Commercial Windows 10 ESU Year 1 coverage ends on October 13, 2026. After that date, a Windows 10 PC at work only keeps getting security updates if it’s covered for Year 2 of Extended Security Updates, either paid or through one of the cloud options below. Microsoft’s list price for Year 2 works out to $122 per device, and a PC that never had Year 1 needs both years: $183. Here is how to count what you still have, spot the PCs that can’t move to Windows 11, and decide which ones are worth paying for.
Sources: Microsoft Lifecycle FAQ – Extended Security Updates (dates) and Microsoft’s Windows 10 ESU program page ($61 for Year 1, doubling each year).
What Windows 10 ESU covers, and what it costs
Windows 10 reached end of support on October 14, 2025. ESU is Microsoft’s paid bridge: critical and important security updates for up to three years. It doesn’t add features, fix non-security bugs, or include general technical support. It covers Windows 10 Enterprise, Education, and Pro used commercially, and the PC has to be on version 22H2. LTSC editions follow their own lifecycles and aren’t part of this program.
| Windows 10 ESU year | Coverage ends | US list price per device |
|---|---|---|
| Year 1 | October 13, 2026 | $61 |
| Year 2 | October 12, 2027 | $122 (plus $61 for Year 1 if you never bought it) |
| Year 3 (final) | October 10, 2028 | $244 |
The fine print matters for budgeting:
- It’s cumulative. You can’t skip a year. Microsoft says a Year 2 purchase requires Year 1 too, so a first-time buyer pays both.
- Whole years only. No six-month terms. The minimum purchase is one license.
- How it’s bought. Through Microsoft Volume Licensing or a Cloud Solution Provider (CSP) partner. You activate each PC with a Multiple Activation Key (MAK) from the Microsoft 365 admin center.
- List price, not your quote. Microsoft publishes $61 for Year 1 and says the price doubles each year; $122 and $244 are that math. Your reseller’s quote is what you’ll actually pay. Microsoft also announced a discounted option for PCs whose updates are managed with Intune or Windows Autopatch, so ask about it if you use those tools.
Step 1: Count the Windows 10 PCs you still have
Before you price Windows 10 ESU, get an accurate count. Use more than one source, because each tool misses something: Intune misses PCs that were never enrolled, and Active Directory keeps old computer accounts long after the hardware is gone.
- Intune: Devices > All devices, filter to Windows, and sort by OS version. Windows 10 builds sit below 10.0.22000 (22H2 is 10.0.19045); Windows 11 starts at 22000. Export the list.
- Microsoft Entra admin center: Devices > All devices shows OS type and version, and Download devices exports a CSV. Check the activity date so you don’t count retired PCs.
- Your RMM or inventory tool: Filter on the operating system name. Include machines that haven’t checked in recently, since those are often the forgotten ones.
- Active Directory (PowerShell):
Get-ADComputer -Filter 'OperatingSystem -like "Windows 10*"' -Properties OperatingSystem,OperatingSystemVersion,LastLogonDate | Select-Object Name,OperatingSystemVersion,LastLogonDate - One PC at a time: press Windows + R and run
winver, or open Settings > System > About. In PowerShell:Get-CimInstance Win32_OperatingSystem | Select-Object Caption, Version, BuildNumber
For PCs you already enrolled in Windows 10 ESU Year 1, run slmgr.vbs /dlv from an elevated prompt. Microsoft’s instructions say the output lists the ESU program name with a License Status of Licensed. That tells you which machines need a Year 2 key, and which ones have been missing patches since last October.
Step 2: Find the PCs that can’t run Windows 11
Microsoft’s Windows 11 requirements are the test:
- A compatible 64-bit processor (1 GHz or faster, two or more cores) on Microsoft’s supported processor list
- 4 GB of memory and 64 GB of storage
- UEFI firmware that is Secure Boot capable
- TPM version 2.0
- DirectX 12 graphics with a WDDM 2.0 driver, and a 720p display of 9 inches or more
The fastest way to check a whole fleet is Intune’s Windows feature update device readiness report (Reports > Windows updates > Reports). Pick Windows 11 as the target. Devices marked Replace device can’t upgrade, and the report also flags apps and drivers likely to cause trouble. It relies on Windows diagnostic data, so devices that don’t send it show as Unknown. For a single Pro PC, Microsoft’s PC Health Check app gives the same yes/no.
To spot-check a machine from an elevated PowerShell window:
Get-Tpmshows whether a TPM is present and ready.Get-CimInstance -Namespace root/cimv2/security/microsofttpm -ClassName Win32_Tpm | Select-Object SpecVersionshows the TPM version.Confirm-SecureBootUEFIreturns True (on), False (supported but off), or “not supported” on older BIOS systems.
Before you write a PC off: a TPM or Secure Boot “fail” sometimes just means the feature is switched off in firmware. An unsupported processor is different. No setting fixes that, so those PCs are your real Windows 10 ESU-or-replace list.
Step 3: Pay for Windows 10 ESU or replace? A decision table
| If the PC… | Lean toward |
|---|---|
| Passes the Windows 11 checks and its apps work | Upgrade now. Skip ESU. |
| Passes, but a business app isn’t confirmed on Windows 11 yet | Windows 10 ESU Year 2 for those PCs only, with a firm date to finish testing |
| Fails on CPU or TPM and is near the end of its life anyway | Replace. Use ESU only if the new PC can’t be ready in time. |
| Runs equipment or software the vendor supports only on Windows 10 | ESU while you get a written upgrade plan from the vendor |
| Is mostly a doorway to apps that could run in the cloud | Look at Windows 365 or Azure Virtual Desktop (see below) |
Do the Windows 10 ESU math per device, not per company. Twenty PCs that never had Year 1 cost 20 × $183 = $3,660 at list for coverage through October 12, 2027, and Year 3 would add $244 each. Put that next to the price of replacing the same machines before you decide.
The cloud route Microsoft documents
Microsoft lists ESU at no additional cost for Windows 10 virtual machines in Windows 365 Cloud PCs, Azure Virtual Desktop, and other Azure services. Physical Windows 10 PCs used to reach Windows 365 Enterprise Cloud PCs (or Windows 365 Flex Cloud PCs in dedicated mode) can also be entitled to Windows 10 ESU. The conditions: the PC must be Microsoft Entra joined or hybrid joined, the user must sign in with the same account at least once every 22 days, and IT must deploy a policy that turns on the ESU subscription check. That route only makes sense if Cloud PCs fit how your staff already work.
Common Windows 10 ESU mistakes
- Buying keys for PCs that aren’t on 22H2 with the prerequisite updates Microsoft lists (KB5066791, then KB5072653)
- Pricing Year 2 alone when those PCs never had Year 1
- Assuming ESU includes troubleshooting help. It covers only activation, installation, and problems caused by the updates themselves.
- Reimaging enrolled PCs without planning for the extra MAK activations that uses (Microsoft documents how to request more)
How LTS can help
Our job here is to make the October 13 decision with real numbers, not guesses.
- Windows 10 inventory review: We reconcile Intune, Entra, RMM, and Active Directory so you get one accurate count.
- Windows 11 readiness: We run the readiness checks and sort each PC into upgrade, ESU, or replace.
- Windows 10 ESU setup: We confirm prerequisites, then install and verify MAK keys on the PCs that need another year.
- Upgrades and replacements: We schedule the work around your business hours, as part of our managed IT services.
- Help for in-house IT teams: With co-managed IT, we take on the inventory and rollout while your staff keeps the day-to-day.
Not sure how many Windows 10 PCs you have left? Request a review and we’ll help you build the list before October 13.
Related: Managed IT services · Co-managed IT · Full service map · Contact