If your business bought itself a year of Windows 10 breathing room, that year ran out on 13 October 2026 — and the next one costs double. Here's what changed, and the fastest way off Windows 10 from here.
When Windows 10 support ended in October 2025, plenty of businesses did the pragmatic thing: paid for a year of Extended Security Updates (ESU) and moved on. Fair call. But ESU year one ended on 13 October 2026, and this second deadline was easy to sleepwalk past — no big headline this time, just a renewal notice and a price that has doubled. If some of your machines missed it, nothing visibly broke. That is exactly the problem.
What changed at the Windows 10 ESU deadline on 13 October 2026?
On 13 October 2026, year one of Windows 10 Extended Security Updates ended for business: from here, a device without a year-two licence gets no more security patches, though it still switches on and runs. For Melbourne businesses, Key IT's advice is to treat year two as a short bridge for the few machines that truly cannot move, and get everything else onto Windows 11.
Microsoft's list price for year one was US$61 per device. Year two doubles that to about US$122, and year three doubles it again to about US$244 before the program ends for good in October 2028. Microsoft designed the pricing as a ratchet — each year you stay, the exit gets more expensive.
Another deadline followed six days later, on 19 October. Microsoft's 2011 Secure Boot certificates have expired: two lapsed in June, and the last, Windows Production PCA 2011, which signs the Windows boot loader, expired on 19 October 2026. PCs keep starting, but one still missing the 2023 replacement certificates can no longer receive new boot-level security fixes. Microsoft says only supported Windows versions get the new certificates, so a Windows 10 PC that does not already have them needs current ESU cover, or a supported LTSC edition, to receive them. Some PCs also need a manufacturer firmware update first, and older models may never get one. Our guide to Secure Boot certificate expiry in 2026 covers how to check each PC and avoid BitLocker recovery lockouts. Old fleets are collecting deadlines.
What are your options if you still run Windows 10?
A business still running Windows 10 after 13 October 2026 has four honest options — and the right answer is usually a mix:
Upgrade in place
Machines that meet the Windows 11 hardware requirements upgrade free. Many 2019-or-later devices qualify and simply never got around to it.
Replace on a schedule
Hardware that cannot run Windows 11 is generally 6+ years old — past its sensible business life anyway. A staged replacement over the coming weeks, planned through IT procurement, spreads the cost and avoids a December scramble.
Buy ESU year two — deliberately
Legitimate for a machine tied to legacy software that cannot move yet, but only with a dated exit plan. See our companion explainer on how the ESU maze works.
Move the stubborn app to the cloud
Under Microsoft's ESU terms, Windows 10 virtual machines in Windows 365 or Azure Virtual Desktop receive ESU at no additional cost — so a legacy application can keep running, patched, while staff work on Windows 11.
Is it safe to keep running Windows 10 without ESU?
No — "we'll risk it" is the one wrong answer. Running Windows 10 with no ESU means every new Windows vulnerability stays open on your machines forever. Each time Microsoft fixes a flaw in Windows 11, attackers study the fix and aim it at Windows 10 machines that will never receive it, so the risk compounds monthly — and an unpatched PC is exactly the kind of foothold a ransomware attack starts from. It also has flow-on effects: cyber insurers ask about unsupported operating systems, and an unpatched fleet is a hard question to answer well at renewal. Unsupported systems sit squarely inside the Essential Eight's patching controls for a reason.
How long does it take to get off Windows 10?
About eight weeks from first audit to the last replacement machine, using the plan below — faster if most devices can upgrade in place. For the machine-by-machine triage, our Windows 10 checklist sorts every device into upgrade, replace, renew or retire.
Week 1–2: audit
Count every Windows 10 device, check Windows 11 eligibility, flag the legacy-software stragglers.
Week 3–6: upgrade wave
Eligible machines move to Windows 11, tested against your critical applications first.
Week 6–8: replacement orders
Ineligible machines are quoted, ordered and staged — arriving configured, not in boxes.
Week 8 onward: nothing happens
Which is the point — the only Windows 10 machines left are the ones you chose to keep on ESU, each with an exit date.
Frequently asked questions
How do I know which machines can run Windows 11?
Windows 11 needs a compatible 8th-generation-or-newer Intel (or equivalent AMD) processor, TPM 2.0 and Secure Boot. Microsoft's PC Health Check tool reports per machine — or we audit the whole fleet in one pass as part of managed IT.
Is ESU year two worth it for a handful of machines?
As a bridge, sometimes. As a strategy, no — the price doubles again for year three and the program ends in 2028. Pay for it only alongside a dated plan to retire the need.
Will Windows 11 disrupt our team?
Less than people fear. The working day looks almost identical, files and applications carry across, and we schedule upgrades outside working hours so most staff just sign in to a newer machine.
What about the Secure Boot certificate issue?
Three Microsoft Secure Boot certificates from 2011 expired during 2026, the last on 19 October. Machines keep booting, but those without the 2023 replacements stop receiving boot-level security fixes, and some models need a manufacturer firmware update before Windows can add the new certificates. On a managed fleet it is handled as routine patching, with BitLocker recovery keys confirmed before any firmware is touched — one more reason unmanaged old hardware is a false economy.
Is it too late to buy Windows 10 ESU year two?
No. Businesses can still buy ESU after 13 October 2026. ESU is cumulative, so an organisation that skipped year one pays for year one as well. Devices must be on Windows 10 version 22H2 to receive the updates, and year two should still come with a dated exit plan.
Do Windows 10 PCs stop working after the ESU deadline?
No. They keep starting up and running normally — Microsoft simply stops sending security fixes to any device without a current ESU licence, so every newly discovered flaw stays open while everything looks fine.
Does Windows 10 ESU year two renew automatically?
No. Microsoft sells ESU one year at a time, and on volume-licensed machines year two has its own activation, separate from year one. A device covered for year one gets no further patches until a year-two licence is bought and activated on it, so confirm each machine shows as licensed for year two.
Beat the ratchet
An audit takes days and turns a missed deadline into a dated plan. Talk to us before you renew another year of ESU — Managed IT support clients get this planned as standard, and we run the audit onsite across Melbourne or remotely.
Wondering how your own business measures up? A free IT & Cyber Security Review shows where you stand and what to fix first — no jargon, no obligation.
Book a Free Review