Windows 10 Support Has Ended: What to Do Before ESU Costs Double

Windows 10 reached end of support on October 14, 2025. Since then, Microsoft no longer ships free security updates, feature updates, or technical support for it. Devices still running Windows 10 are either enrolled in Microsoft’s paid Extended Security Updates (ESU) program or receiving no security fixes at all.

If part of your fleet is still on Windows 10, the next date that matters is October 13, 2026, when ESU Year 1 coverage ends and the more expensive Year 2 begins. The practical goal before then is simple: know your exposure and your exit plan before the next ESU year bills. This guide covers where things stand, what ESU costs, and how to work through the remaining devices one decision at a time.

Where Windows 10 Stands in October 2026

Commercial ESU is sold through Microsoft volume licensing, one year at a time. According to Microsoft’s ESU documentation and its lifecycle FAQ:

• Year 1 costs US$61 per device and covers devices through October 13, 2026.
• Year 2 doubles to US$122 per device and runs through October 12, 2027.
• Year 3 doubles again to US$244 per device and ends October 10, 2028. There is no Year 4.
• ESU is cumulative, so an organization that enrolls in Year 2 also pays for Year 1, which comes to US$183 per device. Partial years can’t be purchased.
• ESU delivers critical and important security updates only. It doesn’t add features or restore general technical support.

There is one important exception. Windows 10 virtual machines running in Windows 365, Azure Virtual Desktop, Azure virtual machines and several other Azure services receive ESU at no additional cost. For some workloads, moving to a cloud desktop is a faster and cheaper bridge than buying ESU device by device. If you are weighing that option, our guide to moving to Azure Virtual Desktop is a good place to start.

What Staying on Windows 10 Means in Practice

For organizations still running Windows 10, with or without ESU, these are the trade-offs worth weighing:

Security Exposure: Devices outside ESU receive no security patches, so newly disclosed vulnerabilities stay unpatched on them.

Compliance Risks: Auditors and cyber insurers increasingly flag unsupported operating systems, so it helps to know exactly which devices are covered and which aren’t, especially in regulated industries.

Software and Hardware Compatibility Issues: New applications, drivers and devices are built and tested for Windows 11 first, so Windows 10 falls further behind.

Rising IT Costs: ESU fees double each year, and the manual workarounds that keep older devices running add labour costs that are easy to miss.

ESU buys time, not a destination. Treat it as a bridge for the specific devices that genuinely can’t move yet, not as a fleet-wide strategy.

The Challenges of Manual Windows 11 Migrations

Most organizations will finish the move to Windows 11; the real question is how much rework it takes along the way. Manual migrations tend to introduce avoidable risk and slow down day-to-day operations.

Time-Consuming and Error-Prone: Without automation, migration can be slow, requiring trial-and-error troubleshooting that extends project timelines.

Increased IT Workload: Internal IT teams already managing daily operations may struggle to handle a large-scale transition, leading to delays and inefficiencies.

Security Gaps: Manually upgrading devices can lead to inconsistent security measures, leaving some endpoints unpatched.

Scalability Issues: For businesses with multiple locations or large device inventories, a migration without structured processes becomes hard to track and coordinate.

A structured plan, automation where it makes sense, and experienced guidance make the remaining transition predictable.

Why Upgrade to Windows 11?

Upgrading to Windows 11 isn’t just about keeping up with Microsoft’s lifecycle. It’s about better security, improved performance and a modernized IT environment.

Enhanced Security: Windows 11 requires TPM 2.0 and Secure Boot and is built to support Zero Trust security models, helping businesses stay protected.

Improved Productivity: Features like Snap Layouts, virtual desktops and Microsoft Copilot streamline workflows and enhance efficiency.

Lower IT Costs: Completing the upgrade ends recurring ESU fees and reduces costly manual fixes and emergency remediation.

Optimized for Hybrid Work: Integrated collaboration tools and cloud-based management with Microsoft Intune make it easier for employees to work securely from anywhere.

Know Your Exposure, Then Set Your Exit Plan

Closing out the remaining Windows 10 devices is mostly a matter of knowing what you have and deciding what happens to each one. Here’s a practical sequence:

Know Your Exposure: Inventory What’s Left

• Identify every device still on Windows 10 and confirm whether it is enrolled in ESU.
• Verify which devices meet Windows 11 hardware requirements and which need replacing.
• Count the devices that would still need ESU coverage after October 13, 2026 if nothing changes, so you know what the next ESU year would bill.

Set Your Exit Plan: Upgrade, Replace, Virtualize or ESU, Device by Device

• Upgrade eligible devices in place, and replace hardware that can’t run Windows 11.
• Move workloads that depend on legacy applications to Azure Virtual Desktop or Windows 365, where Windows 10 ESU is included.
• Buy ESU only for the devices that truly can’t move before October 13, 2026, and set a firm exit date for each one.

Develop a Phased Rollout Plan

• Test critical applications for compatibility before broad deployment.
• Roll out in waves to minimize disruption.

Strengthen Security During Migration

• Enforce multi-factor authentication (MFA) to protect user access.
• Apply Zero Trust security models to secure data and devices.

Provide Employee Training and Support

• Educate employees on Windows 11’s new features and interface changes.
• Set up IT support channels to address any post-migration concerns.

Monitor and Optimize Post-Migration

• Apply security updates and patches regularly. Our post on Microsoft’s vulnerability remediation agent for Intune covers one way to automate this.
• Gather user feedback and adjust settings for optimal performance.

Working through it in this order helps keep the migration within the approved time frame and budget, with fewer surprises along the way.

Why Choose BITSUMMIT for Your Windows 11 Migration?

BITSUMMIT helps organizations move to Windows 11 with minimal downtime and strong security. Our approach includes:

Expert Guidance: A structured migration framework to keep the transition on track.

Security-First Strategy: Built-in security measures and compliance oversight to protect business data.

End-to-End Support: From planning to post-migration monitoring, our team manages every stage of the upgrade.

See how this works in practice: Apex Utilities moved 6,000 devices to Windows 11, and Reliance and GDI beat the Windows 10 deadline. For a faster start, our Windows 11 Migration Bundles package the work into a defined scope.

Before the Next ESU Year Bills

From October 14, 2026, any Windows 10 device still in service either needs ESU Year 2 coverage or goes without security updates. The practical approach is to use the next few weeks to decide, device by device, what upgrades, what gets replaced, what moves to the cloud and what stays on ESU for a limited time, with a firm exit date for each.

We understand that every migration is unique. That’s why we tailor our approach to your IT environment, from initial assessment to post-migration optimization.

Check your Windows 10 exposure with our team, and we’ll help you map an exit plan for each remaining device.