Windows 10 extended security updates: year one ends on 13 October 2026. Should you renew, upgrade or replace?

What actually happens on 13 October 2026?

Windows 10 reached end of support on 14 October 2025. Since then, the only way for a business PC to keep getting Windows 10 security updates has been Microsoft's paid ESU programme, which is bought one year at a time for up to three years. Year one ends on 13 October 2026, eight days after this article is published. Year two runs from 14 October 2026 to 12 October 2027.

A PC without year two keeps working. It just won't get the November security update, or any after it, even though it still opens email, browses the web and holds company data.

The same day brings a second, quieter deadline. Windows 11 version 24H2 Home and Pro editions also reach end of servicing on 13 October 2026 (BleepingComputer, July 2026). A PC that "upgraded to Windows 11" a year or two ago but has never moved to version 25H2 is about to be in the same position as an unpatched Windows 10 machine.

What does year two cost, and why does skipping it not save money?

Microsoft's list prices for commercial ESU are per device, per year (Microsoft Learn):

UK businesses buy through a Microsoft partner in sterling, so your invoice won't match the dollar figure. The pattern is what matters: each year costs twice the last.

Two rules catch people out. First, ESU is cumulative. If you skipped year one and want year two, you have to pay for year one as well. Second, you can't buy part of a year. A device joining in March still pays for the full year.

There are cases where ESU costs nothing. Windows 10 virtual machines running in Windows 365, Azure Virtual Desktop and Azure virtual machines get ESU at no extra charge (Microsoft Learn). If you already run cloud desktops for some staff, those don't need a licence.

Doesn't Microsoft give ESU away free now?

Only to home users. In June 2026, Microsoft extended its consumer ESU programme to 12 October 2027, free for anyone who syncs their PC settings (Help Net Security, 26 June 2026). That headline has confused a lot of small businesses.

Consumer ESU can't be used for business. Microsoft excludes devices joined to Microsoft Entra ID or Active Directory, and devices enrolled in mobile device management such as Microsoft Intune. If a device enrolled in consumer ESU is later used commercially, its enrolment is suspended (Microsoft). A business laptop that is properly managed doesn't qualify. One that isn't managed is a bigger problem than its update status.

Renew, upgrade or replace: how do you decide for each PC?

Work through your Windows 10 devices one at a time. Most businesses end up with a mix.

Remember that ESU only covers Windows 10 version 22H2. A device on an older build won't receive ESU patches even if you pay for them.

What about Cyber Essentials and Microsoft 365?

Cyber Essentials. IASME, which runs the scheme, treats Windows 10 devices in scope that aren't enrolled in ESU as unsupported and non-compliant (IASME Knowledge Hub). Devices covered by year one have been acceptable. From 14 October, any in-scope Windows 10 PC without year two fails the "supported software" requirement. If your certificate renews in the next twelve months, every Windows 10 device needs year two or a replacement date before the assessment.

Microsoft 365 apps. Word, Excel, Outlook and Teams keep working on Windows 10. Microsoft will provide security updates for Microsoft 365 Apps on Windows 10 until 10 October 2028, but feature updates stop at version 2608, and Microsoft support will ask you to move to Windows 11 if a problem only happens on Windows 10 (Microsoft Learn). ESU covers Windows itself, not the apps. You need both to be current.

Worked example: a 25-person office with nine Windows 10 PCs

Example (an illustration using Microsoft's list prices, not a quote): a 25-person firm in Glasgow still has nine Windows 10 PCs. It bought year one for all nine in November 2025.

An audit sorts the nine into three groups:

• Four PCs meet the Windows 11 requirements once Secure Boot is switched on. They're upgraded to Windows 11 25H2 before 13 October. ESU cost: nothing.
• Three PCs are six years old and don't meet the requirements. Replacements are ordered, but won't be set up until November, so the firm buys year two for these three as a bridge: 3 × US$122 = US$366 at list price.
• Two PCs run a legacy design package that its supplier hasn't certified for Windows 11. They get year two (US$244 at list price), move onto their own network segment, and the firm asks the supplier for a written Windows 11 date.

Had the firm renewed all nine without thinking, year two would have cost US$1,098 at list price, with year three at US$2,196 to follow. Instead it pays for five devices this year and, if the supplier delivers, none next year. The firm also checks its Windows 11 PCs and finds two on version 24H2 Pro, which are moved to 25H2 in the same week.

How Indigo does this. Indigo Unified Communications manages 2,000+ endpoints from Glasgow, keeping them updated through Datto RMM and managing them with Microsoft Intune, so we can list every Windows 10 and Windows 11 24H2 device on your network in one report. We're a Microsoft Solutions Partner for Modern Work and hold Cyber Essentials Plus ourselves. We don't supply Extended Security Update licences ourselves; for most clients we plan an upgrade or replacement instead. Where a PC needs replacing, old equipment goes to a certified WEEE recycling partner. On our Silver package, PC builds are chargeable. Managed IT support →

What to do next

1. List every Windows 10 device this week, with its Windows build, age and whether it meets the Windows 11 requirements. Check your Windows 11 PCs for version 24H2 at the same time.
2. Upgrade every compatible PC to Windows 11 25H2 before 13 October, starting with the ones staff use for email and finance.
3. Buy year two only for PCs you can't replace or upgrade in time, and record why and until when.
4. Order replacements for older devices and set a date for each. Our hardware and leasing page covers options to spread the cost.
5. Book a free IT health check if you'd like us to produce the device list for you.