Windows 10 End of Support: What Your Business Needs to Do
This article used to explain how to move from Windows 7 to Windows 10. The calendar has moved on twice since then. Windows 10 itself reached the end of support on October 14, 2025, and a year later a surprising number of business computers are still running it, some on paid extended updates and many on nothing at all. Here is where things stand in late 2026: what an unsupported Windows 10 machine can and cannot do, what Microsoft’s Extended Security Updates cost, which computers can move to Windows 11, and how to plan the change so it does not turn into a bad week.
What actually stopped in October 2025
Windows 10 did not stop working. It starts, runs your software and connects to the internet as before. What ended was the monthly security patch for Windows 10 Home, Pro, Enterprise and Education. Every month since, Microsoft has published fixes for Windows 11 that describe security holes, and attackers read those notes and look for Windows 10 machines that will never get the equivalent fix. A few things kept going on their own timelines:
- Microsoft 365 apps (Word, Excel, Outlook, Teams) receive security updates on Windows 10 until October 10, 2028, though Microsoft will not troubleshoot Windows 10-specific problems.
- Microsoft Defender antivirus definitions and the Edge browser continue to update for the time being.
- Windows 10 LTSC editions, used on some equipment and kiosk PCs, have their own dates: LTSC 2021 ends in January 2027, LTSC 2019 in January 2029 and IoT Enterprise LTSC 2021 in January 2032.
None of that changes the core problem. An operating system that no longer receives security fixes fails the basic control that HIPAA, PCI DSS, CMMC and every cyber-insurance application now check for. Our cyber insurance readiness check includes the exact question insurers ask.
Extended Security Updates: the bridge, and what it costs
Microsoft sells Extended Security Updates (ESU) for Windows 10 to businesses by the device, by the year, for up to three years. The first year, October 2025 to October 2026, costs $61 per device. The second year costs $122 and the third $244, and the programme ends in October 2028. The price is cumulative: a business enrolling in year two pays for year one as well. Two discounts matter. Organisations that manage updates through Microsoft Intune or Windows Autopatch pay 25 percent less, and Windows 10 machines that are used only to reach a Windows 365 Cloud PC or an Azure Virtual Desktop session get ESU at no cost.
The consumer programme is different and about to end. Home users could get one year of updates free by syncing settings to a Microsoft account, or for a one-time $30 fee, and that year finishes on October 13, 2026. It was never available for business licences, and after that date a personal Windows 10 laptop used for work is simply unpatched.
Our advice on ESU has not changed: it is a bridge for machines that cannot be replaced yet, priced to become more expensive than replacing them. Three years of ESU costs $427 per device before the discount, which is a large share of the price of a new business laptop.
Which computers can move to Windows 11
Windows 11 requires a TPM 2.0 security chip, UEFI with Secure Boot, at least 4 GB of memory and 64 GB of storage, and a supported processor: broadly an eighth-generation Intel Core or newer, a second-generation AMD Ryzen or newer, or a recent Qualcomm Snapdragon. In practice, most business computers bought since 2019 qualify and most bought before 2018 do not. Microsoft’s PC Health Check app gives a yes or no for one machine; under a managed IT plan the monitoring agent reports the answer for every computer at once, which is how we plan these projects. The upgrade itself is free for a licensed Windows 10 Pro or Home machine and keeps files and programs in place. Our earlier article on whether to upgrade to Windows 11 covers the compatibility testing in more detail.
Four options for every remaining Windows 10 computer
| Option | When it fits | What it costs |
|---|---|---|
| Upgrade in place to Windows 11 | The machine meets the requirements and is less than about five years old | Time to test software and run the upgrade; no licence fee |
| Replace the computer | It fails the requirements, or it is old enough that an upgrade buys only a year or two | A new business laptop or desktop; see our guide to business-class hardware |
| Enrol in ESU as a bridge | It cannot be replaced before a fixed date: a budget cycle, a vendor certification, a lease | $61 per device this year, rising each year, plus the cost of eventually replacing it anyway |
| Isolate or virtualise | It runs a machine, an instrument or a legacy application with no upgrade path | A separate network segment with no internet, or a Windows 365 Cloud PC in front of it |
For the replacement column, our article on business versus consumer laptops explains what to buy, and retired machines go through certified hardware recycling with the drives wiped or destroyed.
A plan that avoids a bad week
- Inventory. List every Windows 10 machine, who uses it, whether it qualifies for Windows 11, and what unusual software or hardware it depends on. This is a one-day job with management tools and a two-week job without them.
- Prioritise by exposure. Machines used for email, banking, remote access and administration go first. An isolated shop-floor PC goes last.
- Test the awkward software once. Upgrade one representative machine per role and run the line-of-business application, the label printer, the scanner and the VPN client. Fix what breaks before touching the rest.
- Set a standard build. Windows 11 Pro, current feature release, BitLocker on, the security agents installed, the same settings everywhere. Windows 11 feature releases are supported for 24 months on Pro, so the build needs a yearly refresh.
- Roll out in waves of a few machines a day, outside working hours, with someone available the next morning.
- Close the loop. Confirm nothing is left on Windows 10 without ESU, update the asset list, and tell your insurer the truthful answer at renewal.
What it means for compliance and insurance
Unsupported operating systems are a finding on every framework we help clients with. HIPAA expects supported and patched systems; PCI DSS requires security patches within a defined window that no longer exists for Windows 10; CMMC Level 1 asks for the same in plainer words. Cyber insurers have taken the shortest route: the application asks whether any end-of-life operating systems are in use, and a yes changes the premium or adds an exclusion for incidents that start on those machines. If a claim follows a breach through an unpatched Windows 10 computer, expect that answer to be checked.
How we handle this for clients
Under a managed plan the Windows 10 question was answered for every client computer before October 2025, and the stragglers were either replaced, enrolled in ESU with a replacement date or isolated. If you are not a client and are not sure where you stand, we will inventory your computers, tell you which ones qualify and give you a fixed price for the rest. The pricing calculator gives a monthly figure for keeping every computer patched and current from then on.
Free tools from OAC Technology
- Managed services pricing calculator: a monthly figure for managed IT, in about a minute
- Cyber insurance readiness check: fourteen questions insurers ask, scored in a minute
- IT glossary: the terms in this article, explained plainly
Common questions
Is Windows 10 still safe to use in 2026?
Not for a business, unless the machine is enrolled in Extended Security Updates. Since October 2025 Microsoft has not fixed security holes in Windows 10 for ordinary licences. Attackers scan for exactly those unpatched machines, and cyber insurers now ask whether any unsupported operating systems are in use.
How much do Extended Security Updates cost?
For businesses, $61 per device for the first year, doubling each year after that, for up to three years ending in October 2028. Joining late means paying for the years you skipped. Organisations that manage updates through Intune or Windows Autopatch get a discount, and Windows 10 machines used only to reach a Windows 365 Cloud PC or Azure Virtual Desktop get ESU at no charge.
Can we get Extended Security Updates for free?
Home users could, for one year, by backing up settings to a Microsoft account, and that consumer programme ends on October 13, 2026. It does not apply to business licences. A business can avoid the fee only by moving the desktop into the cloud, for example with Windows 365.
Which computers can be upgraded to Windows 11?
Ones with a TPM 2.0 chip, Secure Boot, at least 4 GB of memory and 64 GB of storage, and a supported processor: broadly an eighth-generation Intel Core or newer, a second-generation AMD Ryzen or newer, or a recent Snapdragon. Most business computers bought since 2019 qualify. Microsoft’s PC Health Check app gives a yes or no per machine.
Will Microsoft 365 and Office keep working on Windows 10?
The Microsoft 365 apps continue to get security updates on Windows 10 until October 2028, so they do not stop working, but Microsoft no longer supports problems that are specific to Windows 10. Office 2016 and 2019 lost support in October 2025 regardless of the operating system; see our guide to which Office versions are still supported.
What about a computer that runs a machine or instrument?
Isolate it. Put it on its own network segment with no internet access and no email, keep a backup image of it, and plan its replacement with the equipment vendor. That is the accepted approach for lab, shop-floor and medical devices that cannot be upgraded.
Talk to us
If you are not sure how many of your computers are still on Windows 10, or what enrolling them in Extended Security Updates would cost, we will tell you within a day, with a plan for each one. Call 952-548-5558 or contact us; the first conversation is free and there is no long-term contract.
