Windows 10 support has ended. Here is the plan.

The short answer

Microsoft ended support for Windows 10 on October 14, 2025. Windows 10 computers still turn on and run, but they no longer get security fixes, bug fixes or technical support unless they are enrolled in the paid Extended Security Updates (ESU) program. For businesses, ESU costs $61 per device for the first year, doubles each year, and runs for a maximum of three years, ending in October 2028. As of October 2026, Year 2 of ESU is starting, so the price per device is rising. The right plan for most businesses is to upgrade capable machines to Windows 11, replace the ones that cannot run it, and use ESU only as a short bridge for the stragglers.

What actually stopped

According to Microsoft, after October 14, 2025 Windows 10 no longer receives:

• Technical support from Microsoft
• Feature updates or new features
• Quality updates, including security and reliability fixes

The last feature update was version 22H2. Without security fixes, every newly discovered Windows flaw stays open on those machines. CISA’s Known Exploited Vulnerabilities catalog shows how quickly attackers use published Windows flaws, which is why an unpatched computer becomes riskier every month.

There is also an insurance and compliance angle. Many cyber-insurance applications ask whether you run unsupported operating systems, and regulated businesses may have to show that systems receive security updates. This is general information: check your policy and your obligations with your insurer or counsel.

What still works, for now

• Microsoft 365 apps: Microsoft says it will keep providing security updates for Microsoft 365 apps on Windows 10 until October 10, 2028. Feature updates stop at version 2608, and support cases will be asked to move to Windows 11.
• OneDrive: the desktop app on Windows 10 22H2 keeps receiving updates through October 10, 2028, according to Microsoft.
• Your files and line-of-business apps: they keep running, but vendors increasingly certify only Windows 11.

None of this patches Windows itself. Updated apps on an unpatched operating system are still exposed.

Extended Security Updates: cost and rules

Microsoft’s ESU program delivers critical and important security updates to enrolled Windows 10 devices. Key points from Microsoft’s documentation, as of 2026:

• Price: $61 per device for Year One through volume licensing, doubling each consecutive year for up to three years. That is $122 in Year Two and $244 in Year Three.
• Cumulative: if you join in Year Two, you must also pay for Year One. You cannot buy only the current year.
• Eligibility: devices must be on Windows 10 version 22H2.
• What it is not: no new features, no non-security fixes and no general technical support.
• Minimum: one license. You can cover just the few machines that must stay.
• Consumer offer does not apply: the consumer ESU options are for individuals and home use, not business devices.

A device joining ESU now pays for two years at once, $183 before Year Three. That is often a meaningful share of a new entry-level business laptop, which is why ESU makes sense only for machines with a firm replacement date or a specific dependency.

The cloud option

Microsoft includes ESU at no additional cost for Windows 10 virtual machines in Windows 365 and Azure Virtual Desktop, and says Windows 10 devices connecting to Windows 365 Cloud PCs are entitled to ESU for up to three years with an active Windows 365 license. For a business with a handful of old machines and staff who mostly use a browser and Microsoft 365, Cloud PCs can be a tidy bridge. For most offices, replacing the hardware is simpler.

A five-step plan to finish the move

1. Inventory. List every Windows computer with its version, model, age and user. Do not forget front-desk PCs, conference room machines and the computer that runs the badge system or a lab instrument.
2. Check Windows 11 eligibility. Microsoft’s minimum requirements include a compatible 64-bit processor, 4 GB of memory, 64 GB of storage, UEFI firmware with Secure Boot and TPM 2.0. Device management tools or the PC Health Check app will flag machines that fail.
3. Test your business apps. Confirm accounting, practice management, scanning and printing work on Windows 11 with one pilot user per department before rolling out.
4. Upgrade or replace in waves. Upgrade eligible machines in groups after hours. Order replacements for the rest, oldest first, and set them up through device management so they arrive ready.
5. Bridge the stragglers. Enroll only the machines that truly cannot move yet in ESU, record why, and set a retirement date for each.

Not sure how many Windows 10 machines you still have, or which ones can upgrade? Our free Technology Health Assessment takes 30 minutes of data collection and gives you a plain-language report the next day, including IT operations and cybersecurity ratings and a short list of next steps in order.

Upgrade day checklist

For each machine moving from Windows 10 to Windows 11 in place:

• Confirm the user’s Desktop and Documents sync to OneDrive or another backed-up location.
• Note any local printers, scanners and mapped drives.
• Install pending Windows 10 updates and firmware updates first.
• Check that BitLocker recovery keys are stored in your management console before starting.
• Run the upgrade after hours, then sign in and test email, files, printing and line-of-business apps.
• Confirm endpoint protection and device management agents report in after the upgrade.
• Record the machine as done in the inventory.

How to budget the move

Split the cost into three lines. First, labor for in-place upgrades on eligible machines, which is usually modest per device when done in batches. Second, replacement hardware for machines that cannot run Windows 11, spread across quarters if cash flow is tight. Third, ESU for the few devices that must wait, priced at the cumulative Year One plus Year Two rate. Comparing the second and third lines device by device usually makes the decision obvious.

Mistakes to avoid

• Assuming “it still works” means it is safe. Working and patched are different things.
• Forgetting special-purpose PCs. Machines attached to equipment are often the last on Windows 10 and the most exposed.
• Upgrading without backups. Confirm files are in OneDrive, SharePoint or another backed-up location before any in-place upgrade.
• Buying ESU for everything. At Year Two pricing it costs more to delay than to plan.
• Leaving old servers out of the plan. Windows Server 2016 reaches the end of extended support in January 2027. If you are replacing desktops, review the server at the same time.

JLB USA provides managed IT for businesses with roughly 25 to 100 employees, including computer upgrades and replacement planning. For a standard new-computer build, see our new office IT setup checklist, and see our cybersecurity services for patching and endpoint protection.

Related services

• Managed IT services
• Free Technology Health Assessment
• Cybersecurity services
• New office IT setup checklist