Windows 10 End of Life, One Year On: What Still Gets Updates and How IT Teams Finish the Move

Updated: November 2026

A year after support ended, Windows 10 still runs on desks, kiosks and the one PC in accounting nobody wants to touch. Some of those devices still get security fixes and some don't, and the dates that decide which keep moving. This Windows 10 end of life guide sorts them device by device, so each one gets a supported path.

TL;DR

• The date. Windows 10 reached end of life on 14 October 2025, so PCs outside ESU get no security updates.
• Still covered. Consumer ESU runs to 12 October 2027, commercial ESU to October 2028, and LTSC on its own dates.
• The cost. Commercial ESU starts at $61 per device and doubles yearly, so three years cost $427.
• The move. Find every Windows 10 device, sort it by why it's still there, and fix each group its own way.

When Windows 10 Reached End of Life (and What's Still Supported)

Windows 10 support ended on 14 October 2025, for Home, Pro, Enterprise and Education alike. Version 22H2 was the last release. Microsoft's end of support page puts it plainly: no technical support, no software updates, no security fixes.

That's the headline date, and it's the one that matters least now. A year on, what you need is the date for each piece: the OS edition, the ESU program it sits in, and the apps on top. Here is where each stands, checked against Microsoft's lifecycle and support pages on 4 November 2026.

The Microsoft 365 Apps and OneDrive dates come from Microsoft's page on Office on Windows 10, which also says no new features arrive during that time.

The Edge date sits on Microsoft's Edge supported systems list, which notes that Edge updates don't need ESU.

Servers run on their own clock. If the same team looks after a server room, the next deadline there is Windows Server 2016 in January 2027.

What End of Support Means for a Windows 10 PC

Nothing breaks on the day. The PC boots, apps open, files sync. Microsoft's own FAQ says the software "will continue to function".

What stops is the maintenance. No monthly security update, no quality fix, no feature update, and no help from Microsoft support if something goes wrong. Windows doesn't throw an error when this happens. Updates just stop arriving, which looks a lot like a device that's simply up to date.

The first visible change is the gap. Every Patch Tuesday adds fixes to Windows 11 and to ESU devices that a Windows 10 PC outside ESU never receives. The PC doesn't get worse on its own; its distance from a patched machine grows by one month, every month.

The apps on top drift on their own timelines. Microsoft 365 Apps keep running and get security fixes to October 2028, but no new features. Office 2016 and 2019 are already out of support on every OS. Third-party vendors set their own dates, so check your line-of-business apps one by one rather than assuming.

Antivirus doesn't close the gap either. Microsoft's end of support hub says antivirus "can help" but is "not enough on its own", because the operating system itself stays exposed.

One more trap: ESU only covers version 22H2. A PC still on 21H2 or older was already out of support before October 2025, and it needs the 22H2 update before ESU can cover it. Run winver to check.

Can You Still Use Windows 10?

Yes. Windows 10 still works, and with ESU on version 22H2 it still gets critical and important security fixes. Without ESU it gets none, so the safe use cases shrink to devices you can keep off the internet.

Is It Safe to Use Windows 10 in 2026?

On ESU, it's patched against the issues Microsoft rates critical or important. Outside ESU, it's unpatched against anything found since October 2025, and that list grows every month. A Windows 10 PC with no ESU that browses the web and opens email is the one to fix first.

Why Some PCs Never Moved to Windows 11

The reasons tend to be concrete. The hardware fails the Windows 11 check: no TPM 2.0, a processor off Microsoft's supported list, or Secure Boot that isn't possible on the firmware. A line-of-business app isn't certified yet. The device is a kiosk or a lab machine that nobody wants to rebuild. Or the user asked for "after the busy season" four busy seasons in a row.

This video walks through the October 2027 consumer extension and shows how to check, in a couple of minutes, whether a PC is enrolled in ESU and whether it qualifies for Windows 11:

Windows 10 Extended Security Updates: Who Gets Them and What They Cost

Extended Security Updates (ESU) is Microsoft's paid bridge for Windows 10, version 22H2. It delivers critical and important security fixes, as rated by the Microsoft Security Response Center. It doesn't bring features, non-security fixes or technical support. There are three routes in, and which one a device can take depends on who owns it.

The consumer program got longer this year. Microsoft's consumer ESU page now says enrollment stays open until 12 October 2027, and devices already enrolled carry over to that date with no action needed. The original end date was 13 October 2026, and the change landed with little fanfare:

The extension is consumer-only. A domain-joined or Intune-managed laptop can't take the $30 route, so it needs commercial ESU. Microsoft's ESU overview sets the price at $61 per device for year one, doubling every year, and adds a catch: ESU is cumulative. Year one started in November 2025, so a device you enroll this month pays for year one and year two together.

Here's the arithmetic per device. One device costs $61 for year one, $122 for year two and $244 for year three. Enroll now and coverage to October 2027 costs $183 per device. Keep it to October 2028 and the total is $427.

For a 25-device fleet, that's $4,575 now and $10,675 for the full run. For 200 devices, it's $36,600 now and $85,400 by October 2028. Year three alone, at $244, is the most expensive year of the three, and it buys patches for a device you still have to replace.

Windows 365 changes the math for some users. Windows 365 Business with 2 vCPUs, 8 GB and 128 GB costs $36 per user a month on Microsoft's Windows 365 pricing page (monthly plan, 4 November 2026), or $432 a year. That's more than ESU for one PC, but it buys a Windows 11 desktop and covers ESU on the Windows 10 device the user connects from, for up to three years.

Microsoft's 2024 announcement also described a $45 year-one price for devices managed by Intune or Windows Autopatch. The current ESU overview lists only $61, so ask your licensing partner which one applies. The full enrollment walkthrough, including activation keys and the cloud routes, gets its own page: our upcoming Windows 10 ESU guide.

Windows 10 LTSC and IoT End of Life Dates

Long-Term Servicing editions skip ESU entirely. Microsoft's ESU setup guide says LTSB and LTSC releases have their own lifecycles and aren't covered by the program. They were built for devices that shouldn't change: medical carts, point-of-sale terminals, factory controllers.

Two surprises sit in that table. LTSC 2021 ends before LTSC 2019, because Microsoft cut the Enterprise LTSC term from ten years to five with that release; the dates are on the LTSC 2021 lifecycle page. And 2016 LTSB went unsupported a month ago, so any kiosk still on it is now outside support.

IoT Enterprise LTSC 2021 is the last Windows 10 with updates into the next decade. It's licensed through device makers for special-purpose hardware, so it isn't a way to keep office PCs on Windows 10.

The usual next stop for these devices is Windows 11 Enterprise LTSC 2024, which Microsoft's release information lists with updates to 9 October 2029, or IoT Enterprise LTSC 2024 to 10 October 2034. One planning note: Intune feature update policies don't support LTSC editions, so these devices move through update rings or an in-place upgrade instead.

Check which edition a kiosk runs before you plan anything. winver shows "Windows 10 Enterprise LTSC" on those builds, and the Caption field from the PowerShell line in the next section shows it too.

Find Every Windows 10 Device Still in Your Fleet

Every upgrade plan starts with a list. And here's the catch that trips people up: Windows 11 still reports itself as version 10.0. There is no spoon; there is a build number. Windows 10 22H2 is build 19045. Windows 11 starts at build 22000, and 25H2 is 26200.

If the devices are in Intune, start with the Windows feature update device readiness report: Reports, then Device management, then Windows updates, then the Reports tab. Pick Windows 11 as the target and it rates each device low, medium or high risk, flags app and driver issues, and marks hardware that can't upgrade as "Replace device". It needs Windows diagnostic data turned on, per Microsoft's compatibility reports docs. A compliance policy with a minimum OS version of 10.0.22000 flags any Windows 10 device that enrolls later.

On a single PC, or pushed to a group of them, one PowerShell line tells you which Windows it is:

powershell
Get-CimInstance Win32_OperatingSystem | Select-Object CSName, Caption, Version, BuildNumber

In a domain, Active Directory has a rough list already. It's only as fresh as each computer's last logon, so read LastLogonDate before you trust it:

powershell
Get-ADComputer -Filter 'OperatingSystem -like "Windows 10*"' -Properties OperatingSystem, OperatingSystemVersion, LastLogonDate |
  Select-Object Name, OperatingSystem, OperatingSystemVersion, LastLogonDate

With osquery on the endpoints, the os_version table answers the same question for every device at once. The build column is text, so cast it:

sql
SELECT name, version, build FROM os_version WHERE CAST(build AS INTEGER) < 22000;

OpenFrame's AI agent, Mingo, reads endpoint state through osquery, so you can ask it which devices still run Windows 10 and get the list back; OpenFrame costs $1 per device a month with 10M AI tokens included, and there's a 14-day free trial. Flamingo builds OpenFrame, which competes with some of the tools mentioned here.

Then sort the list by why each device is still there. Four reasons cover the stragglers: hardware that fails the Windows 11 check, an app that isn't certified, a kiosk or LTSC device that's Windows 10 on purpose, and a user who keeps deferring. Before you file a PC under "hardware", check the firmware: a TPM that's switched off looks the same as a missing one, and our guide to turning on TPM 2.0 shows how to check it across a fleet.

Write the result down as one table: device name, build, ESU status, group and a target date. That table is the plan, the audit evidence and the client report in one place, and every section below works from it.

Your Options by Device Group

Each group gets a different fix, and a deadline. Here's the short version, with the cost each path adds:

Replacing hardware fits inside your refresh cycle. If the fleet already runs on a refresh plan, our guide to IT asset lifecycle covers how to time it.

Moving a user to Windows 365 or Azure Virtual Desktop keeps the old PC as a thin screen. The user works on a supported Windows 11 desktop in the cloud, and Microsoft covers ESU on the Windows 10 device they connect from for up to three years.

Repurposing works for kiosks and spare machines. The community campaign End of 10 walks people through putting Linux on older PCs and lists local repair groups that help. For a business, that usually means a Linux thin client pointed at a remote desktop, not a full desktop migration.

One path that's off the table: forcing Windows 11 onto hardware that fails the check. Microsoft's unsupported hardware page says such a PC "won't be entitled to receive updates", and damage isn't covered by the maker's warranty. That's a fleet of devices with no update guarantee, which is the problem you started with.

Upgrade to Windows 11 at Scale

Pick the target version first, because one of them already ran out. Windows 11 24H2 Home and Pro stopped getting updates on 13 October 2026. Microsoft's Windows 11 release information lists the two versions worth landing on:

26H2 gives the longest runway. 25H2 has a year of fixes behind it. Either is a supported target; just don't land Pro devices on 24H2.

Start with a pilot ring. Put IT's own machines in it, plus one or two users from every app group you found in the sort. Give it a week or two of real work before the broad ring follows.

In Intune, a feature update policy sets the target version and holds devices there, with rollout options to spread the upgrade over days. Microsoft's feature updates docs list the requirements: Intune Plan 1, a Windows license that includes the Autopatch entitlement, Entra joined or hybrid joined devices, and diagnostic data set to at least Required. Windows Autopatch builds the rings for you if you'd rather not run them by hand.

If you're weighing Intune against an RMM for this work, our Intune review compares the two for MSPs and IT teams.

This walkthrough shows a 26H2 feature update policy end to end, from creating it to assigning a group and watching the status:

Outside Intune, setup.exe from the Windows 11 media does the same job from a script. Run the compatibility scan first; Microsoft's Setup command-line options say it exits with 0xC1900210 when there's nothing in the way and 0xC1900208 when something blocks the upgrade:

powershell
.\setup.exe /auto upgrade /quiet /eula accept /compat scanonly

Collect the exit codes, fix what the scan flags, then run the real upgrade on the devices that came back clean:

powershell
.\setup.exe /auto upgrade /quiet /eula accept /dynamicupdate enable

An in-place upgrade keeps apps, settings and files, so the user signs back in to the same desktop. Devices you replace need their files moved first. Microsoft points home users at Windows Backup; in a business, OneDrive's known folder backup or your existing profile tooling does the same job before the old PC is wiped.

If you still push feature updates through WSUS, plan around its deprecation; our WSUS guide covers what replaces it.

Some upgrades will roll back. A 0xC1900101 rollback usually points at a driver, and our 0xC1900101 guide walks through it.

For any other code, start with Windows Update errors and read the code before you reset anything.

If an upgraded PC asks for its BitLocker key on the first restart, that's expected after some firmware and boot changes. Our guide to the BitLocker recovery key shows where to find it.

Compliance and Insurance After End of Life

An unsupported OS shows up in audits, and each framework words it differently. The fix is the same in every case: a list of Windows 10 devices, the coverage each one has, and a dated plan for the rest.

PCI DSS is the most specific. Requirement 6.3.3 in version 4.0.1 asks that system components be protected from known vulnerabilities by installing applicable security patches, with patches for critical vulnerabilities installed within one month of release. A Windows 10 PC with no ESU has no patches to install, so it can't meet that inside the cardholder data environment. The standard itself is in the PCI SSC document library.

HIPAA asks for analysis rather than a deadline. The Security Rule at 45 CFR 164.308 requires "an accurate and thorough assessment of the potential risks and vulnerabilities" to electronic health data, then security measures that bring those risks down to "a reasonable and appropriate level". Windows 10 devices that touch patient data belong in that risk analysis, along with ESU status and a replacement date.

Cyber Essentials is the strictest on paper. The NCSC's requirements for IT infrastructure (v3.3, April 2026) say all software on in-scope devices must be licensed and supported. Unsupported software has to come off the device, or the device moves into a separate sub-set that blocks all internet traffic. Ask your certification body how it treats ESU-enrolled devices before the assessment, not during it.

Cyber insurance renewals are the fourth place it comes up. If a renewal is due, look for a question on unsupported operating systems in the application and answer it from the inventory you built above. Your broker can tell you how the insurer treats devices on ESU.

Auditors and underwriters ask for evidence, not intent. The device table from the inventory section, with ESU activation status and a replacement date for each device, answers all four.

Windows 10 End of Life for MSPs

Some clients said "next quarter" for two years, and their devices are still on Windows 10. The r/sysadmin thread below ranks on page one for "windows 10 end of life". The poster asks whether to charge extra for the old devices, set a hard cutoff, or let the client carry the risk, and the replies argue all three.

ESU makes the first option workable. Commercial ESU has been available through CSP partners since 1 September 2025, per Microsoft's Windows IT Pro Blog, so it can sit on the client's own tenant next to their other licenses. Each device then needs prerequisites KB5066791 and KB5072653, the ESU key installed with slmgr /ipk, and activation with slmgr /ato against the Year 1, Year 2 or Year 3 activation ID. Script it across the client and collect the output; a device that's paid for but never activated looks exactly like one that was never enrolled.

Price it into the agreement as two lines: the license, passed through at cost or with your usual margin, and the work of activating and tracking each device every year. Give coverage an end date. "ESU until the device is replaced or October 2028, whichever comes first" is a clause the client can plan around.

Then have the conversation that ends with a refresh plan. Bring three things: the device list sorted by group, the ESU cost by year for their fleet, and a date for each group. Year three alone costs $244 a device, which makes the case for replacing hardware before October 2027 on its own. Internal IT teams have the same conversation with finance, with the same three pages.

Set the support stance for whatever stays on Windows 10 without ESU, too. Best effort, no security guarantee, written into the agreement. If the client also has servers past their date, the Server 2012 R2 options follow the same logic.

What to Read Next

Windows 10 end of life a year on comes down to three dates and one list. Consumer ESU ends 12 October 2027, commercial ESU in October 2028, and LTSC 2021 in January 2027. The list is every Windows 10 device you manage, sorted by why it's still there, with a path and a date next to each.

Once the upgrades are moving, the devices that keep failing them are the same ones your patch compliance report flags month after month. That's where to look next.

If you're choosing a tool to run upgrades and patches across devices, our roundup of patch management software compares 11 options and who each one fits.