Still on Windows 10? The ESU runway ends in October

Somewhere in your office there is a perfectly functional-looking desktop running Windows 10. It boots, it prints, it runs QuickBooks. It is also 10 months past its operating system’s end of support, and the temporary safety net under it is about to get either expensive or nonexistent.

Windows 10 hit end of support on October 14, 2025. Machines did not stop working that day, which is exactly why so many are still around. What changed is that free security patches stopped, and the gap between “works fine” and “supported” has been quietly widening ever since. Extended Security Updates (ESU) papered over that gap for the past year. For consumer enrollments, ESU coverage ends October 13, 2026. Business ESU can extend up to 3 years total, but the per-device price roughly doubles each year, starting from $61 per device in year 1. Paying the escalating rate for aging hardware is a plan that gets worse every 12 months.

If your business still has Windows 10 machines in August 2026, this is the decision window. Here is how to work through it.

First, know what you actually have

You cannot make this decision from memory. Pull a device list that answers, per machine:

• Windows version and build
• Whether ESU is currently enrolled
• Age and purchase date
• Whether the hardware meets Windows 11 requirements: TPM 2.0 and a supported CPU, roughly Intel 8th generation or newer and comparable AMD Ryzen 2000-series or newer
• Who uses it and for what

For a 10 to 30 user company this is an afternoon of work with basic inventory tooling, or a report your IT provider should produce on request. If your provider cannot produce it, that is a separate conversation about what your documentation should look like.

The decision tree

With the list in hand, every Windows 10 machine falls into 1 of 3 buckets.

Bucket 1: Hardware supports Windows 11. Upgrade it. Free.

The Windows 11 upgrade costs nothing on eligible hardware, and for standard office machines it is a low-drama in-place upgrade. Schedule these now, a few machines at a time, and be done before October. The only reasons these machines are still on Windows 10 are inertia and nobody owning the task.

Bucket 2: Hardware fails Windows 11 requirements. Replace it.

A machine that cannot meet Windows 11’s requirements is, almost by definition, 7 or more years old. Do not buy another ESU year for it. You would be paying an annually doubling fee to keep patches flowing to hardware that is past its useful life on every other dimension too: warranty, battery, performance and parts. Put the money toward a replacement, which for business-class hardware runs $1,200 to $1,600 per seat. We covered how to make that spend boring and predictable in our hardware lifecycle post.

Bucket 3: The genuinely stuck machine.

Some environments have a Windows 10 box that cannot move because a line-of-business application, an instrument controller or a piece of shop equipment depends on it. For these, business ESU is a legitimate bridge, but treat it as a bridge with a toll that doubles annually, not a destination:

• Isolate the machine on the network so it cannot reach, or be reached from, anything it does not need
• Restrict it from web browsing and email entirely
• Put a vendor-upgrade or replacement date on the calendar, with an owner
• Document why it exists, so it does not become permanent by amnesia

The parts nobody budgets for

Two second-order effects catch businesses off guard.

Your security stack starts dropping support. EDR and management tool vendors maintain Windows 10 agent support on their own timelines, not Microsoft’s. As the installed base shrinks, testing effort shifts to Windows 11, and “supported” quietly becomes “best effort.” Running your security tooling on an OS its vendor deprioritizes is a slow leak in your defenses.

Insurance applications ask about end-of-life software. Cyber insurance questionnaires now routinely include a question about unsupported operating systems in the environment. Answering “yes” raises premiums or triggers exclusions. Answering “no” inaccurately is worse, because a misstatement surfaced during a claim gives the carrier leverage to deny it. A handful of $200-value desktops can therefore contaminate the insurability of the whole company, which is a spectacularly bad trade.

A 60-day action plan

Working backward from October 13:

• Week 1: Build the inventory. Bucket every Windows 10 machine: upgrade, replace or documented exception.
• Weeks 2 to 3: Push the free Windows 11 upgrades for bucket 1, a few machines at a time, with a known-good rollback image.
• Weeks 2 to 4: Order bucket 2 replacements. Business hardware lead times are normally fine, but do not bet October on a September order.
• Weeks 4 to 7: Deploy replacements, migrate user data and profiles, wipe and properly dispose of the retired machines with certificates of destruction.
• Week 8: For any bucket 3 stragglers, confirm ESU enrollment, network isolation and a written exit date.

None of this is technically difficult. It is a scheduling problem, and the businesses that treat it like one spend a modest, planned amount. The businesses that ignore it either pay a doubling annual fee indefinitely, run unpatched machines that undermine their security tooling and insurance answers or do a panic buy in October at whatever price and availability October offers. The costs of a planned refresh and a panicked one differ mostly in stress, timing and what breaks in between, and the flat-fee math of managed IT is built to absorb exactly this kind of scheduled work.

Atticus Rowan runs this playbook for small businesses across Ohio: inventory, upgrade waves, procurement, migration and documented disposal, without pulling your team off their actual jobs. If Windows 10 machines are still on your floor and October feels closer than it did in January, get in touch and we will get you off the runway before it ends.