On October 14, 2025, Microsoft ended support for Windows 10. No more security patches. No more bug fixes. No more updates of any kind. For the hundreds of millions of devices still running Windows 10 worldwide, the clock stopped — and the attack surface started growing.
Ten months on, the migration picture remains grim. Enterprise IT teams are dealing with hardware compatibility walls, application certification backlogs, and budget constraints that make wholesale upgrades painful. But the security math is unforgiving: every day on Windows 10 is another day of unpatched exposure.
Key Dates at a Glance
- Windows 10 22H2 (Home, Pro, Enterprise, Education): end of support 2025-10-14
- Windows 10 ESU year 1 (commercial and consumer): ends 2026-10-13
- Windows 10 ESU year 2 (commercial only): ends 2027-10-12
- Windows 10 ESU year 3 (commercial only): ends 2028-10-10
- Windows 11 24H2 Home and Pro: end of support 2026-10-13
- Windows 10 Enterprise LTSC 2021: end of support 2027-01-12
- Windows 10 Enterprise LTSC 2019: end of support 2029-01-09
- Windows 10 IoT Enterprise LTSC 2021: end of support 2032-01-13
Understanding the Scope
Before you can migrate, you need to know what you're dealing with. Most organizations dramatically underestimate their Windows 10 footprint until they run a proper inventory. Shadow IT, remote workers' personal devices used for work, branch office machines, and legacy departmental systems all contribute to a count that's often 20–30% higher than IT's official records.
Run a discovery scan across your entire environment — not just managed endpoints. Include everything that touches your network. The output should give you a complete count of Windows 10 machines, their hardware specifications, their primary use cases, and the applications installed on each.
The Hardware Problem
Windows 11 has a hard requirement for TPM 2.0 and a compatible 64-bit processor. Many machines purchased between 2015 and 2019 fail this check — not because they're slow, but because they lack the security hardware Windows 11 requires.
Replace the hardware. For machines that are four or more years old, replacement is often the right call economically. A new endpoint with a three-year lifecycle will cost less in the long run than extended security coverage for aging hardware.
Purchase Extended Security Updates (ESU). Microsoft offers paid ESU coverage for Windows 10 through October 2028 — three years of continued security patches at a per-device annual cost. This is a bridge, not a destination, but it buys time for complex migrations.
Move to Linux. For specific use cases — kiosk machines, single-purpose workstations, developer environments — Linux is a viable alternative that eliminates hardware replacement costs entirely.
The Application Compatibility Problem
Hardware is the first wall. Application compatibility is the second. Many enterprise applications were certified against Windows 10 and have not been re-tested against Windows 11. Some will work without modification. Some will require updates from the vendor. Some will break entirely.
For applications that fail compatibility testing, escalate to the vendor immediately. For legacy applications with no upgrade path, consider application virtualization — App-V, Citrix, or Azure Virtual Desktop — to isolate the incompatible application while migrating the underlying OS.
Migration Strategy: Phased Approach
Complete hardware and software inventory. Run Windows 11 readiness assessment. Categorize every endpoint: Ready to migrate, Needs hardware replacement, Needs application remediation, or ESU candidate.
Select 50–100 technically tolerant users across different departments. Migrate this group to Windows 11. Document issues, build remediation playbooks, refine your deployment process before proceeding at scale.
Deploy in waves of 500–2,000 endpoints per week. Prioritize internet-facing machines and those handling sensitive data. Use Windows Autopilot or SCCM/Intune for automated deployment at scale.
Address remaining exceptions: hardware replacements, application remediations, ESU enrollments. Set a hard deadline for ESU cutover — ideally no later than Q1 2027.
ESU: The Bridge Option
Microsoft's Extended Security Updates program delivers Critical and Important security fixes to enrolled Windows 10 devices after October 14, 2025 — for up to three years for organizations, one year for consumers. Devices must be on Windows 10 version 22H2 to enroll. ESU includes no new features, no non-security fixes and no technical support.
| ESU period | Ends | Commercial (Volume Licensing) | Consumer (Home/Pro personal use) |
|---|---|---|---|
| Year 1 | Oct 13, 2026 | US$61 per device | US$30 one-time, or free by syncing settings with Windows Backup or redeeming 1,000 Microsoft Rewards points (free in the EEA) |
| Year 2 | Oct 12, 2027 | US$122 per device (price doubles each year; years are cumulative — buying year 2 requires year 1) | Not offered |
| Year 3 | Oct 10, 2028 | US$244 per device | Not offered |
ESU is free for Windows 10 running as a virtual machine in Windows 365, Azure Virtual Desktop, Azure VMs and the Azure Stack family, and for Windows 10 endpoints that connect to a Windows 365 Cloud PC. Over three years the commercial total is US$427 per device — more than a mid-range replacement PC — which is the point: treat ESU strictly as a bridge, and give every machine on it a documented migration date and owner. Consumer ESU ends October 13, 2026 with no year two: home and small-business PCs on it have one deadline, not three.
Two Windows 10 clocks are not covered by ESU because they never needed it: Enterprise LTSC 2021 is supported until January 12, 2027 and Enterprise LTSC 2019 until January 9, 2029; IoT Enterprise LTSC 2021 runs to January 13, 2032. If a device is on an LTSC build, plan against those dates, not October 2025. And note the calendar collision: Windows 11 24H2 Home and Pro reach end of support on October 13, 2026 — the same day Windows 10's first ESU year ends, so a fleet migrated to 24H2 in 2025 needs its 25H2 feature update in the same window.
Which Windows 10 Are You Actually On?
ESU eligibility and the LTSC dates both depend on the exact build. winver shows version and build; in PowerShell, Get-ComputerInfo | Select-Object WindowsProductName, WindowsVersion, OsBuildNumber. Build 19045 is 22H2 (the only ESU-eligible build); 19044 is 21H2, including Enterprise LTSC 2021; 17763 is 1809, including Enterprise LTSC 2019. Fleet-wide, Intune, Configuration Manager or your RMM report the same fields, and the EOL Checker maps a build to its date. Anything on 22H2 that is not enrolled in ESU has been unpatched since October 14, 2025; anything below 22H2 cannot enroll at all and must move.
Communicating the Migration to End Users
User communication is half the battle. Windows 11 is visually different from Windows 10, and end users who aren't prepared will generate support tickets at scale. Send migration notices at least two weeks before a user's scheduled migration. Plan for a 15–20% increase in helpdesk volume in the two weeks following each wave deployment.
Windows 10 currently carries an EOL Risk Score™ of 80/100 — Grade D, high risk, recalculated at every site build from EOL recency, attack surface, CISA KEV exposure, and extended-support availability. Per-version scores and dates are on the Windows 10 lifecycle page.
The right response comes down to one question: how many more years does this system need to run? Under a year, extended support (where it exists) is usually cheaper than an emergency migration. One to three years, migrate — support fees paid repeatedly cost more than doing the project once. Indefinitely, migrate now and plan the next one before it surprises you. Extended support is often the more expensive choice over a multi-year horizon — a bridge, not a destination. And if this deadline feels like vendor caprice, it isn’t — why end of life is inevitable for every version, with the receipts.
Measuring Success
Track three metrics weekly: percentage of endpoints migrated to Windows 11, percentage enrolled in ESU as a bridge, and number of Windows 10 machines with zero coverage — neither migrated nor ESU-enrolled. That last number is your actual risk exposure. Drive it to zero.
Frequently Asked Questions
When did Windows 10 reach end of life?
October 14, 2025 — for Windows 10 version 22H2 Home, Pro, Enterprise and Education. Since then only devices enrolled in Extended Security Updates receive security fixes. Enterprise LTSC 2021 is supported until January 12, 2027, Enterprise LTSC 2019 until January 9, 2029, and IoT Enterprise LTSC 2021 until January 13, 2032.
How long does Windows 10 ESU last?
Up to three years for organizations — year 1 ends October 13, 2026, year 2 October 12, 2027, year 3 October 10, 2028 — and one year for consumers, ending October 13, 2026 with no second year. Devices must be on Windows 10 version 22H2 to enroll.
How much does Windows 10 ESU cost?
For organizations, US$61 per device for year 1 through Volume Licensing, doubling each year (US$122, then US$244); years are cumulative, so year 2 requires year 1. Consumers pay US$30 one-time for the single year, or get it free by syncing settings with Windows Backup or redeeming 1,000 Microsoft Rewards points (free in the EEA). ESU is free for Windows 10 VMs in Windows 365, Azure Virtual Desktop and Azure, and for endpoints connecting to a Windows 365 Cloud PC.
What happens on October 13, 2026?
The first Windows 10 ESU year ends — the last day of consumer ESU and of commercial year 1 — and, on the same Patch Tuesday, Windows 11 24H2 Home and Pro reach end of support. Organizations continue on Windows 10 ESU year 2 only if they buy it; home users have no further Windows 10 security updates after that date.
Can I still upgrade from Windows 10 to Windows 11 for free?
Yes, on hardware that meets Windows 11's requirements (TPM 2.0, Secure Boot, a supported CPU); the in-place upgrade keeps applications and data. Devices that fail the hardware check are the reason ESU exists — replace them, move them to a Windows 365 Cloud PC, or enroll them in ESU with a documented retirement date.
Does Windows 10 ESU include technical support?
No. ESU covers Critical and Important security updates only — no new features, no non-security fixes, and no general technical support; Microsoft supports only ESU activation, installation and regressions caused by an ESU update, and only for customers with a support plan.
The Windows 10 EOL is not a future problem — it's a current one. Every unpatched Windows 10 machine in your environment is accumulating CVE exposure with no remediation path. Start the inventory today. By October 13, 2026 — when the first ESU year ends — you want to be looking at a largely Windows 11 fleet — not a growing stack of ESU invoices.