v1.1.0 - Windows 11 26H2 support (KB5121794)

This release adds the Windows 11 26H2 upgrade path to the repository. Windows 11 24H2, 25H2 and 26H2 share one core operating system, so 26H2 is enabled by a second, small enablement package: KB5121794 (~174 KB, one restart). Hosts on 24H2 can go straight to 26H2. The existing 25H2 scripts (KB5054156) are unchanged.

New files

File	Purpose
Upgrade-Win11-To-26H2.ps1	full implementation: gates, BITS/HTTP download, SHA-1 + Authenticode verification, transcript logging, reboot policy, -WhatIf
Upgrade-Win11-To-26H2.bat	reduced cmd.exe alternative: same gates, curl-then-PowerShell fallback inside each attempt, certutil SHA-1 check, /whatif
tests\Upgrade-26H2.Tests.ps1	unit tests for the decision functions
tests\Preflight.Paths.Tests.ps1	fixture runs of the observable paths; they force the branch and assert that no download or install happens
.gitattributes	keeps batch files CRLF on checkout (they need it for labels and goto)

Gates

Gate	Rule
Version	24H2 build 26100.9546+ or 25H2 build 26200.9550+ (KB5124010 or later)
Edition	Home, Pro, Enterprise, Education, Enterprise multi-session, IoT Enterprise — not LTSC, not Windows Server
Architecture	AMD64 or ARM64; ARM is matched first, so ARM 64-bit Processor is not mistaken for x64
Target	any 26300.x is 26H2; build 28000+ (26H1) is refused as a separate branch
Package	pinned Microsoft delivery-CDN URL; SHA-1 from the file name + Microsoft Authenticode signature; 100,000-byte sanity floor

Package verification

Both architecture packages were downloaded and verified on 2026-10-25: the SHA-1 matches the fingerprint published in the file name and the Authenticode signer is Microsoft Corporation.

Architecture	Size (bytes)	SHA-1
x64 (AMD64)	177,535	5e20a3cce48d6611b16bdec42b07167f5456586a
ARM64	178,969	77a76caf2d362bb293a4d18058388f2717365abe

x64:   https://catalog.sf.dl.delivery.mp.microsoft.com/filestreamingservice/files/94520a88-858f-4832-a57d-7211f6d84a4e/public/Windows11.0-KB5121794-x64_5e20a3cce48d6611b16bdec42b07167f5456586a.msu
ARM64: https://catalog.sf.dl.delivery.mp.microsoft.com/filestreamingservice/files/9d8dc3d0-9cbf-4eb1-9411-722e3e6a19b3/public/Windows11.0-KB5121794-arm64_77a76caf2d362bb293a4d18058388f2717365abe.msu

The package is delivered through Windows Update and WSUS (product "Windows 11", classification "Upgrades") and is not offered in the Microsoft Update Catalog, which is why the URLs are pinned. If they ever stop working, use -PackagePath with a stored, verified copy.

Tests

Invoke-Pester -Path .\tests -Output Detailed

57 Pester tests pass. The fixture cases force their branch inside a copy of the script (target build 1, raised minimum, 26H1 override, faked edition) and assert the absence of download/install markers, so the suite is safe on any Windows host. Windows-only; PowerShell 7 + Pester 5.1 or later.

Upgrade notes

• Exit code 0 means the package was accepted and staged (or there was nothing to do). The build does not change until the restart: verify CurrentBuild = 26300 and DisplayVersion = 26H2 afterwards before recording a host as upgraded. 3010 is folded into 0.
• -WhatIf writes nothing at all and refuses instead of prompting when the architecture is unknown; pass -Architecture in that case.
• -PackagePath requires a file name containing KB5121794 with the matching architecture token; SHA-1 is skipped for local files, Authenticode is still checked.
• No rollback or uninstall. The script was executed only on PowerShell 7.6.6 (the Windows PowerShell 5.1 parser accepts it), and the install path was not executed during development — the decision paths, the download/verification chain and both package files were tested.

Verification status of this release

Item	Status
25H2 scripts	unchanged
26H2 decision paths (gates, refusals, -WhatIf)	tested via fixtures on any-host-safe harness
Download + SHA-1 + Authenticode of both packages	tested against Microsoft's CDN
Install path (wusa.exe)	not executed during development
Pester suite	57/57 passing