Latest / The Windows Podcast with Fexingo: Microsoft, PC, and Enterprise Windows Conversations / Why Windows 11 Is Slowing Down Older Enterprise Apps
Transcript
- Lucas: So there's this quiet problem that's been building inside enterprise IT for about a year now, and it finally surfaced in a way that's hard to ignore. Windows 11 is breaking older line of business applications that ran perfectly fine on Windows 10. Luna: I've heard muttering about this from IT friends, but I haven't seen a great concrete example. What's the specific case you're tracking? Lucas: A regional bank in Ohio — I'm not naming them because the story came from a systems integrator who works with them — had a core loan-origination application written in 2016. It's a.NET Framework 4.6 app, nothing exotic. After the Windows 11 24H2 feature update rolled out to their pilot group in March of this year, the app crashed on launch. Just a hard fault. Eight thousand loan applications stalled for two days while IT scrambled. Luna: Ouch. And this wasn't some obscure vertical app — loan origination is literally how a bank makes money. So what broke it? Lucas: Microsoft added a new kernel-level security check in 24H2 called 'arbitrary code guard' — it's an extension of the existing Vulnerable Driver Blocklist. The old app's installer had a custom DLL that injected a thread into a system process to check licensing. On Windows 10, that flew under the radar. Windows 11 flagged it as suspicious and terminated the process. Luna: So the security hardening that Microsoft markets as a feature is directly breaking production software. That's the tension, right? Lucas: Exactly. And the bank's IT team did what a lot of shops do — they tried to add the app to the compatibility shim database using Microsoft's Compatibility Administrator Toolkit. But the arbitrary code guard doesn't honor shims. It's a kernel-level enforcement, not a user-mode policy. Luna: So they had to go back to the vendor. And the vendor said what, exactly? Lucas: The vendor's response was: 'We have a cloud-native version of this app, but it's a separate license, and the migration will take six to nine months.' Meanwhile, the bank needs its loan system working tomorrow. So the IT director made a choice that's becoming very common in mid-2026: they rolled back the entire pilot group to Windows 10 22H2 and locked all future feature updates via group policy. Luna: Which is exactly what Microsoft has been trying to prevent with its mandatory hardware and update policies. But if the alternative is a crashed revenue-generating app, what's an IT team supposed to do? Lucas: Right. And this is where the economics get interesting. Microsoft offers something called 'App Assure' — it's a program where Microsoft engineers will help fix compatibility issues for free if you're a Microsoft 365 or Windows Enterprise customer. The bank actually called them. Microsoft's team showed up, analyzed the crash dump, and said the fix would require the vendor to recompile the app against.NET 8 and remove the thread-injection licensing check. Luna: So Microsoft's own free support program basically said 'this is a vendor problem.' That's not exactly a solution for the bank. Lucas: No. And the vendor has no incentive to recompile a six-year-old app for a customer that might migrate to the cloud version eventually. So the bank is stuck. They're now running a 'virtualized app compatibility' layer — essentially a Windows 10 VM on each Windows 11 machine, just to run that one loan-origination app. It adds about 15 seconds to the launch time and consumes an extra 2 gigs of RAM per instance. Luna: That's a tax. A real, measurable performance tax that shows up on every single loan officer's desktop. Across a bank with maybe 200 loan officers, that's 400 gigs of wasted RAM and three minutes of cumulative lost time every time they open the app. Lucas: Exactly. And this story isn't unique. I've heard similar cases from a manufacturing company in Michigan whose ERP client broke after 24H2, and from a health-care billing system in Florida. The common thread is that these are line of business apps written between 2014 and 2019, using.NET Framework 4.x, often with some driver-level integration or custom installer behavior. Luna: And Microsoft's position is that these apps should have been updated to use 'modern' APIs. But in the real world, enterprises don't rewrite working software on a vendor's schedule. Lucas: No, they don't. And that's the fundamental disconnect. Microsoft sees each security improvement as a justified hardening. The enterprise sees an update that broke something that was working, with no easy path back. Luna: There's also a licensing angle here, isn't there? Something about Windows 10 Extended Security Updates? Lucas: Yes. Windows 10 reached end of support in October 2025. But Microsoft offers paid Extended Security Updates — ESU — for three years. The cost scales up per device per year. So for that bank, staying on Windows 10 22H2 isn't free. They're paying roughly sixty-one dollars per device per year for ESU in year two. With two thousand devices, that's over a hundred twenty thousand dollars annually just to keep running the OS that actually works with their app. Luna: And that's not counting the virtualization RAM tax or the labor hours for the rollback and pilot reconfiguration. Suddenly Windows 11's 'free' upgrade costs real money. Lucas: It does. And I think this is going to become a bigger story as more feature updates roll out. Microsoft ships two per year — one in the spring, one in the fall. The 25H2 update is already being tested on the Insider channel, and I've seen reports of additional kernel hardening around how unsigned third-party services are loaded. Luna: So the trajectory is clear: more security, more breakage, more workarounds. The question is whether Microsoft will eventually offer a compatibility mode that relaxes some of these kernel protections for approved enterprise apps. Lucas: They haven't indicated that. In fact, the documentation for the arbitrary code guard says explicitly that no opt-out mechanism exists for enterprise customers. It's either update your app or find a workaround. Luna: That's a pretty strong stance for a company that still dominates the enterprise desktop. You'd think they'd want to keep IT administrators on their side. Lucas: A quick honest thing — a handful of listeners chip in monthly through buy me a coffee dot com slash fexingo, and that literally funds making shows like this one. No ads, no sponsors, just listeners who find the conversations useful. If this episode helped you understand what's happening with your own Windows 11 rollout, you might consider joining them. Totally optional, but it's what keeps us digging into these specifics. Luna: Yeah, and we don't take funding from vendors or PR firms, so we can actually say 'this is a problem' without softening it. That matters for a show like this. Lucas: It does. So back to the compatibility story — the other thing I want to highlight is how IT teams are responding. Many are now creating 'app compatibility testing' as a formal phase in their update rollout process, often taking three to four weeks per feature update. Luna: Which means the 'fast' update ring that Microsoft recommends for security fixes is essentially unusable for any organization with legacy apps. You're forced into the 'slow' or 'semi-annual' channel. Lucas: Right. And that delays security patches for all the other apps. There's a real trade-off: you can either get the March 2026 security update immediately or you can keep your loan-origination app working. Not both. Luna: I wonder if we'll see more enterprises moving those legacy apps to virtualized desktops — Windows 365 or Azure Virtual Desktop — where the underlying OS can be managed separately. Lucas: Some are. But that adds per-user licensing costs and network latency. For a loan officer, a 15-second app launch delay in a VM is worse than a 15-second delay on a local VM. And the desktop virtualization stack itself has compatibility issues — I've seen cases where the same app that crashes on Windows 11 local also crashes in a Windows 11 virtual desktop, because the kernel is the same. Luna: So the workaround is to run a Windows 10 virtual desktop. Which means you're still paying for ESU. The costs compound. Lucas: They do. And I think the smartest move for IT leaders right now is to do a full inventory of every line of business app that uses.NET Framework 4.x or has custom installer behaviors, and have a conversation with each vendor about their upgrade roadmap. If the vendor doesn't have one, that app is a ticking clock. Luna: What's your prediction? Will Microsoft eventually blink and offer an enterprise compatibility toggle? Lucas: I think they'll offer something, but it won't be a toggle — it'll be a paid add-on. Like 'Windows 11 Enterprise Compatibility Mode' as an extra SKU. They've already shown they're willing to monetize extended support. I wouldn't be surprised if in 2027, there's a 'Windows 11 Long-Term Compatibility' edition that costs an extra fifty dollars per device per year and includes relaxed kernel enforcement for certified apps. Luna: That would essentially be a tax on legacy. Which, from a business perspective, makes sense for Microsoft. But it puts IT managers in a difficult spot — they have to justify yet another per-device cost to their CFO. Lucas: Exactly. And the CFO will ask: 'Why are we paying extra to run an OS that breaks our apps, when Windows 10 worked for a decade?' That's a conversation no IT leader wants to have. Luna: So the takeaway for an IT pro listening today is: audit your legacy apps now, talk to your vendors now, and budget for either an upgrade project or a compatibility workaround before the next feature update hits your pilot group. Lucas: Yeah. Don't wait until a Tuesday morning when the loan system goes dark. That's a bad day.