Passkeys, Administrator Protection, AiTM-resistant MFA, the death of NTLMv1, and the end of VBScript. The 2024 Update has more going on underneath than the feature list suggests.
Windows 11 24H2, the 2024 Update, landed for consumer devices in October 2024 and began rolling out to business environments shortly after. The headline features are the kind of thing that fills Microsoft's marketing pages: improved Copilot integration, a redesigned Settings app, better Bluetooth LE Audio support. Fine. We don't cover that here.
What we do care about is what changed underneath. And there's more worth paying attention to than the patch notes make obvious: a fundamental redesign of how admin rights work, improvements to phishing-resistant authentication, the effective death of NTLMv1, and a significant deprecation that will catch out IT teams who haven't been paying attention. Here's the full picture.
24H2 significantly improves the Windows Hello passkey implementation. Passkeys stored in Windows Hello are now manageable in Settings > Accounts > Passkeys, you can see which services have registered a passkey, rename them, and delete individual ones without diving into credential manager.
If your users are signing into supported services (Google, GitHub, Dropbox, and a growing list of others), passkeys are now a first-class option rather than a buried feature. Why this matters for security: passkeys are phishing-resistant by design. A passkey is cryptographically bound to the specific domain it was created on. A perfect replica of a login page at a different domain won't accept it. This is exactly the defence that standard passwords and even standard TOTP codes lack against AiTM phishing.
This is the most significant security architecture change in 24H2, and it's currently available as a preview feature. Understanding it requires a brief explanation of how Windows admin accounts have always worked.
Traditional admin accounts maintain an elevated token at all times. When an admin logs in, they have full administrative privileges available continuously, the UAC prompt is the gate, but the token exists whether or not you're actively doing something that needs it. This means that if malware executes in that user's context, it has the same privileges the user does.
Administrator Protection works differently. Users run as standard users even when their account is technically an administrator. When admin rights are genuinely needed, a separate, isolated admin token is spun up, used, and immediately discarded. It's similar in concept to UAC but considerably more robust, the privileged token doesn't persist in a state where it can be hijacked.
To enable it: Group Policy at Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options > User Account Control: Configure type of Admin Approval Mode, or via Intune using a custom OMA-URI policy. It's still labelled Preview so test it before broad deployment, but this is the direction Windows is heading and it's worth getting familiar with.
Smart App Control (SAC) has been refined in 24H2. It now uses AI-powered reputation models from Microsoft's cloud to decide whether an application should be allowed to run. Known-good apps run without friction; unknown or suspicious ones are blocked or prompted.
For businesses evaluating SAC, Evaluation mode is the right starting point. In evaluation mode, SAC observes without blocking, it builds a picture of what would have been blocked in your environment before you commit to enforcement. Deploy SAC in evaluation on a handful of representative machines, run it for a few weeks alongside your normal workload, review what it flags, then make an informed decision about full enforcement.
Windows Security's Enhanced Phishing Protection previously warned you when you typed a password into a risky context, for instance, when you entered your Windows account password into a non-Microsoft site. 24H2 extends this to cover pasting passwords too, closing an obvious gap that anyone could exploit by prompting you to paste instead of type.
Coverage has also expanded beyond Microsoft accounts to a broader set of credential contexts. This isn't a complete defence, but it's a meaningful improvement for users who ignore every other warning, at least Windows will tell them something looks wrong at the moment of entry.
Yes, really. 24H2 introduces a sudo command for Windows, allowing you to run elevated commands from a non-elevated terminal session without opening a new admin window. Enable it at Settings > System > For Developers > Enable sudo.
For IT professionals managing systems day-to-day, this is a quality-of-life improvement. For security teams, it's worth knowing it exists and monitoring its use, sudo events should appear in your audit logs, and unexpected use of it on an endpoint you manage warrants investigation. It's not a vulnerability, but like any capability that makes privilege escalation easier, it's worth tracking.
Microsoft has been trying to kill NTLM authentication for years. 24H2 accelerates the deprecation of NTLMv1 specifically, with NTLMv2 also on the long-term deprecation path in favour of Kerberos and modern auth.
For most organisations running modern infrastructure, this changes nothing. But if you have legacy line-of-business applications, old printers, NAS devices, or on-premises services that rely on NTLM authentication, now is the time to audit this. You can identify NTLM authentication events in your environment with:
Get-EventLog -LogName Security -InstanceId 4776
Event ID 4776 is generated every time NTLM is used for credential validation. If you see a steady stream of these from unexpected sources, those sources need investigation and migration before NTLM is removed entirely.
VBScript is being staged for complete removal from Windows. In 24H2, it remains available but is disabled by default in the Windows optional features list. The full removal timeline runs through 2027, but the message is clear: if anything in your environment runs .vbs files (login scripts, automation, scheduled tasks, legacy application workflows), migration to PowerShell is not optional anymore, it's on the clock.
From a security perspective, this is unambiguously good news. VBScript has been abused for malware delivery for decades. Its removal closes a persistent attack surface. From an operations perspective, it means an IT audit is overdue if you haven't inventoried your legacy scripting dependencies.
Not a security issue, but worth flagging for any users who relied on it as a lightweight document viewer for .rtf or .doc files. Microsoft 365 or LibreOffice are the replacements. Operationally, it's a minor item, but it tends to generate tickets.
Our recommendation for most London SMBs: hold on the broad rollout until the first significant cumulative update to 24H2 is in place, this addresses early adoption bugs that inevitably surface in the first weeks after a feature update ships. Then deploy in a phased rollout, starting with a pilot group of five to ten machines, reviewing for two weeks, and then expanding. Windows Update for Business and Intune both support phased ring deployments natively.
Don't upgrade everything at once. Even a well-tested feature update can surface issues in edge cases you didn't anticipate. Staged rollout is the difference between "five laptops need a rollback" and "everything in the office stopped working on a Monday morning."
Need Windows updates handled properly across your fleet?
KAVIX manages Windows feature update deployment for all clients through tested, phased rollouts, so you get the security improvements without the Monday morning surprises. Contact us to find out how we handle it.
Talk to KAVIX →