Year 1 of Microsoft’s paid Extended Security Updates (ESU) program for Windows 10 ends October 13, 2026. After that date, a business PC still running Windows 10 stops receiving security patches unless Year 2 coverage is purchased. If your office has Windows 10 machines, this week is the time to decide, PC by PC: upgrade, replace, or extend.
Quick answer: Microsoft’s Extended Security Updates program has kept Windows 10 business PCs patched since free support ended on October 14, 2025. Year 1 of that coverage ends October 13, 2026, and Year 2 (through October 12, 2027) is a separate purchase. The most important action this week: count your Windows 10 PCs and attach a decision to each one - upgrade to Windows 11, replace it, or buy Year 2 - before the coverage gap opens.
What happened?
Windows 10 reached the end of support on October 14, 2025, and free security updates stopped that day. Since then, the way for an ordinary business PC to keep receiving security fixes has been Microsoft’s paid ESU program, sold one year at a time. According to Microsoft’s Windows 10 ESU documentation on learn.microsoft.com, the coverage years are:
- Year 1: October 15, 2025 - October 13, 2026
- Year 2: October 14, 2026 - October 12, 2027
- Year 3 (final): October 13, 2027 - October 10, 2028
So October 13, 2026 is the last day a PC with only Year 1 coverage receives security updates. This is not a new attack or a surprise disclosure - it is a scheduled deadline Microsoft has documented for over a year. That is the good news for a small organization: the response is a planned decision, not an emergency.
Details from Microsoft’s documentation worth knowing before deciding:
- Pricing doubles each year. Microsoft lists Year 1 at $61 per device through the Volume Licensing Program and states that “the price doubles every consecutive year, for a maximum of three years” - putting Year 2 at $122 per device and Year 3 at $244.
- ESU is cumulative. Microsoft is explicit: “If you decide to purchase the program in Year Two, you have to pay for Year One too.” Joining at Year 2 costs $183 per device ($61 + $122).
- Whole years, patches only. ESU cannot be bought for a partial period, and technical support is not included.
- Eligibility requires Windows 10 version 22H2, plus Microsoft’s ESU licensing preparation package before the activation key works.
- Some machines are covered another way. Microsoft includes ESU at no additional cost for Windows 10 virtual machines in several of its own cloud services, including Windows 365 and Azure Virtual Desktop.
Why does this matter for small businesses?
For Pennsylvania small businesses and nonprofits, this deadline matters for three practical reasons.
Unsupported software is a recognized risk, not a technicality. CISA, the U.S. Cybersecurity and Infrastructure Security Agency, maintains a short catalog of “Bad Practices,” and the first entry is the use of unsupported (or end-of-life) software, which the agency calls dangerous and especially egregious for anything accessible from the internet. CISA’s warning is aimed at critical infrastructure, but the agency encourages all organizations to address these practices. A Windows 10 PC that stops receiving patches becomes exactly that kind of asset.
The consumer extension in the headlines does not cover business PCs. You may have read that Windows 10 updates for home users run to October 12, 2027 - free with Windows settings backup, or a one-time $30 purchase. That is the consumer program, and Microsoft states plainly that it “can’t be used in commercial scenarios.” Enrollment is not even offered for PCs joined to a company domain or Microsoft Entra, or enrolled in device management software - which describes most office machines.
The math favors a decision over a subscription. At $122 per device for Year 2 (or $183 if Year 1 was skipped), ESU is a bridge, not a destination - Microsoft describes it as a temporary bridge to a supported platform, and it ends for good on October 10, 2028. For a PC that can run Windows 11, Microsoft’s recommendation is to upgrade it. For one that cannot, the honest comparison is between $122-183 for another year of patches and putting that money toward a replacement.
One wrinkle for Microsoft 365 shops: Microsoft will keep sending security updates for Microsoft 365 Apps on Windows 10 through October 10, 2028, but feature updates stop at Version 2608, and Microsoft warns that running its apps on an unsupported operating system can cause performance and reliability issues. Outlook and Excel keep opening; the PC underneath them is what goes dark.
What should you do this week?
-
Count your Windows 10 PCs - including the hidden ones. On any PC, press the Windows key and R, type
winver, and press Enter to see the version. If your machines are managed, your IT provider can pull a report listing every Windows 10 device at once. Look where Windows 10 hides: the front-desk machine, the conference-room PC, spare laptops that still sign in to email, home computers used for work, and PCs attached to equipment or printers. -
Check each one for Windows 11 eligibility. Microsoft’s free PC Health Check tool reports whether a PC meets the Windows 11 hardware requirements and explains why if it does not. In our experience, the processor and the TPM security chip are what hold older business PCs back.
-
Attach a decision to every PC: upgrade, replace, or extend. Upgrade eligible machines to Windows 11 - Microsoft’s recommended path. Replace the ones too old to be worth $122-183. Buy Year 2 only for genuine exceptions: a PC tied to software or equipment not yet supported on Windows 11, or one already budgeted for replacement next year.
-
If you are extending, buy Year 2 now and confirm it is activated. Each coverage year is its own purchase - a PC activated only for Year 1 is not covered by Year 2 automatically.
-
Write the plan down. The PCs you extend this year are next year’s replacement list. No business ESU is sold after October 10, 2028, so every Windows 10 PC eventually gets upgraded or retired.
Frequently asked questions
Do our Windows 10 PCs stop working on October 13, 2026? No. Microsoft’s documentation is explicit that Windows 10 PCs keep working after support ends. What stops is security patches: October 13, 2026 is the last day of Year 1 of the paid business Extended Security Updates program, and a PC with Year 1 and nothing after it receives no further security fixes unless Year 2 is purchased and activated.
Can our business use the consumer Windows 10 extension that runs to October 2027? No. Microsoft states the consumer ESU program “can’t be used in commercial scenarios,” and enrollment isn’t offered for PCs joined to an Active Directory domain or Microsoft Entra, or enrolled in device management software - which describes most business PCs. The consumer program (free with Windows settings backup, or a one-time $30 purchase, through October 12, 2027) is for home machines only.
How much does Windows 10 ESU Year 2 cost? Microsoft lists business ESU at $61 per device for Year 1 and states the price doubles every consecutive year, which puts Year 2 at $122 per device. Because ESU is cumulative, a business that skipped Year 1 and joins in Year 2 pays for both years - $183 per device for coverage through October 12, 2027. Microsoft sells ESU by the whole year only.
Will Microsoft 365 apps keep working on Windows 10? For now, yes. Microsoft will keep sending security updates for Microsoft 365 Apps on Windows 10 through October 10, 2028, but feature updates stop at Version 2608. Microsoft also warns that running its apps on an unsupported operating system can cause performance and reliability issues, and says those devices should move to Windows 11.
What is the single most important thing to do this week? Count your Windows 10 PCs and put each one into one of three buckets: upgrade to Windows 11 (Microsoft’s recommended path for eligible PCs - its PC Health Check tool confirms eligibility), replace it if it is too old to upgrade, or buy and activate ESU Year 2 if it must stay on Windows 10 a while longer. A PC with no decision attached to it is the one that quietly stops getting patched.
Where Merit IT fits in
Deadlines like this one do not require panic - they require a list and a decision per machine. That is ordinary, ongoing IT work: knowing what is on your network, what is patched, and what is approaching end of life. That is the core of our IT support practice - patching, monitoring, and lifecycle management that keeps the lights on. And when a machine needs replacing, our Microsoft 365 and deployment team handles hardware procurement and Windows 11 migrations so the swap is a scheduled event, not a scramble.
We work with small businesses and nonprofits across Pennsylvania, month-to-month - no long-term contract. We earn your business every single month, or we don’t.
Get a free technology assessment - we will count your Windows 10 machines, check Windows 11 eligibility, and give you a plain-English plan with real numbers for each PC. No obligation, no pressure. Or keep reading on the Merit IT blog for more practical, no-hype IT guidance.