Windows 10 ESU Ends October 2026: The Multi-Site Migration Plan

Windows 10's polite grace period is closing. Mainstream support ended in October 2025; the consumer Extended Security Updates bridge runs out in October 2026; and commercial ESU, for those who keep paying, escalates in price each year (roughly US$61 per device in year one, doubling annually) before ending entirely in 2028. For a 2,000-device estate, year-two ESU is a six-figure bill for the privilege of standing still.

If your branch, store or office fleet still runs Windows 10 in mid-2026, the migration is no longer a roadmap item. It's this financial year's project, and the deadline maths gets worse every quarter you wait.

Why multi-site fleets are the hard case

A head-office fleet migrates over a few weekends. A fleet spread across 200 stores or branches migrates like any other multi-site rollout: audits, staging, waves, field crews and trading-hour windows. The organisations in trouble in 2026 are mostly the ones who treated a distributed migration like a desktop task.

Add the hardware wrinkle: a meaningful slice of Windows 10 fleets can't run Windows 11 at all (TPM and CPU requirements), so the migration is partly a hardware refresh, with freight, installs and old-fleet disposal attached. Devices that retire now still carry remarketing value; the same devices in 2028 carry recycling fees.

The plan that works at fleet scale

1. Audit for eligibility, honestly. Which devices upgrade in place, which need replacement, which run line-of-business apps that need compatibility work. This split drives the whole budget, and estates guess it wrong constantly. Real fleet data or a structured audit, not vendor spreadsheets from 2022.

2. Build the Windows 11 SOE first. One standard build, tested against your hardware models and application set. Migrating without an SOE just relocates your chaos onto a newer OS.

3. Migrate in waves, staged centrally. In-place upgrades push overnight where hardware allows; replacement devices image at staging and swap through field visits, wave by wave, around trading calendars. The refresh-cycle logic applies directly, this is a refresh with a regulatory deadline.

4. Buy ESU only as a bridge, with an end date. Commercial ESU is a legitimate tool for the tail of a migration in flight. It's a ruinous tool for avoiding one: escalating fees, security-only coverage, and cyber insurers increasingly treating end-of-life systems as coverage exclusions.

The insurance angle nobody budgets

Cyber policies commonly require supported, patched systems. An incident on an out-of-support fleet is an incident your insurer may decline, which prices the "do nothing" option rather differently than the ESU invoice alone. The migration isn't an IT preference; it's a risk-transfer requirement with a date on it.

Fleet still on Windows 10 with sites everywhere? Speak to an expert.