit.

Click to expand...

No, the requirement for SSE4.2 is not artificial and cannot be bypassed! Attempting to boot 24H2 or 25H2 Setup at a CPU without SSE4.2 will hang the system with a black screen. The same will happen to the virtual machine running in such CPU. You can check for SSE4.2 using CPU-Z utility.

If CPU-Z shows you CPU has SSE4.2, then all you need is to download the 25H2 ISO (yes, you can upgrade directly from 23H2 to 25H2), bypass compatibility check if needed, and upgrade. My main PC (2nd system specs) is a 3rd generation Intel Core-i7 running Windows 11 25H2 without issues.

spapakons said:

No, the requirement for SSE4.2 is not artificial and cannot be bypassed! Attempting to boot 24H2 or 25H2 Setup at a CPU without SSE4.2 will hang the system with a black screen. The same will happen to the virtual machine running in such CPU. You can check for SSE4.2 using CPU-Z utility.

If CPU-Z shows you CPU has SSE4.2, then all you need is to download the 25H2 ISO (yes, you can upgrade directly from 23H2 to 25H2), bypass compatibility check if needed, and upgrade. My main PC (2nd system specs) is a 3rd generation Intel Core-i7 running Windows 11 25H2 without issues.

Click to expand...

I was referring to a VM that can emulate SSE4.2. You cannot boot Windows 24H2/25H2 natively on a PC with a chip that doesn't support the instruction set.

lnjr said:

Did the same thing yesterday and then when I went to download the next update which is January 17, 2026—KB5077797 (OS Build 22631.6494) Out-of-band - Microsoft Support I had some issues. I was getting an error

Click to expand...

This could be the cause of the error. You must install the updates in chronological order. You have installed an older version (January 2026) over the newer one (May 2026).

Since your last update via Windows Update was November 2025, the first off-line update must be December 2025. After that, install January 2026, and so on. Finally, you can install the update June 2026.

There are monthly updates that do not require all previous updates (since some updates includes the previous fixes), but I recommend that you install them all.

At first I don't think you can run 24H2 and 25H2 on a CPU without SSE4.2 either natively or in a virtual machine that shares the same CPU. I tried that in VMWare Workstation. I even tried to fake the CPU ID using Intel SDE Tool, also didn't work. Which Virtual Machine allows you to successfully emulate SSE4.2 instructions on a CPU without them? Please give details step-by-step how to achieve it. I wouldn't mind if I run Windows 11 23H2 as host in my test laptop (see 1st system specs) and then run Windows 11 25H2 in a virtual machine. It is not very fast anyway so a small performance penalty would not make a huge difference.

Secondly, the issue is because newer updates make older updates obsolete. If you miss a cumulative update and you install a newer one, you are OK. You don't need or cannot install the missing update because it is no longer applicable to your system. If you download it from Microsoft Updates Catalog and try to install it manually you should see an error. This is normal. If you like me, are concerned you might miss some feature, it is better to download all updates and install them in chronological order than suggested. To have a reference, when I installed Windows XP to a friend back in the day, I didn't trust the Windows XP SP3 CD-ROM. I installed the original (aka RTM) version, Windows XP and then manually installed SP1, then SP2 and then SP3 to make sure I have everything and I am not missing any components or features. Similarly, I didn't install Microsoft dotNET 3 directly, I installed dotNET 1.1 first, then 2.0, then 3.0, then 3.5, then 3.5 SP1 and finally 4.0 (there wasn't any newer back then). This was because some rather old applications and games would require an older version of Microsoft dotNET and of course you cannot install it if you have a newer version installed. So I installed all versions in order to make 100% sure I am not missing anything and I am as much backwards compatible as possible.

Even today in Windows 11, I first installed Windows Core 1.0, then 1.1, 2.0, 2.1, 2.2, 3.0, 3.1 and then Microsoft dotNET 5, 6, 7, 8, 9, 10 and even 11 Preview to be 100% sure I can run everything. Also for the same reason I have installed both the x86 and x64 versions of VC Redist 2005, 2008, 2010, 2012, 2013, 2015 and 2017-2026. I hate it when I see an error that some component is missing, no matter how old or how new is the application or game I'm trying to run.

I am downloading those updates in the order as listed on the MS website. I started by checking my history and then finding the very next one and selecting that one to download and then install. I am not trying to just go to the most recent update. I was having an issue downloading the one update - I did eventually get that download and it installed with no issues at all this morning. I have now downloaded the next one that comes after the one that I installed today and I will install that tomorrow morning. I am not getting any errors when installing the actual .msu file / update.

My pc is about 18 months old. If the current version which is 23H2 then wouldn't the computer automatically update to the next stable version or at least give me that option with the downloads?

Thanks for the suggestion about CPU-Z - will definitely check it out!

Since there are a few different options on the Geekom website for my unit regarding BIOS I did contact them to make sure that I am downloading and installing the proper one. Waiting to hear back from them now.

lnjr said:

My pc is about 18 months old. If the current version which is 23H2 then wouldn't the computer automatically update to the next stable version or at least give me that option with the downloads?

Click to expand...

Given the computer you have, Windows Update should update your Windows to 24H2 or 25H2 without any issues, unless you've blocked updates and Windows remains on 23H2, as I have.

If you have a Windows 11 compliant installation (UEFI boot, TPM 2.0 and Secure Boot enabled), then you should be offered to upgrade to 25H2 via Windows Update. If for any reason compatibility breaks, then you must make it compliant or bypass compatibility check to manually upgrade using the ISO. There's a utility to confirm Windows 11 compliance. I am on my mobile now, I don't remember which one it is.