Windows version upgrades
Approve a target Windows version, try it on test devices, and let Revo upgrade devices with Windows Update, the enablement package or Windows setup.
Updated
On this page
Patching keeps the Windows version a device runs secure. Moving devices to a newer version (say 24H2 to 25H2) is separate. With agent 0.6.0 or later, Revo does both, and tells you why a device won't move.
Upgrades follow the same rules as updates: patch management must be on for the customer, the workspace not paused, and they run in maintenance windows, ring by ring. Only Windows client editions are upgraded.
Choose the target version
- Open the patch policy (Patching → Policies, or the customer's Schedule & policy).
- Under Windows version, pick the version devices should run, from the versions Revo offers (currently Windows 11 24H2, 25H2 and 26H2).
- Save.
Saving approves the version, including Microsoft's licence terms for the upgrade; it's recorded under your name and date. Devices that are behind upgrade in their maintenance window, after that window's updates, ring by ring (a Broad ring with a 3-day delay starts 3 days after you approved it). Don't upgrade (the default) keeps devices on their current version.
How it upgrades
Revo tries, in order, the methods the policy allows, until one works:
| Method | What it is | Notes |
|---|---|---|
| 1. Windows Update | The device's own update source offers the new version | Works for any supported move |
| 2. Enablement package | A small download that switches on the new version on Windows 11 24H2 and later | One restart |
| 3. Windows setup | A full in-place upgrade from Microsoft's installation media | For Windows 10 and Windows 11 23H2, or when the others fail. Checks compatibility first, takes 1–2 hours, restarts several times. Skipped when restarts are set to never |
Methods that need a download are only used once Revo has published a verified download for that version. Revo offers Microsoft's enablement packages for 25H2 (KB5054156) and 26H2 (KB5121794); the agent checks each download's size, checksum and Microsoft signature before installing it. Windows setup media isn't offered yet, so a full upgrade (from Windows 10 or Windows 11 23H2) relies on Windows Update.
Check compatibility first in the policy runs Microsoft's compatibility appraisal before an upgrade. If Windows setup fails, Windows rolls the device back to its previous version by itself.
Test devices
Try a new version on one computer before approving it for everyone:
- Open the computer's Settings → Windows version.
- Turn on Test device, then choose the newer version (for example 26H2 while the policy stays on 25H2).
Only test devices can go beyond their policy's version. Owners and admins can also let a test device override Microsoft's safeguard holds, to see whether a problem Microsoft is holding the upgrade back for affects you. Hardware blocks are never overridden this way.
The same setting can also hold a device on its current version, or keep it on an earlier approved version.
Upgrade now
From a device (More → Upgrade Windows…, or Upgrade Windows now… on its Overview), the Devices list (select devices → Upgrade Windows…) or Windows versions (select devices → Upgrade Windows now…). Choose each device's approved version or a specific one, the restart behaviour and when. You confirm that people using the computers will be interrupted. Upgrading now counts as your approval.
Devices already on the version, held, or under a safeguard hold (unless they're test devices overriding it) are skipped with the reason.
Awaiting restart and verification
Once the upgrade is installed, the device shows Awaiting restart and verification until it restarts and confirms the new version, then On target (or Failed with the reason, if Windows rolled back). With restarts off, that's whenever someone next restarts it. Meanwhile the device takes no other installs, and pausing or cancelling doesn't undo the upgrade.
A device that reports it restarted but still runs the old version is marked failed ("didn't complete"), so a silent rollback never looks like success.
See where everyone is
Patching → Windows versions shows how many devices run the approved version and, for the rest, whether they're behind (waiting for a window or their ring), in progress, blocked or failed, with the reason. Expand a device for its readiness (TPM, Secure Boot, processor, memory, free disk, pending restart, Microsoft's compatibility verdict) and its last attempt. Readiness Windows couldn't report shows as unknown, never as ready. Filter by status or version and export CSV. Each device's Overview has the same in a Windows version block, and the patch compliance report has a Windows versions section.
The version pin
To upgrade, the agent sets Windows Update's own target-version policy on the device
(TargetReleaseVersion, ProductVersion and TargetReleaseVersionInfo under
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate). After a successful upgrade it leaves that pin in place,
so Windows doesn't move the device past the approved version by itself. Approving a newer version moves the pin.
Removing the policy's target, or uninstalling the agent, doesn't release it: to let Windows choose again, delete those
three values. If your own Group Policy or Intune manages them, it rewrites them at its next refresh.
Switch it off on a device
The device's local administrator can refuse upgrades with feature_upgrade = false in config.toml (installer switch
-DisableFeatureUpgrade). See Local controls.