Windows 10 End of Support: A Small Business Action Plan

Windows 10 support ended on October 14, 2025. A business PC still running it gets no security fixes unless it is enrolled in Microsoft’s paid Extended Security Updates (ESU) program, and the second, more expensive ESU year for businesses starts on October 14, 2026. The practical plan: list every Windows 10 PC, upgrade the ones that qualify for Windows 11 (the upgrade is free), and replace, cover, or repurpose the rest on a schedule you choose.

This guide was last checked against Microsoft’s own pages in September 2026.

What does “end of support” mean in practice?

The computer keeps working. That is what makes this easy to ignore. According to Microsoft’s Windows 10 end of support page, what stopped on October 14, 2025 is:

• Security updates. Newly discovered flaws in Windows 10 are no longer fixed on unenrolled PCs. Each month that passes adds to the list of known, published weaknesses.
• Bug fixes and feature updates. If something in Windows itself breaks, it stays broken.
• Microsoft technical support for Windows 10.

Two related dates matter for an office:

• Microsoft 365 apps (Outlook, Word, Excel) keep getting security updates on Windows 10 until October 10, 2028, but no new features, and Microsoft says performance and reliability issues may appear over time.
• Other software vendors set their own timelines, and some have already dropped Windows 10 from their supported lists. Check the system requirements page for each program your business depends on.

An unpatched PC is not certain to be attacked. It is simply a machine whose known weaknesses will never be closed, connected to the same network as your files, email, and banking.

Which Extended Security Updates program applies to a business?

There are two ESU programs, and they are easy to confuse.

The consumer program is for personal PCs. Microsoft extended it in June 2026, and it now runs through October 12, 2027. Enrollment is free if the PC syncs its settings to a Microsoft account, or costs 1,000 Microsoft Rewards points or a one-time $30. Microsoft states that this program “can’t be used in commercial scenarios,” and it is not offered on PCs joined to an Active Directory domain, joined to Microsoft Entra ID (the sign-in system behind Microsoft 365), or enrolled in device management. If your office PCs sign in with work accounts, this is not your program.

The business program is what Microsoft intends for companies of any size. Details from Microsoft Learn, as of September 2026:

ESU year	Coverage dates	List price per device
Year 1	October 15, 2025 to October 13, 2026	$61
Year 2	October 14, 2026 to October 12, 2027	$122
Year 3	October 13, 2027 to October 10, 2028	$244

Things to know before buying:

• It is cumulative. If you join in year two, you also pay for year one. A PC enrolled for the first time this October costs $183 at list price, and all three years total $427.
• Minimum purchase is one license, bought through Microsoft Volume Licensing or a Cloud Solution Provider (a Microsoft reseller). It is sold by the year, not by the month.
• The PC must run Windows 10 version 22H2.
• It covers critical and important security updates only. No new features, no general technical support.

At those prices, ESU makes sense for a specific PC with a specific reason to stay on Windows 10 for a defined period. It rarely makes sense as a plan for a whole office.

How do I check whether a PC can run Windows 11?

The Windows 11 minimum requirements are a compatible 64-bit processor with two or more cores, 4 GB of memory, 64 GB of storage, UEFI firmware with Secure Boot, and TPM 2.0. TPM (Trusted Platform Module) is a security chip that stores encryption keys. The processor must also be on Microsoft’s supported processor lists, which is the requirement that rules out most older PCs.

To check one PC:

1. Open Settings > Update & Security > Windows Update. An eligible PC usually shows an offer to upgrade to Windows 11.
2. If there is no offer, install Microsoft’s PC Health Check app and select Check now. It tells you whether the PC qualifies and, if not, which requirement failed.
3. To check the TPM yourself, press Windows key + R, type tpm.msc, and press Enter. Look for “Specification Version: 2.0”. If the window says no TPM was found, the chip may only be switched off in the firmware settings, which can often be turned on.

The result usually sorts each PC into one of three groups:

Result	What it means	Typical next step
Eligible	Meets every requirement	Free upgrade to Windows 11
Fails on a setting	TPM or Secure Boot is off, or the PC is low on memory or disk space	Change the setting or add memory, then recheck
Fails on processor	The CPU is not on Microsoft’s list	Replace, cover with ESU, or repurpose

It is technically possible to force Windows 11 onto unsupported hardware. Microsoft recommends against it and says such a PC is not entitled to receive updates, which defeats the purpose for a business.

What are the options for PCs that cannot run Windows 11?

Replace the PC. For a computer someone uses all day, this is usually the right answer. A PC that fails the processor check is old enough that a replacement is also faster and under warranty. Compare the $427 three-year ESU cost against the price of a new business desktop before paying to extend an old one.

Buy business ESU for a defined period. Reasonable when a PC runs equipment or software that is not yet ready for Windows 11, or when replacements need to be spread across two budget cycles. Write down the date the PC will be retired so the bridge does not become permanent.

Move the user to Windows 365. Windows 365 is a Windows 11 desktop that runs in Microsoft’s cloud and streams to almost any device. Microsoft includes ESU at no extra cost for a Windows 10 PC used to connect to a Windows 365 Cloud PC. As of September 2026, Windows 365 Business list prices run from $36.00 per user per month (2 vCPU, 8 GB memory, 128 GB storage) to $108.80 for the largest configuration. It costs more than ESU over time, but the user ends up on Windows 11 instead of a patched Windows 10.

Repurpose the hardware. An older PC can run a supported Linux release or Google’s ChromeOS Flex for a single job such as a lobby kiosk, a display screen, or a browser-only workstation. Our guide on whether a small business should use Linux covers where that fits and where it does not.

Take it off the network. A Windows 10 PC that only controls one piece of equipment and never touches email or the web can sometimes be isolated on its own network segment. This reduces the risk rather than removing it, and it needs to be set up deliberately.

Whatever you retire, erase the drive properly before it leaves the building.

A rollout plan that does not disrupt the office

1. Inventory. List every computer with its user, model, age, Windows version, and PC Health Check result. Include the machines people forget: the front desk, the conference room, the PC attached to a scanner or label printer.
2. List the software and devices each PC depends on. Check every vendor’s Windows 11 support statement. Older printers, scanners, and card readers are the usual sources of trouble, so look for current drivers.
3. Back up first. Confirm that files are in OneDrive, SharePoint, or another backup before touching a PC. Our business data backup guide explains what a working backup looks like.
4. Pilot on one or two PCs. Upgrade a PC belonging to someone patient who uses the main business software. Give it a few working days.
5. Upgrade in waves. Do a few PCs at a time, outside busy hours, and keep one known-good PC available in case a wave goes badly. The in-place upgrade keeps files and installed programs.
6. Order replacements early for the PCs that failed the check, and move those users in the same waves.
7. Decide the exceptions in writing. For any PC staying on Windows 10, record why, which protection it has (business ESU, Windows 365, or isolation), and its retirement date.
8. Finish the job. Wipe retired drives, update the inventory, and confirm every remaining PC is receiving updates. A patch management routine keeps you from landing here again with the next deadline.

What does this mean for insurance and compliance?

No major rule says “Windows 10 is prohibited.” The rules say you must manage known risks, and an operating system that no longer gets security fixes is a known risk.

• HIPAA. The Security Rule requires a risk analysis covering systems that hold patient information. An unsupported PC belongs in that analysis along with what you are doing about it. See our HIPAA IT guide.
• PCI DSS. Businesses that take cards must keep systems in the card environment patched against known vulnerabilities. A Windows 10 PC without ESU cannot meet that. See PCI DSS for small businesses.
• FTC Safeguards Rule. Tax preparers, mortgage brokers, and other covered financial businesses must assess and control risks to customer information. Our Safeguards Rule guide covers the details.
• Cyber insurance. Applications often ask whether you run unsupported software. Answer accurately and ask your broker how the policy treats it. An incorrect answer on an application can cause more trouble than the old PC. More in our cyber insurance guide.

When you do not need to rush

If every PC in the office already runs Windows 11 and receives updates, you are done. If a Windows 10 PC is enrolled in business ESU through October 2026, it is protected today, and your decision is whether to pay $122 for year two or retire it. A Windows 10 PC that is permanently offline and runs a single piece of equipment is a lower priority than anything that opens email.

Common mistakes

• Assuming the $30 consumer ESU covers office PCs that sign in with work accounts.
• Budgeting $61 per PC for a first enrollment in late 2026, when the cumulative price is $183.
• Upgrading everything in one weekend without checking printer, scanner, and line-of-business software support first.
• Forcing Windows 11 onto unsupported hardware and assuming it will keep receiving updates.
• Forgetting the PCs nobody sits at.

Common questions

Is it safe to keep using Windows 10 in a business?

Only with ESU, and only as a bridge. Without ESU, a Windows 10 PC receives no fixes for security flaws found after October 14, 2025. Antivirus software helps but does not repair flaws in Windows itself. A PC that opens email, browses the web, or reaches shared files should be upgraded, replaced, or enrolled in business ESU.

Can a business use the free consumer ESU?

Microsoft says the consumer program cannot be used in commercial scenarios, and enrollment is not offered on PCs joined to a domain, joined to Microsoft Entra ID, or enrolled in device management. It runs through October 12, 2027 for personal PCs. Businesses are expected to buy the commercial ESU through Volume Licensing or a Cloud Solution Provider.

How much does Windows 10 ESU cost for a business?

As of September 2026, Microsoft’s list price is $61 per device for year one, $122 for year two, and $244 for year three, ending October 10, 2028. The years are cumulative, so a PC first enrolled during year two costs $183. Reseller pricing can differ slightly from list.

Does the Windows 11 upgrade cost anything?

No. Microsoft offers the upgrade free for eligible PCs running a current version of Windows 10. The costs are time, any memory or storage upgrades, and replacing PCs that do not qualify. Files and installed programs are kept during an in-place upgrade, but back up first anyway.

Will my files and programs survive the upgrade?

An in-place upgrade through Windows Update keeps files, programs, and most settings. The usual problems are older printers and scanners without Windows 11 drivers and older line-of-business software. That is why a pilot on one or two PCs comes before the rest of the office.

How Coastal Growth Co. can help

We can inventory your PCs, run the eligibility checks, confirm your software and printers are ready, and carry out the upgrade in waves around your working hours. For PCs that cannot move yet, we can set up business ESU or Windows 365 and document the exceptions for your insurer or auditor. Scope and price are agreed before any paid work. See managed IT services for how ongoing support works, or tell us what you have through the contact page.