Skip to content
Managed IT & Support

Windows 10 end of support: what to do a year later

Windows 10 support ended in October 2025. What Extended Security Updates cover and cost, what unsupported means, and whether to upgrade or replace.

Geidi Infrastructure Team6 min read

In brief

What it is
Windows 10 support ended on 14 October 2025, so a Windows 10 PC only gets security fixes through paid Extended Security Updates.
Who it affects
Organisations with Windows 10 machines still in use, such as the reception PC or the one running old accounting software.
What to do
List every Windows 10 device, check which are activated for ESU, and budget to replace them this financial year.
On this page
  1. What end of support actually means
  2. What Extended Security Updates cover
  3. The Windows 365 and cloud option
  4. Can the PC run Windows 11?
  5. Upgrade, replace or ESU?
  6. What to do this week
  7. Where Geidi fits
  8. Sources

Windows 10 reached end of support on 14 October 2025. A year on, plenty of organisations still have a few Windows 10 machines in the building: the reception PC, the one running the old accounting package, the laptop that "can't take Windows 11". If that's you, the machines still turn on and still work. The question is whether anything is still patching them.

For some of them, something is. Microsoft sells Extended Security Updates (ESU) for Windows 10, and the second ESU year starts on 14 October 2026. For the rest, every month that passes adds another set of known, unpatched holes.

What end of support actually means

Since 14 October 2025, Microsoft no longer provides security updates, fixes or technical support for Windows 10 unless the device is enrolled in ESU. Version 22H2 was the final release of Windows 10, so there's no newer Windows 10 to move to.

Nothing dramatic happens on the day. The problem builds up quietly. Each Patch Tuesday, Microsoft fixes vulnerabilities in Windows 11, and many of those same bugs exist in Windows 10. Once a fix ships, attackers can compare the patched and unpatched code and work out exactly what changed. An unsupported PC is a machine whose weaknesses are published every month and never repaired.

It also tends to fail other checks. Cyber insurance questionnaires ask about unsupported operating systems, and the Essential Eight expects operating systems that are no longer supported by the vendor to be replaced. (Our guide to Essential Eight maturity levels explains where that sits.)

What Extended Security Updates cover

ESU is a paid, yearly subscription that keeps delivering critical and important security updates, as rated by the Microsoft Security Response Center, to enrolled Windows 10 PCs. It does not include new features, general fixes or technical support. Microsoft only supports problems with activating and installing the ESU itself.

The details that matter:

  • Version: the device must be running Windows 10, version 22H2.
  • Editions: for organisations, ESU covers Enterprise, Education and Pro in commercial use.
  • Price: Microsoft lists ESU for organisations at US$61 per device for the first year through volume licensing, and says the price doubles each following year. Check current pricing with your licensing provider before budgeting.
  • Cumulative: you buy by the year, never part of a year. If you join in year two, you pay for year one as well.
  • Minimum: one licence. A small office can buy ESU for the two machines it can't replace yet.
  • Activation: each device needs its ESU key installed and activated before it receives updates. Buying the licence alone does nothing.

The coverage years, as published on Microsoft's lifecycle page and checked in October 2026:

  1. Year one ends on 13 October 2026.
  2. Year two runs to 12 October 2027.
  3. Year three, the last, ends on 10 October 2028.

There is no year four. ESU is a bridge, not a place to live.

The Windows 365 and cloud option

There's one twist worth knowing. Windows 10 devices used to connect to a Windows 365 Cloud PC are entitled to ESU at no extra cost for up to three years, as long as the Windows 365 subscription is active. Windows 10 virtual machines running in Azure Virtual Desktop also get ESU at no extra cost.

That makes Windows 365 a real option for some businesses. The user's actual desktop is a Windows 11 Cloud PC hosted by Microsoft, and the old Windows 10 laptop becomes a way to reach it while it stays patched under ESU. It suits staff who mostly work in Microsoft 365 and a browser. It suits people who need heavy local software, video editing or poor-internet locations much less.

Can the PC run Windows 11?

Microsoft's minimum requirements for Windows 11 are:

  • a compatible 64-bit processor, 1 GHz or faster, with two or more cores
  • 4 GB of RAM and 64 GB of storage
  • UEFI firmware with Secure Boot capability
  • TPM version 2.0
  • a DirectX 12 compatible graphics card with a WDDM 2.0 driver
  • a display larger than 9 inches with 720p resolution

The processor and the TPM are where older machines usually fail. On a Windows 10 PC, the free PC Health Check app will tell you whether it qualifies. Sometimes a machine fails only because TPM or Secure Boot is switched off in the firmware, which is a ten-minute fix rather than a new PC.

Meeting the minimum isn't the same as being pleasant to use. A laptop with 4 GB of RAM will run Windows 11 in the sense that it will boot.

Upgrade, replace or ESU?

A simple way to sort your fleet:

  1. Eligible and under about four years old: upgrade in place to Windows 11. It keeps apps and files, and Intune or Windows Autopatch can roll it out in stages.
  2. Eligible but tired (slow disk, 4 GB of RAM, flat battery): replace it. The labour to upgrade and then nurse an old machine often costs more than the difference.
  3. Not eligible: replace it, or move that user to a Windows 365 Cloud PC.
  4. Genuinely stuck because software or hardware only works on Windows 10: buy ESU for that machine only, isolate it on the network where you can, and put a date in the diary for fixing the real problem. ESU buys time to get a vendor upgrade or a replacement, not a reason to wait.

Whatever you choose, don't leave a Windows 10 machine on neither path. An unsupported PC with a staff member's email and saved passwords on it is exactly the easy door attackers look for.

What to do this week

  1. Get a list of every device still on Windows 10. Intune or your remote management tool can report it.
  2. For each one, record the version (it must be 22H2 for ESU), whether it passes PC Health Check, and who uses it for what.
  3. Check which ESU devices are actually activated and receiving updates. Paying for year one and forgetting to renew for year two is an easy mistake.
  4. Put the replacements into this financial year's budget, with ESU covering the gap.

Where Geidi fits

Our managed IT and support service includes a 7-day service desk and fixed-cost coverage of the devices and systems your business depends on, which covers planning and rolling out a move like this. If you're not sure how many Windows 10 machines you still have, talk to us.

Sources

More on Managed IT & Support

One partner for the whole environment.

Tell us about your existing IT. We would be pleased to review your current system and give you an overview as to how Geidi may be able to deliver and enhance your IT operations.

Book a consultationCall 1300 855 049