Windows 11 Migration for Business in India: A 2026 Playbook

The 47 laptops that were never going to run Windows 11

In March 2026 we finished a Windows 11 rollout for a 260-seat engineering firm off Old Madras Road. When we ran the eligibility audit in November 2025, 47 of their 312 laptops failed the CPU cutoff. All 47 were perfectly healthy machines — i5-7200U and i5-8250U units bought in 2018 and 2019, still under their original three-year warranty extensions, still doing CAD drawings without complaint. Every one of them was ineligible for a supported Windows 11 install, and every one of them had been running Windows 10 22H2, which stopped receiving security updates on 14 October 2025.

That gap — between "the hardware works" and "the hardware is supported" — is the whole Windows 11 migration problem in India in one paragraph. It is not a licensing exercise. It is an asset-management exercise with a security clock running.

This article is about how to run that exercise properly: how to audit eligibility at scale, what to actually do with the machines that fail, how to sequence the rollout without stopping the business, how to test applications before you break finance, and what staying on an unsupported build really costs you in exposure terms. If you would rather hand the whole thing to a team that does this weekly, our end-computing services cover audit through to decommissioning.

What actually disqualifies a machine

Microsoft's official requirements for Windows 11 (as of the 24H2 and 25H2 builds current in 2026) come down to four things that matter in a commercial fleet.

TPM 2.0. A discrete or firmware TPM, version 2.0, enabled and owned. Most business laptops from 2016 onwards have a TPM 2.0 chip. The problem is that it is often disabled in BIOS, or set to the wrong mode — the classic one being Intel PTT left off in a Dell Latitude BIOS, which makes the machine look ineligible until someone goes in and flips it.

CPU generation. This is the hard wall. Intel 8th generation (Coffee Lake, roughly 2017-18 onward) and AMD Ryzen 2000-series and later are supported. Intel 7th generation and earlier are not, with a short official exception list that includes some Xeon and a handful of Skylake-X parts nobody deploys on desktops. Practically: if your fleet has i5-6500, i5-7500, or i5-7200U machines in it, those are done.

Secure Boot and UEFI. The machine must boot in UEFI mode with Secure Boot capable. Machines installed in the Windows 7 era and upgraded in place are frequently still on a legacy BIOS/MBR disk layout. You can convert MBR to GPT without data loss using mbr2gpt, but it is a per-machine operation that has to be scripted and tested, not something you do on a Friday evening across 200 PCs.

4 GB RAM and 64 GB storage. Nominally fine, practically irrelevant. Do not deploy Windows 11 on 4 GB in 2026. It will run, and users will file tickets about it for a year. 8 GB is the floor for knowledge work; 16 GB is the floor for anyone running Excel models over 50 MB, AutoCAD, Tally with a large data set, or a browser with more than fifteen tabs.

The one that catches people out: firmware TPM vs discrete

On older desktops, particularly assembled white-box machines that Indian SMBs buy by the dozen from a local assembler, there may be no TPM header on the motherboard at all. A ₹900 TPM 2.0 module for a Gigabyte or ASUS board solves it if the header exists and the vendor has published a module. If it does not, that machine is not migrating, full stop. We have seen offices try to save ₹18,000 per seat by buying TPM modules for a batch of six-year-old assembled desktops, and then discover the boards have no header. Check before you buy.

Auditing the fleet without visiting 300 desks

The right way to do this is scripted and remote. Two approaches work.

Option one: Microsoft's own tooling. The PC Health Check app is fine for one machine. For a fleet, use either Configuration Manager's Windows 11 readiness dashboard (if you already run MECM) or Intune's Endpoint Analytics with the Windows 11 readiness report (if you are on Intune). Both give you per-device eligibility with the specific failing reason.

Option two: a PowerShell sweep. For offices without MECM or Intune — which in India is most companies under 100 seats — a signed PowerShell script that writes to a CSV is faster to stand up than either console. The four checks you need are TPM version and status, Secure Boot state, the processor name string, and the boot partition style. Something like this, pushed via a login script or PsExec:

$cs = Get-CimInstance Win32_ComputerSystem
$tpm = Get-CimInstance -Namespace "root\cimv2\security\microsofttpm" -Class Win32_Tpm -ErrorAction SilentlyContinue
$sb = Confirm-SecureBootUEFI -ErrorAction SilentlyContinue
$disk = Get-Disk | Where-Object { $_.IsBoot -eq $true }
[pscustomobject]@{
  Hostname = $env:COMPUTERNAME
  CPU = (Get-CimInstance Win32_Processor).Name
  RAM_GB = [math]::Round($cs.TotalPhysicalMemory/1GB)
  TPM_Present = [bool]$tpm
  TPM_Version = if ($tpm) { $tpm.SpecVersion } else { $null }
  TPM_Enabled = if ($tpm) { $tpm.IsEnabled_InitialValue } else { $null }
  SecureBoot = $sb
  BootPartitionStyle = $disk.PartitionStyle
} | Export-Csv -Append -NoTypeInformation \\fileserver\it$\win11-audit.csv

Run it for a week, and you will have a real inventory. The output tells you which machines need a BIOS change (TPM off or Secure Boot off), which need a disk conversion (MBR), and which are genuinely dead (CPU too old). Those are three different remediation tracks with three different costs.

A caution from experience: expect the audit to disagree with your asset register. In the Old Madras Road job, the register said 312 machines. The audit found 338 — 26 were laptops bought on a project budget and never added, plus a few personal devices someone had domain-joined years ago. Budget for that gap; it is usually 5-10%.

Reading the audit output

The percentages vary enormously by how disciplined the buyer has been. A company that refreshes laptops on a four-year cycle has almost no ineligible machines. A company that runs machines to failure has 30% that will not migrate.

What to do with the machines that fail

There are four honest options. Most articles list only the first two; the third and fourth are where the actual savings are.

1. Replace them

The clean answer. A business-grade laptop in 2026 — a Dell Latitude 5450, an HP ProBook 450 G11, a Lenovo ThinkPad L14 Gen 5 — lands between ₹58,000 and ₹82,000 with a three-year onsite warranty, i5-1335U or Ryzen 5 7530U, 16 GB RAM, 512 GB NVMe. A business desktop (Dell OptiPlex 7020, HP ProDesk 400 G9, Lenovo ThinkCentre M70q) is ₹38,000-₹52,000 for a comparable spec.

If you are replacing 20% of a 150-seat fleet, that is roughly 30 machines. Budget ₹18-24 lakh. Spread the purchase across two financial years if March is tight, and remember GST at 18% is input-creditable, so the cash impact is the invoice value less the credit.

There is a real argument for pulling the replacement forward. A machine bought in 2026 will be supported for Windows 11's full lifecycle and will still be inside warranty when the next major OS question arrives. A machine you limp along for two years will not be.

2. Windows 10 ESU — but only as a bridge

Microsoft's Extended Security Updates for Windows 10 is available to businesses. Consumer ESU runs to October 2026; the commercial programme runs up to three years to October 2028, priced per device and escalating each year. For an Indian SMB, the annual per-device cost through a Cloud Solution Provider is typically in the ₹3,000-₹6,000 range for year one (2026 pricing, and it rises).

That is cheap compared with a laptop replacement, which is why some finance heads will push for it. It is the right call for a narrow case: a machine that is genuinely on its way out in six to nine months, or a line-of-business PC running an old instrument or machine-tool controller that cannot be touched. It is the wrong call for a general fleet deferral, because you are paying per device per year for a device you will have to replace anyway, and the price climbs.

3. Repurpose to a role that does not need Windows 11

The machines that fail the CPU cutoff are often perfectly good as thin clients, kiosk terminals, shop-floor label printers, digital signage players, or a reception browsing station. A 2018 i5 with Windows 10 LTSC or a Linux distro behind a firewall is doing useful work that costs nothing extra.

We have converted 20-machine batches of failed-eligibility laptops into Windows 365 Cloud PC endpoints — the local machine becomes a dumb terminal to a cloud-hosted Windows 11 desktop, and the user gets a supported, patched environment. Windows 365 Business runs from roughly ₹2,100 to ₹5,600 per user per month depending on spec (2026 pricing), which is expensive against a ₹60,000 laptop over three years for a full-time heavy user, but very reasonable for a contractor or a shift worker. We covered the thin-client side of this in more depth in our thin-client deployment work, and it is a genuine option rather than a stopgap.

4. Move the workload, not the OS

Some of the failed machines belong to people whose actual work is a browser and a spreadsheet. If the ERP is now on the web and email is Microsoft 365, the OS underneath matters less than the patching posture. Moving those users to a Chromebook or a Linux desktop removes them from the Windows 11 question entirely and reduces your per-seat cost by ₹20,000-₹30,000. It also creates a support problem — your helpdesk now handles two OS families — so be honest about whether you have the bench for it. For a 40-person trading office with no Windows-only software, it works. For a CA firm running Tally and Excel macros, it does not.

The security exposure of staying put

This is the part that gets waved away, and it should not be.

Windows 10 22H2 went out of support on 14 October 2025. That means no more security patches for the operating system. Every month that passes, the unpatched vulnerability list grows. We are now well past the point where a Windows 10 machine on a corporate network can be considered defensible.

What this looks like in practice: the January and February 2026 Patch Tuesdays each fixed between 120 and 160 vulnerabilities across Microsoft products, with a meaningful fraction affecting components that exist in Windows 10. Those fixes will never reach a Windows 10 build. An Edge or Chrome update will patch the browser, and your firewall and EDR will catch some of the rest, but the kernel, the SMB stack, the RDP service and the print spooler underneath are frozen at October 2025.

The compliance angle is sharper than the technical one. If you are a DPDP Act data fiduciary — and any company handling customer personal data at scale now is — you carry an obligation to implement reasonable security safeguards. Running an unpatched operating system across your fleet is hard to characterise as reasonable if there is an incident. Cyber-insurance underwriters have started asking the question directly on renewal forms. We have seen two renewals in 2026 where the questionnaire explicitly probed for out-of-support operating systems, and one where the premium was loaded. Your auditor will ask. CERT-In's incident reporting timelines (six hours for specified incident types) do not get easier when the root cause is a known-unpatched OS.

The realistic exposure for a 100-seat company running, say, 25 machines on unsupported Windows 10: every one of those 25 is a potential initial-access point, and lateral movement from a single compromised workstation to a file server is standard ransomware behaviour. The mitigation is network segmentation — put the legacy machines on their own VLAN with no route to the file server except through a jump host — and that costs money to build and maintain. You are often better off spending that money on replacement.

One failure story, with the bill

In 2024 we took over support for a 90-seat logistics firm in Peenya. They had 22 Windows 7 machines still in production because the warehouse management application had a client that would not run on anything newer, and nobody had wanted to open that conversation. In August 2024 one of those machines was compromised through an unpatched SMB flaw exploited over a VPN that was, itself, three firmware revisions behind. The attacker moved laterally to the file server and encrypted it, plus the backup NAS — because the NAS was domain-joined and the backup service account had domain admin rights, which is its own story.

Recovery took eleven days. The ransom demand was not paid; the restore came from an offsite copy that was three weeks old, so three weeks of invoices, PODs and dispatch records were reconstructed manually from email and WhatsApp. The direct bill: ₹4.2 lakh in emergency response and forensics, ₹2.8 lakh in staff overtime and contract data-entry labour, roughly ₹6 lakh in revenue they could not bill for during the outage, and ₹9 lakh to replace the 22 legacy endpoints and rebuild the network properly. Call it ₹22 lakh, on a company with a ₹9 crore turnover.

The fix, once it was done, was not exotic. A dedicated VLAN for legacy machines, a firewall rule set that allowed only the WMS traffic out, a properly segregated backup with an offline copy, and a two-year plan to replace the WMS client with a browser-based version. The prevention would have cost perhaps ₹3.5 lakh. That is the arithmetic of deferral.

Sequencing the rollout

Do not do this in one weekend. A 200-seat in-place upgrade with no phasing will produce a week of helpdesk chaos and one or two very unhappy departments. Phase it.

Phase 0: The audit and the pilot (weeks 1-3)

The audit as described above. Then pick 10-15 users across functions — one from finance, one from sales, one from a design-heavy role, one from a role with an old printer, and the loudest complainer in the company. Upgrade them first. Their complaints in week two are worth more than any test plan.

Phase 1: The easy third (weeks 4-6)

Knowledge workers on standard hardware, no legacy apps, no specialised peripherals. In a 200-seat company this is 60-70 people. Roll out in batches of 15-20 per evening, with a next-morning floor-walk. Expect a 5-10% per-batch ticket rate in the first week — mostly Outlook profile re-creation, default printer resets, and OneDrive sync confusion.

Phase 2: The application-heavy middle (weeks 7-12)

Finance, operations, anyone running Tally, ERP clients, AutoCAD, SolidWorks, or a vertical application. This phase is gated on the compatibility testing described below. Do not move a department until its applications have been signed off on Windows 11 by the actual users, not by IT.

Phase 3: The difficult tail (weeks 13-20)

The machines that need BIOS changes, the MBR conversions, the users with a scanner from 2014, the one person whose access database is load-bearing. This phase takes as long as the first two combined and involves more desk visits. Build a tracker per machine — not per user — because the same user may have two devices in different states.

Phase 4: Decommission (weeks 20-24)

What happens to the replaced machines is a data-security question. Every failed-eligibility machine going out the door needs its drive wiped to NIST 800-88 standard and a certificate issued. If you are selling them to a refurbisher, get the certificate in writing. If you are scrapping them, physically destroy the drives — a ₹400 drill-and-shred is cheaper than a data breach notification under DPDP.

Application compatibility testing that actually catches things

Windows 11 is a Windows 10 kernel underneath. The application breakage is rarely about the OS version and almost always about one of four things: 16-bit installers, drivers (especially printers and scanners), user profile path assumptions, and Internet Explorer dependencies.

IE dependencies deserve their own paragraph. Windows 10 shipped with IE11 in compatibility mode inside Edge; Windows 11 moved that to IE Mode in Edge, and Microsoft has been retiring the underlying MSHTML engine. In 2026, a Tally or ERP client that calls an embedded IE control will still work under IE Mode, but the clock is genuinely running. We have a client on an old insurance-broking system whose vendor still has not shipped a modern client. Test it in week one; you do not want to discover it in phase 2.

A practical test matrix:

Send the matrix to the vendor for each line-of-business application and get a written statement of support. "It works on our machine" is not a statement of support, and it will not help you when finance cannot raise a challan on the 1st.

A specific gotcha worth naming: hardware-accelerated GPU scheduling and Memory Integrity (HVCI) in Windows 11 can break older kernel-mode drivers. Some cheque-printing and banking-device drivers in use in Indian offices fall into this category. Test with Memory Integrity on, not off, because it will be on by default in a hardened environment.

The unglamorous items that decide the timeline

A few things bite in almost every migration.

ISP lead time. If you are adding branch bandwidth or a new link to support Windows Update traffic across a large fleet, the lead time for a new leased line or RBI-approved MPLS in Bengaluru is realistically four to six weeks from order to live, longer if the building needs new cabling from the riser. Schedule the upgrade in phase 0, not phase 3, or your download-heavy deployment will run on a congested 100 Mbps link and users will notice.

Power. An in-place upgrade is a vulnerable operation. A power cut at the wrong moment can corrupt the OS partition. Do overnight batches only in offices with UPS coverage on the endpoint circuits, or use laptops on battery. In older Bengaluru commercial buildings we have seen enough brownouts during monsoon storms to make this a real consideration, not a theoretical one.

Monsoon and cabling. If any part of the rollout involves re-cabling a floor — often necessary when you are also adding network ports or moving desks during a refresh — do not schedule exterior work in June to September. UTP run in wet conduit and terminated without proper sealing fails within a year, and it fails intermittently, which is the worst kind.

Activation and licensing. Windows 11 Pro upgrade from a Windows 10 Pro OEM licence is free and automatic via the digital licence. But a machine reinstalled from scratch with Windows 11 needs the OEM embedded key or a volume licence. If you are re-imaging, get your KMS or Active Directory-Based Activation right in the pilot, not after you have rebuilt 80 PCs.

GST and the capital goods angle. Replacements are capex. Laptops and desktops attract 18% GST and the credit is available if you are registered. If you are buying through a lease or an OPEX model, the treatment changes — work with your CA. Leasing 30 laptops over three years is a cash-flow tool that some SMBs use to pull the refresh forward without a lump-sum hit, and it is worth pricing against an outright purchase.

What this costs, in totals

For a 150-seat company with a 25% ineligible rate, a realistic 2026 budget for the full migration:

That is dominated by hardware. If the ineligible rate is 10% rather than 25%, the total drops to ₹9-13 lakh. If it is 40%, you are at ₹30-38 lakh. Which is why the audit is the first spend, not an afterthought — it decides whether this is a ₹10 lakh project or a ₹35 lakh project, and you want that number before you commit to a date.

If you are going to do this once, do it properly. Pair the rollout with an endpoint-management platform — Intune if you are on Microsoft 365, or a proper RMM if you are not — so that the next OS transition is a push, not a project. That is the difference between an IT team that runs the same fire every five years and one that has the plumbing to just turn the tap.

FAQ

How do I check if my laptop can run Windows 11? Run Microsoft's PC Health Check app on the machine, or use the PowerShell snippet above if you have a fleet. The two things that disqualify most business machines in India are an Intel 7th-generation or older CPU and a disabled TPM in BIOS. RAM below 4 GB or a 32 GB drive will also fail, but those are rarely the real blocker.

Is Windows 10 still safe to use in 2026? No, not on a corporate network. Windows 10 22H2 went out of support on 14 October 2025 and receives no further security patches without an ESU subscription. A machine on Windows 10 today is exposed to any vulnerability Microsoft patches going forward. If you must keep one for a line-of-business app, isolate it on its own VLAN and do not let it talk to anything it does not need to.

What does Windows 10 ESU cost in India? Commercial ESU through a Cloud Solution Provider runs roughly ₹3,000-₹6,000 per device for year one (2026 pricing), rising each subsequent year. It is available for up to three years. Treat it as a bridge for machines you are replacing within a year, not as a fleet-wide deferral strategy.

Can I install Windows 11 on an unsupported CPU? Technically yes, using a registry bypass that Microsoft has documented but does not support. Do not do this on a business fleet. You will not get feature updates reliably, you are unsupported if something breaks, and you have added risk to a machine that was already a liability. Replace it, repurpose it to a non-Windows role, or put a Cloud PC on it.

How long does a Windows 11 migration take for 100-200 computers? A 150-seat rollout with 25% replacement runs 16-20 weeks end to end, including audit, pilot, three rollout phases and decommission. The in-place upgrades themselves are quick — 60-90 minutes per machine — but the sequencing and the hard tail are what take the calendar time.

Will my Tally and ERP software work on Windows 11? In almost all cases yes. Tally Prime 4.x and 5.x, SAP GUI 7.7 and 8.0, and current versions of most ERP clients run on Windows 11 without changes. Check the driver layer for peripherals — cheque printers, label printers and older A4 scanners are the most common failure point — and check whether anything depends on Internet Explorer, which now requires IE Mode in Edge and is on a retirement clock.

Next step

Run the audit before you decide anything else. If you want the inventory done for you — a per-machine eligibility CSV with a recommended track for each one and a budget number you can take to your finance head — talk to us about it. Start with a conversation via our contact page or read about the end-computing service. The audit takes about a week on a 200-seat network, and it turns this from a scary project into a line in a spreadsheet.