Windows 10 Support Has Ended: ESU, Windows 11 Migration or New Hardware?

14 October 2025 was the long-announced date that still caught many businesses unprepared: free security updates for Windows 10 ended that day. The system keeps running — it boots, applications open, nothing looks "broken". That is precisely the danger: every vulnerability discovered from now on stays permanently open on unpatched Windows 10 machines. This article lays out the three realistic options for estates that still contain Windows 10, and the order in which to decide.

Why "It Still Works" Is Not Enough

An out-of-support operating system is like a car whose insurance has lapsed: no difference until the accident. Attackers know end-of-support dates as well as anyone, and the unpatched vulnerabilities accumulating on old systems are ransomware operators' favourite entry point. There is also a compliance dimension: running an OS that cannot receive updates on computers that process personal data is an increasingly difficult position to defend under data-protection rules on technical safeguards — and in regulated sectors it hardens into an audit finding.

Option 1: ESU — Buying Time

Microsoft's Extended Security Updates programme keeps delivering security updates rated Critical and Important to Windows 10 after end of support, on an annual subscription. For businesses it covers the Pro, Enterprise and Education editions, and the device must be on Windows 10, version 22H2. Licences are bought per device, one year at a time, and the price doubles every year — by design: ESU is not a destination, it is extra time purchased to finish the migration.

ESU year	Coverage period	List price per device
Year One	15 October 2025 – 13 October 2026	$61
Year Two	14 October 2026 – 12 October 2027	$122
Year Three (final)	13 October 2027 – 10 October 2028	$244

• No skipping years: Year Two and Year Three licences can only be bought together with the years before them. An organisation joining in Year Two pays $61 + $122 = $183 per device. Partial periods, such as six months, are not sold.
• How it is bought: through Volume Licensing or a Microsoft Cloud Solution Provider (CSP) partner, with a minimum of one licence. The activation key appears in the Microsoft 365 admin center, and each year's licence is activated on the device separately. The device needs a security update released on or after 14 October 2025 plus Microsoft's latest ESU Licensing Preparation Package (KB5126256 as of September 2026).
• What it provides: security updates only. No new features, no non-security fixes, no general technical support. Windows 10 LTSC releases sit outside the programme, on their own lifecycles.
• The cloud exception: Windows 10 virtual machines running in Windows 365 or Azure Virtual Desktop receive ESU at no additional cost.
• Who it fits: machines pinned to a legacy application, devices already scheduled for replacement within the year, estates that need a few more months to complete the migration.
• The trap: recording ESU as "problem solved". It is not solved; it is postponed, and the postponement gets pricier every year.

The $30 home ESU does not cover company PCs. Microsoft runs a separate programme for individuals: free if the PC's settings are synced, 1,000 Microsoft Rewards points, or a one-time $30 — one licence covers up to 10 devices, with updates through 12 October 2027. But Microsoft states plainly that the consumer programme cannot be used in commercial scenarios, and it is not offered at all on PCs joined to Active Directory or Microsoft Entra, or enrolled in mobile device management (MDM).

Dates and prices verified against Microsoft's official sources (Lifecycle FAQ, Windows 10 ESU programme) as of 13 September 2026. Microsoft can change the terms; check the current position before you buy.

Option 2: the Windows 11 Upgrade

Licence-wise the upgrade is free; the obstacle is hardware. Windows 11 requires the TPM 2.0 security chip and relatively recent processor generations. The practical rule: most business PCs bought in 2018 or later qualify, older ones mostly do not — but the basis is a scan, not a guess; compatibility is reported per device.

Even on compatible devices, migration is not "click update". The healthy sequence: verify each device's backup first, confirm Windows 11 support for the business applications in use (accounting, ERP, e-signature, sector tools), live with a pilot group for a week or two, then move the remaining estate in waves during off-hours. As device count grows, the waves need central tooling rather than hand-holding — this is where device-management and patch-management platforms earn their place.

Option 3: Hardware Refresh

For devices with no TPM, unsupported processors, or simply at the end of their economic life, forcing Windows 11 is the wrong investment; the right move is planned replacement. The decision looks beyond compatibility to the device's age, fault history and the user's role: the machine where accounting closes the books and the warehouse barcode station do not share the same urgency. Standardising new purchases on Windows 11 Pro with TPM enabled prevents a rerun of this same problem in five years.

The Decision Matrix

Device situation	Recommended path	Timing
Win11-compatible, recent device	Direct Windows 11 upgrade	Now, with pilot + waves
Compatible but critical software unverified	Application testing first, then upgrade	Within weeks
Incompatible, device under 5 years old	Protect with ESU, budget the replacement	Decide on Year Two before 14 October 2026; replace by October 2028 at the latest
Incompatible and ageing	Hardware refresh	First budget cycle
Machine locked to legacy software	ESU + network isolation + vendor migration plan	Until software support clarifies

The Forgotten Fronts

The machines most often missed in migration plans are the ones on nobody's desk: the meeting-room PC, the camera recording station, the shop-floor machine, the mini PC behind the till. They belong in the inventory — to an attacker, a desktop and a shop-floor PC are the same thing. And note that Windows 10 was not alone on that date: Office 2016 and 2019 fell out of support at the same time, and merging the two migrations into one project is usually the economical route.

Planning This Migration with Yamanlar Bilişim

Our first step is always the same: a full compatibility-and-age inventory of the estate — which device can upgrade, which needs ESU, which should be replaced, all visible in one table. Migration waves are scheduled off-hours, critical business software is verified in the pilot, and ESU licensing plus new-device procurement run through a single hand. For maintenance-agreement customers this inventory is already current — the decision meeting takes minutes, not hours, because the table is ready.

FAQ