How to Migrate Off Windows 10: The Post-EOL Playbook (2026)
Windows 10 22H2 — the final consumer release of Windows 10 — reached end of life on October 14, 2025. Since that date, machines without an Extended Security Updates (ESU) enrollment have received no security patches: every vulnerability discovered after EOL stays open on those systems permanently. The consumer ESU bridge softened the cliff, but it runs out in October 2026. If you are still on Windows 10 in mid-2026, this is the window to execute a migration rather than plan one.
What Actually Stopped at End of Life
End of life for Windows 10 means, concretely:
- No more security updates for unenrolled machines — monthly cumulative updates stopped after October 14, 2025.
- No more feature or quality updates — 22H2 was the last feature release; bugs that shipped with it stay shipped.
- No technical support from Microsoft for the OS itself.
- Shrinking application support — third-party software vendors progressively drop Windows 10 from their support matrices after the OS vendor does.
Two carve-outs matter. First, machines enrolled in consumer ESU continue to receive security-only updates into October 2026, and commercial ESU is available in yearly increments for organizations. Second, the long-term servicing editions were never on the consumer clock: Windows 10 Enterprise LTSC 2021 (21H2) is supported until January 12, 2027, and LTSC 2019 (1809) until January 9, 2029. Full per-edition dates are on our Windows lifecycle page.
Who Is Affected
Three groups are still exposed in 2026:
- Home users on older hardware — machines that fail Windows 11's requirements (TPM 2.0, supported CPU list, Secure Boot) and cannot take the free upgrade.
- Small businesses without central management — fleets that were never inventoried, where nobody knows how many Windows 10 machines exist until a scanner finds them.
- Enterprises with anchored endpoints — point-of-sale terminals, lab instruments, kiosks, and machines running line-of-business software certified only for Windows 10.
Migration Paths, Ranked by Effort
Path 1 — In-place upgrade to Windows 11 (lowest effort, compatible hardware only)
If the machine meets Windows 11 hardware requirements, the in-place upgrade preserves applications, settings, and files. Check eligibility with the PC Health Check app or your endpoint management tooling. Pick your target release deliberately: Windows 11 24H2 Home/Pro is itself serviced only until October 13, 2026, so migrating to it in mid-2026 buys you months, not years — target 25H2 (Home/Pro serviced until October 12, 2027) or newer where your tooling allows. Enterprise editions get longer servicing windows; see the per-version tables on /windows.
Path 2 — Hardware replacement (moderate effort, the common enterprise path)
For machines that fail the requirements check, replacement is usually cheaper than fighting the hardware. Fold the migration into your normal refresh cycle where possible, and prioritize by exposure: internet-facing and credential-holding machines first, air-gapped kiosks last.
Path 3 — Re-platform to Linux or a virtual desktop (higher effort, hardware-constrained fleets)
Hardware that Windows 11 rejects often runs a modern Linux desktop comfortably. This is a real option for browser-centric users and for secondary machines, but it is a re-platforming project, not an upgrade: application compatibility (especially anything built on Windows-only software) decides feasibility. The alternative flavor is a thin-client model — keep the old hardware as a terminal into a virtual desktop running a supported OS.
Path 4 — Extended support as a bridge (lowest disruption, highest ongoing cost)
ESU and third-party patching options exist precisely for fleets that cannot finish migrating on schedule. Treat them as a bridge with an explicit end date, not a destination — see the "can't migrate yet" section below.
Step-by-Step Migration Checklist
- Inventory. Enumerate every Windows 10 machine — including the ones not in your management console. Record edition (Home/Pro/Enterprise/LTSC), version, and hardware eligibility for Windows 11.
- Segment. Split into: upgrade-eligible, replace, re-platform, and bridge (ESU/extended support). LTSC machines get their own bucket — they have time.
- Confirm application compatibility. Test your critical line-of-business applications on the target Windows 11 release before touching production machines.
- Back up before every upgrade. Full image or verified file-level backup — an in-place upgrade that fails mid-flight is recoverable only if you did this.
- Pilot. Upgrade a small representative slice, run it for a week or two, and watch for driver and peripheral problems.
- Roll out in waves, highest-exposure machines first. Verify BitLocker/encryption status and update posture after each wave.
- Decommission properly. Wipe and dispose of replaced machines; remove retired hosts from licensing and monitoring so the inventory stays true.
Common Pitfalls (What Actually Breaks)
- Peripheral drivers. Printers, scanners, and lab equipment with vendor drivers last updated years ago are the most common in-place upgrade casualty. Check driver availability for the target OS before upgrading the host.
- The 24H2 trap. Migrating in 2026 to Windows 11 24H2 Home/Pro puts you back on an EOL countdown almost immediately (October 13, 2026). Go straight to a newer release where possible.
- BitLocker recovery prompts. Firmware and TPM changes during upgrades can trigger recovery-key prompts. Verify recovery keys are escrowed before the rollout, not during it.
- Forgotten machines. The conference-room PC, the warehouse terminal, the machine under someone's desk. Unmanaged endpoints are found by attackers before they are found by audits.
- Assuming ESU is automatic. ESU requires enrollment. A Windows 10 machine that nobody enrolled has been unpatched since October 2025, whatever the migration plan says.
If You Can't Migrate Yet
Some fleets genuinely cannot finish in time — hardware certified against Windows 10, budget cycles, application vendors that haven't shipped Windows 11 support. For those cases, extended support is the honest bridge: Microsoft's ESU program (consumer into October 2026; commercial in yearly increments), or commercial extended-support vendors that ship security patches for EOL Microsoft products independently. We compare the options on our extended support vendors page. Whichever bridge you pick, write down the exit date and put the migration on a calendar — a bridge without an end date is just an unsupported system with a subscription.
Frequently Asked Questions
Is Windows 10 still safe to use in 2026?
Windows 10 22H2 reached EOL on October 14, 2025. Without ESU enrollment, no security patches are delivered and every new vulnerability stays open permanently. ESU-enrolled machines keep receiving security-only updates into October 2026.
When does the Windows 10 consumer ESU program end?
The consumer ESU bridge covers Windows 10 22H2 into October 2026. Commercial ESU is available in yearly increments for organizations needing longer.
My PC does not meet Windows 11 requirements. What are my options?
Enroll in ESU as a short-term bridge, replace the hardware, move to a Linux desktop, or shift to a virtual desktop on a supported OS. Forcing Windows 11 onto unsupported hardware via registry workarounds leaves you outside the supported configuration.
Are any Windows 10 editions still supported in 2026?
Yes — Windows 10 Enterprise LTSC 2021 (21H2) is supported until January 12, 2027, and LTSC 2019 (1809) until January 9, 2029. These are volume-licensed editions for special-purpose devices.
Which Windows 11 version should I migrate to?
The newest your hardware and tooling support. Windows 11 24H2 Home/Pro ends servicing October 13, 2026; 25H2 Home/Pro runs until October 12, 2027. Check every release on our Windows page.