Windows 10 End of Life (EOL): Extended Security Updates Year 2, Costs and Your Options

A year after Windows 10 reached end of support, plenty of business PCs are still running it. Some are covered by paid Extended Security Updates. Some are not covered at all, and their owners may not know it. October 2026 added a second decision: year 2 of those updates costs twice as much as year 1.

This guide covers what end of life means for a business today, what ESU year 2 costs and how it works, what actually keeps PCs on Windows 10, and how to move each machine to Windows 11, new hardware, a cloud PC or a deliberate ESU bridge. It draws on what we see in the field as a managed IT provider in New Jersey and South Florida, including the devices that most often break a Windows 11 upgrade.

No. Microsoft ended support for Windows 10 Home, Pro, Enterprise and Education on October 14, 2025. A business PC on Windows 10 now receives Windows security updates only if it is enrolled in Extended Security Updates, which run in yearly terms until October 10, 2028.

Nothing switched off. A Windows 10 PC boots, opens email and runs its applications today exactly as it did a year ago. What stopped is the patching. Every vulnerability found since October 2025 stays open on an unenrolled PC for good, and attackers look for exactly that kind of machine.

Windows 10 key dates

Windows 10 end of life is really a set of dates, not one. These are the ones that matter for a business:

The dates come from Microsoft Partner Center’s ESU guidance, Microsoft 365 Apps on Windows 10, Microsoft Edge supported operating systems, products ending support in 2026 and the Windows 10 Enterprise LTSC 2021 lifecycle. Edge and Microsoft 365 Apps updates patch those apps, not Windows itself.

Three details catch businesses out:

• The consumer program is off limits. Microsoft’s consumer ESU page states that it “can’t be used in commercial scenarios,” and enrollment is blocked on PCs joined to an Active Directory domain, joined to Microsoft Entra or enrolled in device management. Business PCs need the commercial program below.
• Microsoft 365 Apps are not the operating system. Per Microsoft’s Microsoft 365 Apps guidance, Office apps on Windows 10 keep receiving security updates until October 10, 2028, but new features stop at Version 2608 and support is limited to troubleshooting. A patched Outlook on an unpatched Windows still leaves the PC exposed.
• LTSC devices follow their own dates, listed above. Windows 10 Enterprise LTSC 2021 ends on January 12, 2027, the same day as Windows Server 2016. Microsoft positions LTSC for special-purpose devices, which are easy to leave off an inventory.

Why it matters beyond the PC itself

An unsupported operating system is a finding in almost every security review and cyber insurance questionnaire that asks whether systems receive vendor security updates. For defense contractors working toward CMMC, FAR 52.204-21 already requires identifying, reporting and correcting system flaws in a timely manner, which an unpatched Windows 10 PC cannot meet. If Windows Server 2016 is on the same network, read our guide to Windows Server 2016 end of life as well.

Extended Security Updates (ESU) deliver Critical and Important security fixes to Windows 10 PCs for up to three years after end of support. They include no new features and no non-security fixes. Here is how the commercial program works, from Microsoft’s ESU program page, its activation guide, its lifecycle FAQ and its Partner Center guidance:

In round numbers at list price: 25 PCs that were enrolled in year 1 cost $3,050 to renew for year 2. The same 25 PCs joining now cost $4,575. One PC carried through all three years costs $427 in ESU alone, before any of the hardware or software work that still has to happen afterward.

What we see with ESU renewals

As a Microsoft CSP partner, we sell Windows 10 ESU licenses, and some of our clients who took year 1 have just purchased year 2 renewals. That ties back to hardware prices: businesses that would normally have replaced older PCs this year are holding onto them longer and using ESU to stay patched while they do.

One step is easy to miss. Because each ESU year has its own activation ID, buying year 2 is not the same as having it on the PC. A device that never gets the year 2 activation is not licensed for year 2, even though it looks covered on the purchase order. Check slmgr.vbs /dlv on every enrolled PC, or have your IT provider report it across the fleet.

When we ask why a PC is still on Windows 10, the answer is usually one of two things: the price of new hardware, or software and devices that have not been proven on Windows 11.

Hardware prices

In our own quotes since spring 2026, memory prices are up roughly 300 to 500 percent and storage roughly 200 to 300 percent. Even older-generation memory has climbed, because so many businesses are keeping hardware longer. That makes a fleet refresh far more expensive than it was a year ago.

The response we see most combines three moves: keep the existing PCs, add memory or storage where a machine needs it, and buy ESU to stay patched until replacement makes more sense. That is a reasonable bridge for PCs that cannot run Windows 11. For PCs that can run Windows 11, the upgrade itself is free, which a second year of ESU is not.

The devices that break a Windows 11 move

Printers are the biggest culprit we run into, with missing drivers or drivers that do not behave on Windows 11. Microsoft is also changing how printer drivers are delivered. Its third-party printer driver plan stopped publishing new printer drivers to Windows Update for Windows 11 on January 15, 2026, began ranking Windows’ built-in IPP class driver ahead of manufacturer drivers on July 1, 2026, and allows only security fixes to third-party drivers from July 1, 2027. Existing drivers can still be installed, including from the manufacturer’s own package, so the fix is usually a tested driver, not a new printer.

After printers, these are the devices and systems we check before any rollout:

• Barcode scanners and receipt printers at the counter or on the warehouse floor
• Credit card machines and payment terminals that connect to a Windows PC
• Biometric devices
• Access control systems for doors and gates
• Phone systems and their desktop software
• Older line-of-business software that the vendor has not certified on Windows 11
• Warehouse and manufacturing machines run by PLCs, where the PC running the operator software is often tied to the machine vendor’s supported Windows version

If one of these truly cannot move, keep that PC on ESU, take it off the general network, and limit what it can reach until the vendor has a supported path.

Every Windows 10 PC lands in one of four places. The right one depends on the hardware, the devices attached to it and the software it runs.

Cloud PCs are a niche choice, for a specific reason

Very few of our clients are moving to Windows 365 or Azure Virtual Desktop because of Windows 10. The ones who do are usually businesses that no longer want to deal with hardware lifecycles at all, often led by executives who prefer a predictable monthly operating expense over a capital purchase every few years. If that describes you, our guide to Azure Virtual Desktop for small business covers the costs and trade-offs.

Upgrading to Windows 11 is not a one-time event. Each Windows 11 version has its own end of updates, and the Home and Pro editions get a shorter window than Enterprise and Education. According to Microsoft’s Windows 11 release information:

The practical point: any Windows 11 Home or Pro PC still on version 24H2 no longer receives security updates. Check the version on every Windows 11 PC (Settings, then System, then About), move stragglers to 25H2 or 26H2, and look hardest at PCs where feature updates are paused or deferred by policy. Version 26H1 is only for certain new devices and is not offered as an upgrade to existing PCs.

Most of the time goes into testing, not installing. Here is what we see:

The rollout itself is quick once a pilot PC in each department has run every application and talked to every printer, scanner and payment terminal it needs. If you have in-house IT, our co-managed IT team can run the testing and rollout alongside them.

This is the order we follow:

1. 1
   Inventory every Windows 10 PC: edition, version, Windows 11 eligibility, attached devices, line-of-business software, and whether it is enrolled in ESU.
2. 2
   Confirm year 2 ESU activation on every enrolled PC, and enroll any PC that will still be on Windows 10 for a while. Joining later only costs more, and we can quote the licenses.
3. 3
   Pick one pilot PC per department or device type and test it on Windows 11 25H2 or 26H2 with every printer, scanner, payment terminal and application it uses.
4. 4
   Order replacements for PCs that fail the hardware requirements, and get them on order early through IT hardware procurement.
5. 5
   Roll out by department once each pilot passes, starting with the simplest groups.
6. 6
   Isolate any PC that has to stay on Windows 10, keep it on ESU, and set a date to revisit it before October 2027.

If you want help sorting your PCs into the four paths, we can review the list with you. For ongoing coverage, this planning is part of how we run managed IT services, and managed Microsoft 365 covers the Office side.