Windows 10's second deadline: your ESU safety net ends in October 2026
The Windows 10 ESU deadline passed on 13 October 2026. What changed for business, year two's cost (about USmd:22 a device) and the fastest way off Windows 10.
If your business bought itself a year of Windows 10 breathing room, that year ran out on 13 October 2026 — and the next one costs double. Here's what changed, and the fastest way off Windows 10 from here.
When Windows 10 support ended in October 2025, plenty of businesses did the pragmatic thing: paid for a year of Extended Security Updates (ESU) and moved on. Fair call. But ESU year one ended on 13 October 2026, and this second deadline was easy to sleepwalk past — no big headline this time, just a renewal notice and a price that has doubled. If some of your machines missed it, nothing visibly broke. That is exactly the problem.
What changed at the Windows 10 ESU deadline on 13 October 2026?
On 13 October 2026, year one of Windows 10 Extended Security Updates ended for business: from here, a device without a year-two licence gets no more security patches, though it still switches on and runs. For Melbourne businesses, Key IT's advice is to treat year two as a short bridge for the few machines that truly cannot move, and get everything else onto Windows 11.
Microsoft's list price for year one was US$61 per device. Year two doubles that to about US$122, and year three doubles it again to about US$244 before the program ends for good in October 2028. Microsoft designed the pricing as a ratchet — each year you stay, the exit gets more expensive.
There is a second, quieter 2026 problem: Secure Boot certificates on many older machines began expiring from mid-2026, needing firmware and update attention of their own. Old fleets are collecting deadlines.
What are your options if you still run Windows 10?
A business still running Windows 10 after 13 October 2026 has four honest options — and the right answer is usually a mix:
Upgrade in place.
Machines that meet the Windows 11 hardware requirements upgrade free. Many 2019-or-later devices qualify and simply never got around to it.
Replace on a schedule.
Hardware that cannot run Windows 11 is generally 6+ years old — past its sensible business life anyway. A staged replacement over the coming weeks, planned through IT procurement, spreads the cost and avoids a December scramble.
Buy ESU year two — deliberately.
Legitimate for a machine tied to legacy software that cannot move yet, but only with a dated exit plan. See our companion explainer on how the ESU maze works.
Move the stubborn app to the cloud.
Under Microsoft's ESU terms, Windows 10 virtual machines in Windows 365 or Azure Virtual Desktop receive ESU at no additional cost — so a legacy application can keep running, patched, while staff work on Windows 11.
Is it safe to keep running Windows 10 without ESU?
No — "we'll risk it" is the one wrong answer. Running Windows 10 with no ESU means every new Windows vulnerability stays open on your machines forever. Each time Microsoft fixes a flaw in Windows 11, attackers study the fix and aim it at Windows 10 machines that will never receive it, so the risk compounds monthly — and an unpatched PC is exactly the kind of foothold a ransomware attack starts from. It also has flow-on effects: cyber insurers ask about unsupported operating systems, and an unpatched fleet is a hard question to answer well at renewal. Unsupported systems sit squarely inside the Essential Eight's patching controls for a reason.
How long does it take to get off Windows 10?
About eight weeks from first audit to the last replacement machine, using the plan below — faster if most devices can upgrade in place. For the machine-by-machine triage, our Windows 10 checklist sorts every device into upgrade, replace, renew or retire.
Week 1–2: audit.
Count every Windows 10 device, check Windows 11 eligibility, flag the legacy-software stragglers.
Week 3–6: upgrade wave.
Eligible machines move to Windows 11, tested against your critical applications first.
Week 6–8: replacement orders.
Ineligible machines are quoted, ordered and staged — arriving configured, not in boxes.
Week 8 onward: nothing happens.
Which is the point — the only Windows 10 machines left are the ones you chose to keep on ESU, each with an exit date.
Frequently asked questions
How do I know which machines can run Windows 11?
Windows 11 needs a compatible 8th-generation-or-newer Intel (or equivalent AMD) processor, TPM 2.0 and Secure Boot. Microsoft's PC Health Check tool reports per machine — or we audit the whole fleet in one pass as part of managed IT.
Is ESU year two worth it for a handful of machines?
As a bridge, sometimes. As a strategy, no — the price doubles again for year three and the program ends in 2028. Pay for it only alongside a dated plan to retire the need.
Will Windows 11 disrupt our team?
Less than people fear. The working day looks almost identical, files and applications carry across, and we schedule upgrades outside working hours so most staff just sign in to a newer machine.
What about the Secure Boot certificate issue?
From mid-2026, expiring Secure Boot certificates need firmware and Windows updates applied to keep older machines booting securely. It is handled as routine patching on a managed fleet — one more reason unmanaged old hardware is a false economy.
Is it too late to buy Windows 10 ESU year two?
No. Businesses can still buy ESU after 13 October 2026. ESU is cumulative, so an organisation that skipped year one pays for year one as well. Devices must be on Windows 10 version 22H2 to receive the updates, and year two should still come with a dated exit plan.
Do Windows 10 PCs stop working after the ESU deadline?
No. They keep starting up and running normally — Microsoft simply stops sending security fixes to any device without a current ESU licence, so every newly discovered flaw stays open while everything looks fine.
Does Windows 10 ESU year two renew automatically?
No. Microsoft sells ESU one year at a time, and on volume-licensed machines year two has its own activation, separate from year one. A device covered for year one gets no further patches until a year-two licence is bought and activated on it, so confirm each machine shows as licensed for year two.
Beat the ratchet
An audit takes days and turns a missed deadline into a dated plan. Talk to us before you renew another year of ESU — Managed IT support clients get this planned as standard, and we run the audit onsite across Melbourne or remotely.
Related services & guides
More insights
Windows 10 ESU: free vs paid
Windows 10 ESU explained: free for home PCs until October 2027, but business PCs pay US$61 each for…
Read article →Windows 10Windows 10 end of life
Windows 10 end of life was 14 October 2025, and business ESU year one ended 13 October 2026. The…
Read article →Windows 10Windows 10: the four-week countdown
Windows 10 ESU deadline checklist: year one ended 13 October 2026 and year two costs about USmd:22…
Read article →Book your free IT & Cyber Security Review
See exactly where your IT and security stand, and what to fix first. No jargon, no obligation.