The Quiet Licensing Drift Nobody Notices Until it Matters

As with previous blogs, working code and all relevant how-tos exist in this GitHub Repository! Clone, star, fork...whatever makes the most sense!

You ever get halfway through a conversation about endpoint security or device posture and realize you're just kind of assuming everyone's on Windows 11 Enterprise? Not because you checked, not because anyone validated it recently, just because that's how it's always been said out loud. It feels settled, like something that got figured out a long time ago, and until you actually go look, there's no real reason to question anything.

That's been happening more and more (it even happened to me recently and it's why I'm writing this post). It's not because people are careless...it's more so because the way Windows 11 Enterprise shows up in an environment has shifted just enough that the old model doesn't really apply anymore. Nothing broke, nothing forced a reset, but the path to "having Windows 11 Enterprise" wound up getting more conditional. That's exactly the kind of change which introduces quiet drift and let's assumptions run rampant inside enterprises.

Windows 11 Enterprise didn't go away...your path to the software may have disappeared

Microsoft didn't kill Windows 11 Enterprise, and if anything, it matters more now than it did a few years ago. It's still THE version you want if you care about security controls, consistent policy enforcement, and not having your endpoint strategy fall apart as you scale.

What changed is how you actually get there. Windows 11 Enterprise is no longer something you install once and forget about. It's now a state that sits on top of Pro and lights up through subscription activation when a few things line up correctly, which means licensing matters, identity matters, and management matters. If you've got Microsoft 365 E3 or E5 assigned and devices flowing through Microsoft Intune, you're probably pointed in the right direction...but "probably" isn't the same as verified.

That's where everything gets fuzzy. "We're on Windows 11 Enterprise" often translates to "we expect to be on Windows 11 Enterprise," and those two things can quietly grow apart when the underlying conditions aren’t consistently aligned.

Start simple: ask the device what it thinks it is

Before you touch a portal or start pulling reports, just check a machine. One machine! It sounds almost too simple, but this is still the fastest way to ground yourself in reality. See? The fundamentals STILL matter!

Open a Command Prompt and run:

winver

That output gives you a quick visual confirmation of the edition. If you want something you can capture or run remotely, uses this command:

systeminfo | findstr /B /C:"OS Name"

You're looking for output that explicitly says Windows 11 Enterprise. When or if it doesn't, that's usually the moment where assumptions start to unravel, because environments that believe they're standardized often have a mix of Enterprise and Pro sitting side by side.

There's also a nuance here that didn't used to matter as much. Windows 11 Enterprise isn't always a permanently fixed state. It can light up or fall back depending on user licensing, device join status, and management alignment. So even when/if you see it, it's worth understanding what's actually keeping it there.

Checking one device is easy...checking your environment is where this gets real

Looking at a single device is useful, but it doesn't answer the question you actually care about, which is what's happening across your environment as a whole. That's where you need something that can scale, and this is usually where reality starts showing up in ways people weren't expecting.

PowerShell: quick, flexible, and brutally honest

If you want a fast answer, PowerShell with Get-CimInstance is still one of the easiest ways to get said answer. The nice part is you don't have to pick one approach, because sometimes you already have a list of machines and sometimes you want to pull targets straight from Active Directory. This script supports both scenarios:

param(
    [Parameter(Mandatory = $true)]
    [ValidateSet("List","AD")]
    [string]$Mode,

    [string]$ComputerListPath = ".\computers.txt",

    [string]$ADNameFilter = "*",

    [string]$OutputPath = ".\Windows11EnterpriseAudit.csv"
)

function Get-TargetComputers {
    param(
        [string]$Mode,
        [string]$ComputerListPath,
        [string]$ADNameFilter
    )

    if ($Mode -eq "List") {
        if (-not (Test-Path $ComputerListPath)) {
            throw "Computer list file not found: $ComputerListPath"
        }

        return Get-Content $ComputerListPath | Where-Object { $_ -and $_.Trim() -ne "" }
    }

    if ($Mode -eq "AD") {
        Import-Module ActiveDirectory -ErrorAction Stop

        return Get-ADComputer -Filter "Name -like '$ADNameFilter' -and OperatingSystem -like ` '*Windows*'" `
            -Properties OperatingSystem |
            Select-Object -ExpandProperty Name
    }
}

$computers = Get-TargetComputers -Mode $Mode -ComputerListPath $ComputerListPath `
-ADNameFilter $ADNameFilter

$results = foreach ($computer in $computers) {
    try {
        $os = Get-CimInstance -ClassName Win32_OperatingSystem -ComputerName $computer `
-ErrorAction Stop

        [pscustomobject]@{
            ComputerName = $computer
            OSName       = $os.Caption
            Version      = $os.Version
            BuildNumber  = $os.BuildNumber
            SourceMode   = $Mode
            Reachable    = $true
        }
    }
    catch {
        [pscustomobject]@{
            ComputerName = $computer
            OSName       = "Unreachable or access denied"
            Version      = $null
            BuildNumber  = $null
            SourceMode   = $Mode
            Reachable    = $false
        }
    }
}

$results | Sort-Object ComputerName | Export-Csv $OutputPath -NoTypeInformation
$results | Format-Table -AutoSize

If you already have a list of machines:

.\Get-WindowsEditionAudit.ps1 -Mode List -ComputerListPath .\computers.txt

If you want to pull directly from Active Directory:

.\Get-WindowsEditionAudit.ps1 -Mode AD

And if you want to narrow it down to a VM naming convention:

.\Get-WindowsEditionAudit.ps1 -Mode AD -ADNameFilter "VM-*"

The output tells you exactly what each machine is reporting. No assumptions, no translation layer, just raw truth from the endpoints themselves.

Microsoft Intune: the clean, managed view

If you're already using Microsoft Intune, this is probably the easiest way to validate at scale without writing anything. Pull your Windows device inventory, look at the OS edition column, and you get a clear picture of how your fleet breaks down between Windows 11 Enterprise and everything else. What makes it valuable is that it reflects devices as they exist within your management plane, so you're seeing not just what they report locally but how they show up in the system that's supposed to be governing them.

Entra ID: validate the conditions behind the scenes

Microsoft Entra ID won't give you the cleanest "what edition is this device running" answer, but it's incredibly useful for understanding whether the conditions for Windows 11 Enterprise are even being met. When you look at join state, user association, and whether the device is managed, you're effectively validating the prerequisites that allow Enterprise to activate. When something doesn't look right on the endpoint, the explanation is often sitting right in front of your eyes.

ConfigMgr: still very good at this Task

If you're running Configuration Manager, this is one of the places it still shines. The OS hardware inventory includes the caption field, which tells you exactly what edition each device is reporting. If your inventory is healthy, you can build a very accurate view of where Windows 11 Enterprise is and isn't across your environment without doing anything complicated.

Why this matters more than it used to

There was a time when being a little fuzzy on your Windows edition didn't really change much. That's not the case anymore. Windows 11 Enterprise is tied directly into security posture, compliance expectations, and how you manage devices at scale. If you think you're on Enterprise and you're not, you may be missing controls you believe are in place (could lead to something like regulatory trouble during an audit). If you're licensed but not activating it properly, you're paying for capability that isn't actually showing up on the endpoint.

EOL has a way of forcing the truth out

With Windows 10 reaching end of support on October 14, 2025, a lot of organizations are being pushed into taking a fresh look at their device estate. That's usually when this kind of drift surfaces, because assumptions get replaced with actual data. Devices that were expected to be on Windows 11 Enterprise aren't. Licensing is tied to users who left. Activation paths were never fully completed. None of it is catastrophic on its own, but it paints a very different picture than what people thought was true.

The takeaway

This isn't about Microsoft making things harder. It's about Windows 11 Enterprise becoming something you have to verify instead of something you assume was handled at some point in the past.

Keep it simple for your first step: check a few devices, run the script, export your Intune inventory, and see what's actually there. That small amount of effort will tell you more about your environment than any assumption ever will, and once you see that clearly, you can actually do something about it for the future.