The main idea is that you should replace all authentication certificates with new OID till November 14. Don't understand why April 11 is mentioned as deadline. April 11 affects only certificates which predates accounts, which should be very rare case. Of course it is better not wait for November 14 and migrate to full enforcement as fast as possible, but real deadline is November 14.
The fallout of the Absuing Active Directory Certificate Services whitepaper still continues to amaze.
The main idea is that you should replace all authentication certificates with new OID till November 14. Don't understand why April 11 is mentioned as deadline. April 11 affects only certificates which predates accounts, which should be very rare case. Of course it is better not wait for November 14 and migrate to full enforcement as fast as possible, but real deadline is November 14.