Windows 10 ESU Year One Has Ended: Options for the Sites Left Behind

We warned about the deadline back in September; this is the piece for organisations reading it in hindsight. Windows 10's free support ended in October 2025, the first paid year of Extended Security Updates has now lapsed with October 2026, and consumer ESU is finished entirely. Plenty of multi-site fleets still have a Windows 10 tail: the regional sites the migration never reached, the devices too old for Windows 11, the POS lanes nobody wanted to touch before peak trading. The tail is now the risk register.

What "unsupported" means at estate scale

An unpatched operating system in one office is a vulnerability. Across a distributed estate it is a standing invitation, replicated at every site, reachable through every network the estate touches, and increasingly visible to cyber insurers, auditors and enterprise customers who ask pointed questions about supported software. The cost of the tail is not hypothetical breach headlines; it is the compounding operational drag of running a two-standard estate, where every process, image and support call forks into "Windows 11 sites" and "the others".

The four options left

1. Buy ESU year two. Commercial ESU pricing doubles each year by design; Microsoft is not selling a product, it is administering an incentive. Year two is defensible as a bridge for a fleet already mid-migration, with an end date attached. As a strategy, it is renting a delay at rising rates.
2. Migrate the capable devices. Hardware that meets Windows 11 requirements needs an SOE build and a visit, or a managed remote upgrade where the estate's connectivity allows. This is the cheap half of the problem, and the half most organisations should finish first and fastest.
3. Replace the incapable devices. The remainder is a hardware refresh wearing a software deadline, staged, kitted and run like any national desktop rollout, just with less calendar than the textbook recommends. Late programs still benefit from doing this properly; a rushed rollout that creates a new inconsistent estate simply schedules the next crisis.
4. Retire and consolidate. Some of the tail should not be replaced at all. End-of-life devices exit through sanitised disposal and remarketing, recovering value and closing the security file on each serial number.

The realistic answer for most estates is all four in proportion: a thin ESU bridge, aggressive migration of the capable, a disciplined replacement wave for the rest, and an honest retirement list.

Move before the next deadline moves you

The uncomfortable lesson of the ESU cycle is that it will repeat; operating systems now come with published funerals. Estates that maintain a live view of hardware capability against the next requirement set, and refresh in planned annual waves rather than deadline surges, never meet this problem again. That is the program worth budgeting now, while the current one is still teaching the lesson.

Still carrying a Windows 10 tail? Speak to an expert.