Windows 10 end of support: What to do if you’re still on Windows 10

Short answer: Windows 10 end of support was October 14, 2025, and PCs still running it have received no free security fixes since. They still turn on and the apps still open, which is why some are still in use a year later. Businesses can buy Extended Security Updates as a bridge, but the clock is running: year one of the business program ended October 13, 2026, and year two runs only through October 12, 2027.

Most of our clients have moved to Windows 11. We want every computer we support on it, and we’re working with the rest to upgrade or replace what’s left.

Windows 10 end of support timeline

Since October 14, 2025, Microsoft provides no technical support, feature updates or quality updates, including security fixes, for Windows 10. The risk grows every month. Verizon’s 2026 Data Breach Investigations Report found that exploiting vulnerabilities is now the most common way attackers get into networks, ahead of stolen credentials. An operating system without fixes collects known, unpatched holes over time.

Your options for the PCs that remain

Every remaining Windows 10 machine fits one of four paths.

Upgrade to Windows 11 for free

If a PC meets the hardware requirements, the upgrade is free. The key requirements are a compatible 64-bit processor with two or more cores, 4 GB of RAM, 64 GB of storage, UEFI firmware with Secure Boot, and TPM 2.0. Microsoft’s PC Health Check app will tell you whether a machine qualifies. The TPM requirement has a purpose: Microsoft notes that Windows Hello, BitLocker drive encryption and other security features rely on the TPM for key storage, encryption and boot integrity checks.

Replace the PC

Many machines from around 2018 and earlier don’t meet the processor or TPM requirements. A PC that old probably has a tired battery, an aging drive and no warranty, so replacement is usually the better investment. That is the path we took for our clients’ incompatible machines. Our guide to building an IT refresh plan helps you schedule the rest, and replacements may qualify under Section 179.

Buy Extended Security Updates as a bridge

Microsoft sells ESU to businesses through volume licensing, one year at a time, for up to three years after end of support. ESU delivers only critical and important security updates, with no new features, non-security fixes or general technical support. The cost doubles each year, and ESU is cumulative, so enrolling in year two means paying for year one too. Microsoft calls ESU a last-resort bridge. It makes sense for a handful of machines tied to equipment or software that can’t move yet.

Move to a cloud PC

Windows 10 virtual machines in Windows 365 and Azure Virtual Desktop receive ESU at no additional cost, and Windows 365 can deliver a Windows 11 cloud PC to almost any device. That can cover a few users on older hardware while replacements are scheduled.

What applies to business PCs now

Microsoft also runs a consumer ESU program, which it has extended through October 12, 2027, and it is tempting. Microsoft states it can’t be used in commercial scenarios. Devices joined to Active Directory or Microsoft Entra, or enrolled in mobile device management, aren’t eligible, and if an enrolled device is used commercially its consumer ESU enrollment is suspended. Business PCs need the commercial program.

Microsoft 365 Apps will keep getting security updates on Windows 10 until October 10, 2028, but feature updates stop at Version 2608. Microsoft support will ask you to move to Windows 11 if an issue only happens on Windows 10, and fixes for Windows 10-only bugs aren’t available. Patched apps don’t make the operating system underneath them safe. Our Microsoft 365 services can help you plan around this, and as a Microsoft CSP partner we can answer the licensing questions too.

If you keep client, patient or financial records, the bigger issue is documentation. Healthcare practices must assess risks to electronic protected health information under the HIPAA Security Rule, and financial firms covered by the FTC Safeguards Rule need a written risk assessment and safeguards to match. An unsupported operating system on a computer that touches patient or client data is exactly the finding those assessments should catch. If you keep a Windows 10 machine, document why, cover it with ESU and limit what it can reach. Cyber insurance applications commonly ask about unsupported software too, and a wrong answer can cause trouble at claim time. Our compliance services can help you document exceptions properly.

How to finish the move

1. Inventory every Windows 10 device, including the front desk PC, anything connected to lab or imaging equipment, and the laptop in the closet.
2. Check Windows 11 eligibility with PC Health Check or your management tools.
3. Test line-of-business apps and printers on Windows 11 before rolling out.
4. Make sure user files are backed up and synced to OneDrive or a server.
5. Upgrade eligible PCs a department at a time so issues stay small.
6. Replace the rest, and wipe old drives securely before disposal or recycling.
7. Buy ESU only for true exceptions, isolate them on the network, and set a firm retirement date.

A short list and a firm date will close this out for the last few machines in your office. Book a 15-minute call and we’ll help you sort which to upgrade, replace or cover, with lifecycle management tracking the rest.

Frequently asked questions