Microsoft ended standard support for Windows 10 on October 14, 2025. Since then, many organizations have relied on Extended Security Updates, or ESU, to keep legacy Windows 10 devices protected while planning their transition.
That temporary bridge reaches its first checkpoint on October 13, 2026. Businesses still operating Windows 10 devices must purchase the next year of coverage, upgrade eligible devices to Windows 11, replace incompatible hardware, or adopt another supported solution.
If Windows 10 is still present in your environment, now is the time to determine which devices remain and why.
What Happens When ESU Year 1 Ends?
Devices covered by commercial ESU continue receiving critical and important security updates during the purchased period. ESU does not include new features, design changes, or most nonsecurity updates. General technical support is also excluded.
Microsoft’s published coverage schedule for commercial ESU:
| ESU year | Coverage begins | Coverage ends |
| Year 1 | October 15, 2025 | October 13, 2026 |
| Year 2 | October 14, 2026 | October 12, 2027 |
| Year 3 | October 13, 2027 | October 10, 2028 |
Year 2 begins the day after Year 1 ends, so there is no coverage gap for organizations that purchase in advance. After October 10, 2028, the program ends entirely.
What ESU Actually Costs
Commercial ESU is licensed per device through Volume Licensing or a Cloud Solution Provider partner, and the price doubles every consecutive year:
- Year 1: $61 per device
- Year 2: $122 per device
- Year 3: $244 per device
Coverage is also cumulative. An organization that skipped Year 1 and now wants Year 2 must buy both, at $183 per device, even though Year 1 has already elapsed. Pricing is not prorated and partial periods are not available.
Carried to the end of the program, a single device costs $427 to keep patched through October 2028. Across 100 devices, that is roughly $42,700.
Delaying migration increases cost on a fixed schedule while the underlying problem remains unchanged.
ESU Is a Last Resort, Not a Strategy
Microsoft’s own guidance is unambiguous. The company describes ESU as a last resort option for customers who need to run legacy products past end of support, explicitly not a long-term solution but a temporary bridge while migrating to a supported platform.
That framing defines what ESU is for. It is not a support plan or a maintenance contract. It is a way to reduce security exposure on a specific device while that device is on its way out of the environment.
There are legitimate reasons to use it. A specialized application may not yet support Windows 11. Operational equipment may depend on an older workstation. A business may need time to budget for replacements across several offices.
The problem arises when temporary coverage quietly becomes the entire plan. ESU does not modernize the device, improve hardware compatibility, resolve aging applications, or eliminate the need to migrate. Every dollar spent on it buys time, not progress.
Use it deliberately, for a documented list of verified exceptions, while moving every compatible device to a supported platform.
Four Steps to Take Before October
1. Identify every remaining Windows 10 device
Inventory laptops, desktops, shared workstations, conference-room computers, kiosks, and devices connected to specialized equipment. Do not assume every device appears in the primary asset list. Older or rarely used systems are the ones most likely to be missed.
2. Confirm which devices are actually covered
Check that every device requiring temporary protection is properly licensed, activated, and successfully receiving updates. Commercial ESU carries specific edition and technical prerequisites, and licenses activate per device. Purchasing a license does not guarantee updates are being applied — verify delivery on the endpoint.
3. Sort devices by their best migration path
Assign each device a clear next step: upgrade to Windows 11, replace with compatible hardware, retain temporarily with ESU, move the workload to a supported cloud environment, or retire the device entirely.
Devices commonly fail Windows 11 eligibility because of processor generation or TPM 2.0 requirements rather than performance, so a machine that still feels fast may still need replacement.
This step also surfaces an option that is easy to overlook. ESU is included at no additional charge for Windows 10 virtual machines in Windows 365, Azure Virtual Desktop, and Azure virtual machines, and Windows 10 endpoints connecting to a Windows 365 Cloud PC are entitled to ESU for up to three years with an active subscription. For organizations weighing a cloud transition anyway, that can offset a meaningful share of the licensing cost.
Sorting devices properly prevents businesses from paying escalating fees on equipment that could already be upgraded or removed.
4. Test applications before wider deployment
Account for the applications, peripherals, security tools, and workflows employees use every day. Test business-critical software before scheduling a company-wide rollout. For larger environments, a phased migration gives IT teams time to resolve compatibility issues before they affect more users.
Build a Clear Path Forward
A rushed migration produces preventable downtime, unexpected hardware purchases, application issues, and frustrated employees. Starting now leaves room to prioritize the highest-risk devices, coordinate upgrades around business schedules, budget for replacements, and retain ESU only where there is a documented need.
The goal is not simply to remove Windows 10. It is to build a supported, secure, and manageable environment without interrupting the organization’s work.
Crimson IT can help you inventory Windows 10 devices, verify ESU coverage, assess Windows 11 readiness, test compatibility, plan hardware replacements, and coordinate migrations with minimal disruption.
If Windows 10 is still part of your environment, contact Crimson IT to schedule a readiness review before the October 13 deadline.
