Fix Windows 11 25H2 Not Installing from Intune Feature Update Policy

If you targeted Windows 11 25H2 from Intune > Devices > Windows > Windows updates > Feature updates and the device never moves past Offering, never downloads, or never starts setup, do not treat it like a random Windows Update glitch.

Microsoft’s current documentation points to a short list of checks that matter more than generic reset scripts:

• feature update policy prerequisites
• Windows 11 eligibility
• safeguard holds
• telemetry and reporting requirements
• wlidsvc health
• Windows Update endpoint reachability
• whether the device is coming from Windows 11 24H2 or from Windows 10

That last point matters because Windows 11 24H2 devices move to 25H2 by enablement package. Microsoft says most 25H2 files already exist on recent 24H2 systems, and the upgrade is activated by a small switch package. If the device is missing the required monthly servicing baseline, or if Windows Update never offers the enablement package, the install usually looks stuck rather than obviously broken.

Quick Fix Checklist

Use this list before you delete and recreate the policy:

• Confirm the policy targets Windows 11, version 25H2 and is set to Required if you expect automatic install.
• Confirm the device is still on a supported path: Windows 11 24H2 or an eligible Windows 10 build.
• If the device is already on a newer build, remember that feature update policies do not downgrade.
• Check whether the device is under a safeguard hold.
• Verify the device can reach required Windows Update and Intune endpoints.
• Confirm Telemetry is enabled at least at Required.
• Confirm Microsoft Account Sign-In Assistant (wlidsvc) is running.
• Check for conflicting TargetReleaseVersion or legacy update GPO settings on hybrid devices.
• Review the Intune Feature updates report and the device’s Windows Update event logs.
• If the device is already on 24H2, verify it has recent monthly updates so 25H2 can be offered as an enablement package.

What usually causes this

1. The device is not actually eligible for the 25H2 offer

Microsoft states that feature update policies only offer updates that are applicable to the targeted device. Devices that do not meet Windows 11 requirements will not install a Windows 11 feature update.

This is common when admins target mixed Windows 10 and Windows 11 groups and assume Intune will brute-force the offer. It does not.

For Windows 10 devices, check:

• TPM and Secure Boot readiness
• supported CPU generation
• edition support
• current enrollment state in Intune
• whether Endpoint Analytics shows Windows 11 readiness blockers

2. The device is blocked by a safeguard hold

Microsoft explicitly says devices will not install a targeted feature update when that version is blocked by a safeguard hold. In the field, this often looks like Intune did its job, the assignment is correct, but the device never proceeds.

Do not bypass this assumption too quickly. Safeguard holds usually exist because Microsoft already knows the hardware, driver, or app combination is risky.

3. The 24H2 to 25H2 enablement path is not ready

Microsoft’s 25H2 IT pro guidance says devices updating from Windows 11 24H2 use an enablement package. That means:

• the machine should already be on 24H2
• it should have a recent monthly security update installed
• Windows Update still has to offer the enablement package successfully

If the device is stale on servicing, blocked from update endpoints, or missing the required monthly baseline, 25H2 may never show up as expected.

4. Prerequisites for Intune feature update reporting are broken

Microsoft lists these feature update prerequisites for managed devices:

• device is Intune managed
• device is Microsoft Entra joined or Microsoft Entra hybrid joined
• Telemetry is enabled at a minimum level of Required
• Microsoft Account Sign-In Assistant service (wlidsvc) is enabled and running

If wlidsvc is disabled or telemetry is locked down too hard, the rollout often becomes harder to verify and can fail to progress cleanly.

5. Legacy policy conflict is preventing the offer

Hybrid fleets still get burned by old Windows Update for Business GPOs, registry-based TargetReleaseVersion controls, WSUS settings, or old ring behavior. Microsoft also notes that Windows Update client behavior is still influenced by standard Windows Update policy settings such as update rings.

So if your Intune feature update policy looks right but the endpoint is pinned elsewhere, the Intune report can say one thing while the device obeys another.

What to check in Intune first

Start in the admin center before touching the endpoint:

1. Go to Devices > Windows > Windows updates > Feature updates.
2. Open the Windows 11 25H2 deployment.
3. Review Assignments and confirm the device is really in scope.
4. Confirm the update was configured as Required if you expected automatic installation.
5. Review rollout timing so the device is not still waiting for its offer window.
6. Open the device status and note whether the device is Offering, Pending, Failed, or simply missing.

If the deployment uses gradual rollout, also confirm the device has already reached its offer group date.

Logs and Where to Check

Intune and reporting views

Check these first:

Location	What to look for
Intune admin center > Devices > Windows > Windows updates > Feature updates	Policy assignment, rollout timing, device state
Windows Update for Business reports	Devices with feature update alerts, stalled offers, or compliance issues
Endpoint Analytics / Windows readiness views	Hardware blockers for Windows 11 on Windows 10 devices
Windows 11 25H2 release health	Known issues and safeguard-hold context

On the affected endpoint

Review these event logs:

$logs = @(
  'Microsoft-Windows-WindowsUpdateClient/Operational',
  'Microsoft-Windows-UpdateOrchestrator/Operational',
  'Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin'
)

foreach ($log in $logs) {
  Write-Host "`n=== $log ==="
  Get-WinEvent -LogName $log -MaxEvents 200 |
    Where-Object {
      $_.LevelDisplayName -in @('Error','Warning') -or
      $_.Message -match '25H2|feature update|safeguard|offer|target release|Windows Update'
    } |
    Select-Object -First 30 TimeCreated, Id, LevelDisplayName, Message
}

Also check local Windows Update state:

Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings' -ErrorAction SilentlyContinue
Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate' -ErrorAction SilentlyContinue

That second key is where old policy controls often show up on hybrid or previously domain-managed devices.

PowerShell Triage Commands

Run the following on one affected device before changing policy assignments:

Write-Host '=== OS version ==='
Get-ComputerInfo | Select-Object WindowsProductName, WindowsVersion, OsBuildNumber

Write-Host '=== Intune prerequisites ==='
Get-Service wlidsvc | Select-Object Name, Status, StartType

Write-Host '=== Telemetry policy ==='
Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection' -ErrorAction SilentlyContinue |
  Select-Object AllowTelemetry, MaxTelemetryAllowed

Write-Host '=== Legacy Windows Update policy ==='
Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate' -ErrorAction SilentlyContinue |
  Select-Object TargetReleaseVersion, TargetReleaseVersionInfo, ProductVersion, WUServer, WuStatusServer

Write-Host '=== Quick network test ==='
$targets = @(
  'login.live.com',
  'windowsupdate.microsoft.com',
  'dl.delivery.mp.microsoft.com'
)
foreach ($target in $targets) {
  Test-NetConnection $target -Port 443 | Select-Object ComputerName, RemotePort, TcpTestSucceeded
}

What you want to see:

• wlidsvc is Running
• telemetry is not disabled below Microsoft’s minimum requirement
• no stale TargetReleaseVersionInfo pins the device to another release
• no WUServer value is forcing a legacy WSUS path when the device should use Windows Update for Business
• required HTTPS endpoints are reachable

24H2 versus Windows 10: use the right branch of the workflow

If the device is already on Windows 11 24H2

Treat 25H2 as an enablement-package troubleshooting case.

1. Confirm the device is really on 24H2.
2. Install current monthly quality updates first.
3. Recheck Windows Update scan results.
4. Review release health for open safeguard holds.
5. Retry the offer.

Useful commands:

Get-ComputerInfo | Select-Object WindowsVersion, OsBuildNumber
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10 HotFixID, InstalledOn
UsoClient StartScan

If the device is still on Windows 10

Treat it as a Windows 11 eligibility and policy targeting case.

1. Confirm Windows 11 hardware readiness.
2. Make sure the feature update policy really targets 25H2.
3. If the device is not eligible for Windows 11, remove it from the Windows 11 deployment or use the policy option that keeps non-capable devices on the latest Windows 10 release.
4. Check for old GPO or registry controls that pin the machine to a Windows 10 target release.

Remediation workflow

Step 1: Fix obvious prerequisite failures

If wlidsvc is stopped or disabled:

Set-Service wlidsvc -StartupType Manual
Start-Service wlidsvc

If telemetry is blocked below the required level, correct the policy in Intune or local policy and let the device sync.

Step 2: Remove conflicting legacy targeting

If the device is obeying old target release values or WSUS settings, remove the conflict from the source policy. Do not just delete registry keys without fixing the management source.

For immediate local validation on a test device only:

Remove-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate' -Name TargetReleaseVersion -ErrorAction SilentlyContinue
Remove-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate' -Name TargetReleaseVersionInfo -ErrorAction SilentlyContinue
Remove-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate' -Name ProductVersion -ErrorAction SilentlyContinue

Then sync policy from the real management plane and retest.

Step 3: Refresh the offer path

After fixing prerequisites or conflicts:

UsoClient StartScan
Start-Sleep -Seconds 15
UsoClient StartDownload

UsoClient is quiet. Verify success from the event logs and Intune reporting instead of waiting for console output.

Step 4: Recreate the Intune deployment only if needed

Recreating the policy should be late in the workflow, not the first move. If you do recreate it:

• choose Windows 11, version 25H2 explicitly
• verify Required versus Optional behavior
• verify rollout dates
• confirm the correct device group
• avoid mixing pilot and broad production targets in one noisy assignment

Prevention

• Keep Windows 11 pilot devices current on monthly servicing so 24H2 devices are ready for the 25H2 enablement package.
• Track release health and open safeguard holds before you declare the deployment broken.
• Standardize on one update authority. Hybrid fleets with leftover WSUS or GPO settings create the worst false positives.
• Keep Telemetry at the Microsoft-supported minimum for feature update reporting.
• Monitor wlidsvc in your baseline because feature update workflows depend on it more often than admins expect.
• Use smaller rollout groups so you can spot one hardware family or network segment that is blocking the 25H2 offer.

Sources

• Microsoft Learn: Configure Windows Feature Update Policies - Microsoft Intune
• Microsoft Learn: Manage Windows Feature Updates - Microsoft Intune
• Microsoft Learn: Configure Rollout Options for Feature Update Policies - Microsoft Intune
• Microsoft Learn: Upgrade Devices to Windows 11 Using Feature Updates - Microsoft Intune
• Microsoft Learn: What’s new in Windows 11, version 25H2 for IT pros
• Microsoft Learn: Windows 11, version 25H2 known issues and notifications
• Microsoft Learn: Windows Update for Business reports overview