We published this four-week checklist a month before business Windows 10 Extended Security Updates (ESU) year one ran out on 13 October 2026. It still works if you're running late: machines without a year-two licence miss their first security patch in November, and the section on missing the deadline, below, shows how to compress the plan.
Windows 10 stopped receiving free security updates in October 2025. Businesses that bought year one of Microsoft's Extended Security Updates (ESU) program got a twelve-month extension — and that extension ran out on 13 October 2026. Since then, a Windows 10 machine without a year-two ESU licence gets no new security patches, starting with November's, and Microsoft's list pricing means year two costs roughly double year one — about US$122 per device. We covered the deadline itself in Windows 10's second deadline and the free-vs-paid options in our ESU explainer. This post is the practical part: what to actually do, week by week, so every Windows 10 machine ends up upgraded, replaced, covered or retired.
Week 1: how many Windows 10 machines do you really have?
Usually more than anyone guesses, so the first job is an honest inventory. Most businesses that think they have "a few" Windows 10 machines left find more once they look: the warehouse PC, the machine driving a label printer, the laptop a part-timer uses on Thursdays. For each one, record whether the hardware meets Windows 11 requirements (TPM 2.0, a supported CPU; Microsoft's free PC Health Check app answers this one machine at a time) — that single fact splits your fleet into "upgrade in place" and "replace or pay". If you have a managed IT provider, this list should already exist; ask for it. An internal vulnerability scan is a useful cross-check, because it flags workstations still running outdated, unsupported software, including the ones nobody remembered.
Week 2: should each machine be upgraded, replaced, renewed or retired?
Every Windows 10 device gets exactly one of four labels:
Upgrade
Hardware supports Windows 11: schedule the in-place upgrade before the November Patch Tuesday (10 November 2026).
Replace
Hardware can't run Windows 11 and the machine matters: order now, because lead times compress badly when everyone buys in the same month. Our procurement service handles sourcing and rollout.
Renew ESU
The machine genuinely can't move yet (a legacy application, a vendor dependency): budget for year-two ESU at roughly double last year's price, and write down the exit plan.
Retire
The machine no one will miss. Decommission it properly: wipe it, remove its accounts, take it off the network.
Week 3: how do you move to Windows 11 without stopping work?
Batch the moves: a few machines per day, teams staggered, data and profiles migrated so people sit down to a working machine. Upgrades and replacements only hurt when they land on someone mid-deadline. Test your critical line-of-business applications on one Windows 11 machine first, then roll out. This is routine for a provider that does it constantly — our managed IT services clients had their Windows 11 migrations planned into business-as-usual months ago.
Week 4: verify, then close the books on Windows 10
The last week is for verification, not new work. Confirm every remaining Windows 10 machine is on version 22H2 (ESU updates won't install on anything older) and has a current ESU licence attached, confirm upgraded machines are actually patched and healthy, and confirm the retired machines are really gone — a forgotten, unpatched PC that still has network access and cached credentials is exactly the foothold attackers hunt for after a deadline like this.
Check Secure Boot while you're there. The last of Microsoft's 2011 Secure Boot certificates expired on 19 October 2026, and Microsoft says only supported Windows versions get the 2023 replacements. Without ESU or a supported LTSC edition, a Windows 10 PC can't receive new boot-level security fixes either. Our guide to the Secure Boot certificate expiry in 2026 shows how to check each PC and avoid surprise BitLocker recovery prompts.
What about the free consumer ESU?
Microsoft's consumer ESU route — free with a Microsoft account — has been extended into 2027, but it is a consumer program: it does not cover domain-joined or business-managed machines. For a business fleet, the choices remain the four labels above.
What if you missed the 13 October 2026 deadline?
Start the checklist today and compress it: year one covered the October 2026 security release, so the first monthly patch an unrenewed business machine misses is November's (Patch Tuesday, 10 November 2026). Use that window to run Weeks 1 and 2 in days, buy year-two ESU only for the machines labelled Renew, and upgrade, replace or retire the rest. Any machine that never had ESU has been unpatched since October 2025, so deal with it first.
Frequently asked questions
What happens if we just keep running Windows 10 after 13 October?
The machines keep working, but every new vulnerability found from that day on stays unpatched forever. Attackers reverse-engineer each month's Windows 11 patches to find the same holes in Windows 10 — so unpatched machines get steadily easier to break into. Cyber insurers ask about them, and the Essential Eight expects unsupported operating systems replaced even at maturity level one.
Is paying for ESU year two a bad decision?
Not always — for a handful of machines pinned by a legacy application it can be the right bridge. It becomes a bad decision when it's a way to avoid deciding: the price roughly doubles each year precisely to push you off the platform.
Can our old machines run Windows 11 unofficially?
Workarounds exist, but unsupported installs aren't guaranteed to keep receiving updates — which defeats the whole purpose of the migration. For business machines, upgrade supported hardware or replace.
We haven't started. Is four weeks enough?
For most small and mid-sized fleets, yes — if the decisions get made this week. The inventory and the four-label triage take days, not weeks. If 13 October has already passed, the same plan applies; start today rather than renewing ESU on every machine by default.
What will Windows 10 ESU year two cost us?
About US$122 per device at Microsoft's list price, double year one's US$61. Year three, the last, doubles again to about US$244 before ESU ends in October 2028. Price only the machines labelled Renew, give each one an exit date before you buy, and expect local pricing to depend on how you buy your Microsoft licensing.
Can we still buy ESU year two after 13 October 2026?
Yes, but only as a full year: Microsoft doesn't sell part-years, so buying late doesn't make year two cheaper. ESU is also cumulative, so a business that skipped year one has to pay for it as well. Once the licence is activated on a PC running Windows 10 version 22H2, security updates start arriving again.
Is there a cheaper option than paying ESU on every old PC?
Sometimes. If a PC stays on Windows 10 only for one legacy application, host that application in the cloud instead: Microsoft includes ESU at no extra charge when Windows 10 runs on a cloud desktop in Azure Virtual Desktop or Windows 365. The desk PC can then be upgraded or replaced. Price that against ESU on every desk.
Wondering how your own business measures up? A free IT & Cyber Security Review shows where you stand and what to fix first — no jargon, no obligation.
Book a Free Review