Windows 10 ESU year one has ended: what should businesses do?

Microsoft ended Windows 10 support on October 14, 2025. After that date, the only official way to keep receiving security updates was the paid Extended Security Updates (ESU) programme. Its first year ended on October 13, 2026.

Business devices enrolled in ESU stop receiving updates again unless year two is purchased and activated on each device. This article summarises the order of decisions for your remaining Windows 10 PCs.

1. Get the timeline straight

• October 14, 2025: standard Windows 10 support ended.
• October 13, 2026: ESU year one ended.
• October 12, 2027: ESU year two ends.
• October 10, 2028: ESU year three, the final year, ends.

ESU covers critical and important security fixes only; it includes no new features or general technical support. Organisations that join late also pay for previous years, so waiting does not lower the cost.

2. Build the inventory

List which devices still run Windows 10, who owns them and what they are used for. Intune, Configuration Manager or an RMM tool produces this list in minutes. Without an inventory, both ESU licensing and the migration plan are guesswork.

3. Split devices into three groups

• Upgradeable: devices with TPM 2.0 and a supported CPU can move straight to Windows 11.
• To be replaced: devices whose hardware does not meet Windows 11 requirements.
• Dependent: devices that must stay on Windows 10 because of a legacy application, machine software or driver.

ESU only makes sense for the third group and for devices whose replacement is delayed.

4. Test application compatibility

ERP clients, accounting software, label printer drivers and production line software cause the most trouble. Try each critical application on a pilot Windows 11 device and get a support statement from the vendor.

5. Contain the devices that stay on Windows 10

Reduce the risk for every device left on Windows 10, with or without ESU: move it to a separate VLAN, limit internet access to required addresses, make sure EDR is installed and remove local admin rights. Microsoft 365 apps keep receiving security updates on Windows 10 until October 10, 2028, but operating system vulnerabilities stay open.

6. Migrate in waves, not all at once

Start with upgradeable devices, then spread hardware replacement across budget periods. With Windows Autopilot and Intune, new devices can be shipped directly to users and set up with company settings on first boot.

Let's plan the migration together

At Bilgi Teknoloji we run inventory, compatibility testing, device management with Microsoft 365 and Intune and endpoint security as a single project.