Form SCT-2026 · migration flight plan · filed 2026-07-30 · survey · 44 sources

Windows → Linux
Flight Plan

Almost the whole toolchain crosses over. Four things do not. This is the staged departure sequence — live USB, dual-boot, commit — with the go/no-go gates that decide whether the switch sticks.

registration

WIN‑11 / LNX‑26

crew · 1 · .NET / TS / docker

Departure

Windows 11 + WSL2 workstation

Destination

Native Linux desktop, 2026

Alternate

Windows partition, 80–120 GB, kept indefinitely

Route

LIVE-USB → DUAL-BOOT → COMMIT

Total EET

4–8 weeks of real work before commit

Cargo

Every app opened in the last 90 days, rated ✓ / ⚠ / ✗

Hazards en route

BitLocker · Fast Startup · undersized ESP · RTC skew · Secure Boot

Abort criteria

>2 h/week fighting the desktop instead of working

destination · Fedora KDE Plasma desktop edition swap, not a distro swap — the other legs of this route argue that out

Master caution

items that do not cross over

⚠ Master caution Four lamps stay lit no matter which distro you pick. Every one of them needs a named escape hatch before departure.

NO-GO · OFFICE

Desktop Office & VBA

There is no native Linux Office; the web apps are the only supported route, with no VBA, no add-ins, no offline, and degradation on large workbooks ^[3][4]

NO-GO · CALENDAR

Native Outlook calendar

Thunderbird 145+ speaks Exchange for mail only — calendar and contacts are roadmap, Graph is unimplemented ^[5]

NO-GO · DESIGNERS

WPF / WinForms designers

Rider edits XAML but ships no visual designers, and those apps only run on Windows anyway ^[6][17]

CAUTION · COMPLIANCE

Admin & compliance tooling

SQL Server Agent stays in Windows-only SSMS ^[1]; Belgian eID dies under any Snap or Flatpak browser ^[7]

Load manifest

rated by what happens when you try

Priority cargo first — the six pieces that carry the working day. Then the full manifest: what boards, and what gets left at the gate for the Windows partition.

IDE · replaces Visual Studio

JetBrains Rider

ASP.NET, libraries, tests, containers, .NET 10 / C# 14. Free non-commercially; a paid licence for work ^[16]

boards ✓

documents you author

OnlyOffice ⭐ 5.1k

OOXML is its native internal format, not an import filter — best .docx/.xlsx fidelity for files you trade with Windows colleagues ^[8][9]

boards ✓

the office-worker layer

Microsoft 365 for the web

The only officially supported route on Linux — and your primary mail client, since Outlook Web is the one thing that keeps working ^[3]

boards ⚠

mail · on a clock

Thunderbird

Native Exchange with OAuth2 ^[14] — but it rides EWS, which Microsoft starts blocking 1 Oct 2026 ^[15]

boards ⚠ expiring

corporate SSL VPN

GlobalProtect-openconnect ⭐ 2.2k

SSO, MFA, YubiKey on top of OpenConnect, which covers AnyConnect, GlobalProtect, FortiGate and F5 ^[24][25]

boards ⚠ reimplementation

desktop UI, going forward

Avalonia

New cross-platform work here; Avalonia XPF lifts an existing WPF app across — commercial, and a port rather than a recompile

boards ⚠

boarding Crosses over

drop-in, or with one caveat you will hit

SQL Server → Docker container

Supported on x86-64 Linux hosts and faster than Windows; emulation on ARM is untested and unsupported ^[2]

SSMS query & schema work → VS Code + MSSQL extension

Microsoft's own designated replacement: schema compare, schema designer, DACPAC/BACPAC, Query Profiler ^[1]

Multi-engine SQL client → DBeaver · DataGrip · Beekeeper Studio

All cross-platform, all fine ^[18]

IIS + inetmgr → Kestrel behind nginx/Caddy, or your existing Compose

The direction the platform moved anyway

Teams desktop → Teams PWA

Microsoft retired the Linux Electron client in Dec 2022 ^[11]; PWA install is Edge/Chrome only, not Firefox ^[12]

PowerShell 5.1 → PowerShell 7 native

Get-WmiObject is gone and the CIM cmdlets were never ported off Windows — anything WMI, registry, AD or COM stays behind ^[19]

Photoshop → Photopea · GIMP · Krita

Photopea has the best PSD fidelity of the free tools; fine for dev-adjacent work, not an agency workflow ^[20]

.odf, PDF, everything else → LibreOffice

OOXML is a conversion here, so complex styling and layout drift ^[8]

Belgian eID reader → official eid-mw + eid-viewer

Supported on Debian 12/13, Ubuntu 24.04/26.04 LTS, Mint, Fedora 43/44, RHEL 10, openSUSE Leap 16 — readers are CCID-class and need no vendor driver ^[26]

Banking → itsme + phone

Activate it while still on Windows; the card reader then becomes a fallback rather than a dependency ^[27]

Affinity suite → community AppImage or AffinityOnLinux ⭐ 1.7k

Canva made Affinity free and unified in 2025 but ships Windows/macOS only ^[21]; Linux is unofficial Wine-in-a-box ^[22][23]

left at the gate Stays on Windows

needs a named hatch, or a partition

Excel VBA macros & Power Query

LibreOffice's converter and Option VBASupport 1 are partial by design — anything touching the Excel object model, ActiveX or Application. fails, and OnlyOffice doesn't try (its macros are JavaScript) ^[10][8]. Power Query has no equivalent — move the ETL to Python or SQL

SQL Server Agent & classic administration

The real SQL gap. Microsoft deliberately keeps Agent in Windows-only SSMS. Job scheduling → RDP, VM, or T-SQL against msdb ^[1]

Azure Data Studio

Retired 28 February 2026 — no updates, no security fixes. Do not build on it ^[1]

.NET Framework 4.x projects

Don't build and don't run on Linux. Legacy Framework work = Windows VM

WPF / WinForms visual designers

EnableWindowsTargeting=true lets CI build them on Linux — it does not let you run or design them ^[17]

Outlook calendar & contacts

Nothing native. Outlook Web is the answer, not a workaround ^[5]

After Effects · Acrobat Pro forms & redaction

Premiere has a native answer in DaVinci Resolve; these two do not

Posture-checked vendor VPN clients

OpenConnect is a reimplementation — if the security team mandates the vendor client with posture checking, you lose ^[24]

eID in a sandboxed browser

Belgian landmine. Snap and Flatpak confinement blocks the PKCS#11 module, and Ubuntu's default Firefox is a Snap — so eID is broken out of the box until you install a native browser ^[7]

Practical rule

Documents you author → OnlyOffice. Documents with macros or Power Query that someone else owns → Windows VM or Cloud PC. Don't try to port a business-critical macro workbook; it is the single most common reason a switch reverses.

Fuel & load sheet

escape hatches, ranked by what they cost

Hatch	Good for	Cost / caveat	Weight
Web app	80% of the office layer — M365 web, Outlook Web, Photopea	Free, zero maintenance, no offline, no macros ^[4]	light
Wine / Bottles / CrossOver	Office 2016 and older, Affinity, small vendor utilities	Office 365 / 2021 / 2024 don't work reliably — click-to-run installers defeat Wine, and Outlook/OneDrive/OneNote are broken or absent ^[28]	medium
WinApps / WinBoat	Modern Office, Access, any single stubborn Windows app	Individual Windows windows appear on your Linux desktop over RemoteApp/RDP with MIME and menu integration — far higher compatibility than Wine, at the price of running a Windows VM ^[29]	heavy
Full VM under KVM	Visual Studio proper, SSMS, .NET Framework, posture-checked VPN	Best hypervisor on Linux: VirtIO, low overhead, real PCI passthrough. VirtualBox's 3D and passthrough are markedly weaker ^[30]	heavy
GPU passthrough (VFIO)	Near-native graphics inside the VM	Single-GPU passthrough takes your GPU away from the host — the Linux desktop goes dark until the VM shuts down, on top of fiddly IOMMU/vBIOS setup ^[31]	overweight
Windows 365 Cloud PC	The compliance or legacy app you touch monthly	Any HTML5 browser, no client needed ^[32]. Business runs ~$28–$56/user/month after the May 2026 cut; Enterprise starts near $31 and scales past $120 ^[33]	recurring
Keep a Windows partition	Everything above, at zero recurring cost	Windows 11 is fine. On Windows 10, support ended 14 Oct 2025; consumer ESU (settings sync, 1,000 Rewards points, or $30) runs until the programme closes 12 Oct 2027 ^[34]	disk only

Selected hatch

For this profile: dual-boot Windows for Visual Studio designers, SSMS Agent and macro workbooks — and don't bother with GPU passthrough.

Weight & balance

where the data is allowed to sit

⚠ Master warning — Dropbox constrains your filesystem layout

The Linux client tracks files through extended attributes and supports only unencrypted ext4 for the sync folder ^[41]. This is the sharpest constraint in the whole migration:

The Dropbox folder cannot live on NTFS, exFAT, btrfs or ZFS. If you were planning btrfs snapshots, keep at least one ext4 volume.
ext4 inside a LUKS container is fine — LUKS is block-level and invisible to Dropbox. ext4's own file-based encryption (fscrypt) is not ^[41].
It also needs an AppIndicator-capable tray — GNOME requires an extension ^[42].

NTFS — read your old data, don't live on it

The in-kernel ntfs3 driver has a track record of freezes and corruption; ntfs-3g is slower and safe ^[39].
Treat NTFS partitions as an archive to drain, then convert to ext4/btrfs once the data is verified elsewhere.

exFAT — the shared partition, with a catch

Native read-write kernel support, works from both OSes ^[40].
No POSIX permissions and no extended attributes — which is exactly why Dropbox can't use it.

Crew documents

carry these across in this order

SSH keys

Copy ~/.ssh, then chmod 700 ~/.ssh and chmod 600 ~/.ssh/id_*. Wrong permissions are the #1 "my key doesn't work".

GPG

gpg --export-secret-keys --armor on Windows, gpg --import on Linux, then gpg --edit-key <id> trust. Never copy private-keys-v1.d between versions.

Browser profiles

Sign in to sync rather than copying profile directories across OSes. On Ubuntu, install a non-Snap Firefox if you need eID ^[7].

Dotfiles

Put them in a git repo with a bootstrap script now — you will run it at least twice during a staged migration.

itsme, 2FA, password manager

Verify recovery on your phone before wiping anything ^[27].

Type-rating credit

what your WSL2 hours actually buy

WSL2 makes you competent at the Linux userland and leaves you a beginner at the Linux desktop. Budget the learning time accordingly: the surprises will be graphical, audio and power management — not shell.

✓ hours that count

bash, coreutils, apt/dnf muscle memory
Docker, Compose and CLI workflows — and they get faster: ~0.3s container start native vs ~1.2s on WSL2, container filesystem ops 3–5× quicker ^[43]
Shell scripting, ssh, git, editors
General comfort at the command line

✗ hours that don't

The desktop stack: X11 vs Wayland, compositor, portals, PipeWire audio, theming — WSL2 taught you none of it
Hardware: printers, Bluetooth, webcam, sleep/resume, fingerprint readers, monitor hotplug, GPU drivers
Networking: WSL2 defaults to NAT and is isolated from the host stack; native Linux gives you bridged/host networking and real interfaces ^[44]
USB/GPU passthrough, kernel modules, init-system and system-wide tinkering ^[43]

Departure sequence

four phases, two hard gates

WalkaroundInventory · still on Windows · zero risk

½ day

List every app you opened in the last 90 days and mark each ✓ / ⚠ / ✗ against the manifest above. Anything ✗ must have a named hatch from the load sheet before you go further.

Print the BitLocker recovery key — on paper, not on the machine
Activate itsme while a working Windows box is still in front of you
Push dotfiles to git with a bootstrap script
Export GPG secret keys; verify 2FA recovery on your phone
Decide where the Dropbox folder will live — it needs its own unencrypted ext4 volume

Diagram of the GNU GRUB bootloader components

what takes over the boot path in phase 02

Live USBHardware test · nothing written to disk

2 evenings

Boot the candidate distro from USB without installing. This tests hardware — the failure mode you cannot fix later by changing software.

Wi-Fi and Bluetooth work without hunting for firmware
External monitor at the right resolution and refresh; laptop scaling readable
Suspend and resume, twice — lid close, lid open
Audio out and mic in, plus headset switching
Teams PWA screen share picks up a window and a full screen ^[13]
Webcam in a browser call
Trackpad gestures and fn-keys — brightness, volume

phase 01 hardware · no partitions touched

Gate 1 · GOall seven must pass

Screen sharing is the recurring Linux-Teams failure: missing or misconfigured xdg-desktop-portal/PipeWire leaves the picker empty or crashes the browser, and the Wayland-vs-Xorg session choice changes the outcome ^[13]. Test it on day one, not week three.

Fail any item → change distro or kernel version and re-run Gate 1. Do not proceed to a partitioning phase on hardware that doesn't work from USB.

07a

NOTAMs

read before you touch a partition table

NOTAM A0135/26 · BITLOCKER

Recovery-key prompt on repartition

Windows 11 24H2 can auto-enable BitLocker even on Home. Repartitioning or a bootloader change trips a recovery-key prompt ^[35].

actionPrint the key. Suspend or disable BitLocker before touching partitions.

NOTAM A0136/26 · FAST STARTUP

Shared ESP damage on hibernate

Windows leaves NTFS hibernated and Linux refuses read-write mounts. Worse, hibernating one OS then booting the other can damage a shared EFI System Partition ^[36].

actionDisable Fast Startup. Never hibernate in a dual-boot setup.

NOTAM A0137/26 · ESP SIZE

100 MB ESP fills up

Windows ships a ~100 MB ESP; GRUB or systemd-boot plus a couple of kernels and initramfs images fill it ^[37].

actionTarget ≥ 260 MiB, 512 MB is comfortable. Reuse the existing ESP — never reformat it ^[36].

NOTAM A0138/26 · INSTALL ORDER

Windows overwrites the bootloader

Windows installers overwrite the bootloader and don't detect Linux; Linux installers detect Windows and chain-load it ^[36].

actionWindows first, Linux second. Always.

NOTAM A0139/26 · RTC SKEW

Clock jumps 1–2 h per reboot

Linux writes UTC to the hardware clock; Windows reads it as local time ^[38].

actiontimedatectl set-local-rtc 1, or set Windows to UTC. Fix it once or it erodes your patience daily.

NOTAM A0140/26 · SECURE BOOT

Unsigned third-party modules

NVIDIA and VirtualBox kernel modules need signing under Secure Boot ^[35].

actionEnroll a MOK key during install — or disable Secure Boot, accepting that it also disables BitLocker's TPM unseal.

Dual bootReal work on Linux · fully reversible

4 weeks

Shrink Windows from inside Windows (Disk Management), leaving ≥ 80 GB for Linux plus a separate /home. Suspend BitLocker, disable Fast Startup, reuse the ESP, install Linux second ^[36][35]. Fix the RTC immediately ^[38]. Put /home — or at minimum the Dropbox folder — on ext4 ^[41].

Then do real work on Linux, and log every reboot into Windows and why. That log is the instrument you read at Gate 2 — not your mood.

A GRUB boot menu offering both Ubuntu and Windows

phase 02 · GRUB chain-loads the alternate

Gate 2 · GO / NO-GOthe checkpoints that decide whether it sticks

Full .NET solution builds, tests run, and the debugger hits breakpoints in Rider
Docker and Coolify deploys work end to end
SQL Server container up, MSSQL extension connects, schema compare works ^[1][2]
Corporate VPN connects and survives a sleep cycle ^[24]
eID reads your card in a non-sandboxed browser and a real government or bank flow completes ^[26][7]
Dropbox reports "Up to date", not a filesystem warning ^[41]
You joined a Teams meeting, shared a screen and presented — twice
Printing and scanning work, if you need them
Windows reboot log ≤ 2 in the final week, every entry mapping to a known ✗ item

Fail any of the first six → fix or abandon; those are not things you learn to live with. Reboots > 2/week for reasons that aren't on your ✗ list → the switch is not ready.

CommitAfter Gate 2 · Windows stays, shrunk

ongoing

Don't wipe Windows. Shrink it to ~80–120 GB and keep it for Visual Studio designers, SSMS Agent, macro workbooks and any posture-checked VPN. Give Linux the rest.

Convert one reclaimed NTFS partition to ext4/btrfs once you've verified the data is elsewhere ^[39]
Booting Windows less than monthly after three months → convert it to a KVM guest and reclaim the disk ^[30]. A VM you can snapshot beats a partition you have to reboot into
Keep the reboot log running — it is your only honest signal about whether the alternate is still needed

phase 03 · reclaiming the disk

Abort · go-around

If at any point you're spending more than ~2 hours a week fighting the desktop rather than working, go back to Windows for the quarter and retry after the next LTS or kernel release. The migration is cheap to repeat and expensive to force.