Windows 10 End of Support: What SMBs Must Do Now

Updated September 26, 2026.

Windows 10 Extended Security Updates (ESU) Year 1 ends October 13, 2026 — just over two weeks out as of this update. If you're still running Windows 10 machines on ESU, you have to decide: renew at double the price, finish the migration, or run unpatched.

Doing nothing picks the last one for you. Here's the schedule, the arithmetic, and the one entitlement that gets some businesses ESU for free.

ESU pricing and the three-year schedule

Year 1 coverage ends October 13, 2026, at $61 USD per device. Windows 10 itself hit end of support on October 14, 2025, and Microsoft sells ESU for three years past that date — no longer.

Microsoft's terms say the price "doubles every consecutive year," which makes the schedule this:

One detail catches people out. ESU is cumulative — Microsoft's documentation is explicit: "If you decide to purchase the program in Year Two, you have to pay for Year One too, as ESUs are cumulative."

So sitting this year out doesn't save you $61. Come back next October and you owe $183 per device to get covered, not $122.

Only Enterprise, Education, and Pro editions in commercial use qualify for the business program. Windows 10 Home doesn't, and the consumer enrollment route you may have read about doesn't cover commercial devices.

How you actually buy it, and by when

Microsoft sells commercial ESU through the Volume Licensing Program. Order it through whoever handles your Microsoft licensing — for most small businesses that's their managed IT provider or licensing partner — then activate the keys against the machines you're covering.

Build in lead time. Procurement, key delivery, and deployment across a fleet aren't a same-day exercise, and you have about two weeks left.

Miss October 13 and you don't lose the option — you lose the coverage. The machines sit unpatched until you enroll, and you still owe Year 1 when you do.

What ESU actually buys, and what it doesn't

Security patches. That's the whole list.

No features, no bug fixes, no technical support, and no help when a driver or line-of-business app starts misbehaving on an OS Microsoft has stopped developing. Set the per-device price against what a replacement machine costs you over the same period — a new device arrives supported for years rather than months, and the ESU line item disappears from next year's budget.

ESU earns its place in one situation: a machine chained to an application that won't run on Windows 11 yet. Bridge that machine. Don't bridge a fleet.

The free option most SMBs miss

If you already pay for Windows 365, your Windows 10 endpoints are covered. Microsoft states that "Windows 10 endpoints connecting to Windows 365 Cloud PCs will be entitled to the ESU for up to three years, with an active Windows 365 subscription license."

The same goes for Windows 10 virtual machines running in Windows 365, Azure Virtual Desktop, and Azure VMs — ESU is included at no additional cost. Worth checking before you cut a purchase order, especially if a cloud migration was already on your roadmap.

Unpatched machines keep working — that's the problem

The computers boot fine. What stops is the patching.

New vulnerabilities get found, published, and weaponized, and an unpatched machine never receives the fix. The risk compounds every month, quietly, until an automated scan finds you.

That's the asymmetry: on a supported machine an exploit has a shelf life, because the patch closes it. On an end-of-life machine it doesn't. What works today still works in 2028.

Compliance and insurance follow from the same fact. Most cyber insurance applications and audit frameworks ask you to attest that systems are patched and supported — and once a dozen machines can't receive a patch at all, there's no honest way to answer yes.

Your options for on-premises devices

Three paths, decided per machine rather than per company.

1. Upgrade in place to Windows 11

Free where the hardware qualifies. Windows 11 has firm hardware requirements — TPM 2.0 and a compatible 64-bit processor among them — so part of an older fleet won't pass.

For machines that do: schedule it, run it, verify the apps, move on. Land them on version 25H2, not 24H2: Windows 11 24H2 Home and Pro stop receiving security updates on October 13, 2026, the same day Year 1 ESU coverage ends.

Our Windows 10 to 11 upgrade checklist walks through each step, from the hardware check to the rollback window.

2. Replace the hardware

Machines that fail the TPM 2.0 or CPU check can't be made eligible — the requirement is silicon, not software. Replacement is the only route to a supported OS on that desk.

Stagger the purchases by role priority so the cash lands over quarters rather than weeks. Our IT procurement team can phase it against your budget year.

3. Buy another year of ESU

A bridge, not a plan. Every machine you put on ESU should leave the meeting with a retirement date written next to it, because the price doubles again in October 2027 and the program ends in 2028.

The sequence that keeps this painless

1. Inventory. Every Windows 10 machine, its Windows 11 eligibility, and what it runs. That list is the whole planning problem.
2. Triage. Sort machines into three buckets: eligible to upgrade now, scheduled for replacement with a date attached, and ESU only where an application forces it.
3. Check your entitlements. Any Windows 365 or Azure Virtual Desktop licensing you already pay for may cover devices you were about to buy ESU for.
4. Verify apps against Windows 11 before each wave. The occasional legacy application is the real blocker, and it's better found in testing than on a Monday morning.
5. Decide before October 13. If you're renewing ESU, the purchase has to be done, not discussed.
6. Recycle securely. Retired drives get wiped or destroyed, and documented.

If a Windows Server 2016 box is on your books too, plan both together — that deadline lands in January 2027.

Two weeks is enough time to inventory and decide, and enough to get a purchase order through. It isn't enough to migrate a fleet. Book a complimentary engineer call and we'll do the inventory with you.

Frequently asked questions

When does Windows 10 Extended Security Updates end?

Year 1 coverage ends October 13, 2026. Year 2 ends October 12, 2027, and Year 3 ends October 10, 2028, which is the end of the program. Microsoft caps ESU at three years past the October 14, 2025 end-of-support date, so 2028 is the last year patches are available at any price.

How do I buy Windows 10 ESU for a business?

Microsoft sells commercial ESU through the Volume Licensing Program, at $61 per device for Year 1. Order it through whoever handles your Microsoft licensing, then activate the keys against the covered machines. Leave lead time for procurement, key delivery, and deployment. Missing October 13 doesn't close the door, but the machines go unpatched until you enroll.

Can I buy ESU Year 2 without having bought Year 1?

You can enroll, but you pay for both. Microsoft's documentation states ESUs are cumulative, so enrolling in Year 2 means paying for Year 1 as well — $183 per device rather than $122. The back-paid Year 1 buys nothing retroactively either: the machine was unpatched for every month it went uncovered, and those months don't get their updates back.

Is Windows 10 ESU free with Windows 365 or Azure Virtual Desktop?

Yes. Microsoft includes ESU at no additional cost for Windows 10 virtual machines in Windows 365, Azure Virtual Desktop, and Azure VMs. Windows 10 endpoints connecting to a Windows 365 Cloud PC are also entitled for up to three years with an active Windows 365 subscription license. Check this before purchasing.

Which PCs can upgrade to Windows 11 for free?

Any machine meeting Microsoft's hardware requirements, which include TPM 2.0, a compatible 64-bit processor, 4 GB of memory, and UEFI with Secure Boot. The upgrade itself costs nothing. Machines that fail those checks can't be made eligible in software, which is why the inventory comes first.

Sources and further reading

• Microsoft — Windows 10 Extended Security Updates — commercial pricing, the cumulative-purchase rule, and the Windows 365 and Azure entitlements. Accessed September 2026.
• Microsoft Lifecycle — Extended Security Updates FAQ — the Year 1, 2, and 3 coverage end dates. Accessed September 2026.
• Microsoft — Windows 11 requirements — the hardware checks an upgrade has to pass. Accessed September 2026.

By Joe Laboy, who leads systems, networking, and managed IT operations at The NetSys Group. NetSys has delivered managed IT, cybersecurity, and cloud services since 1998 to businesses across NY, NJ, CT, PA, and Southwest Florida.