Windows 10 After ESU in 2026: Why the Free Year of Security Updates Just Ended, What Paid Extended Updates Actually Cost a Business, and How to Upgrade or Retire PCs That Fail the Windows 11 Check
- Equipo de Internet Pros
- October 23, 2026
- Redes y Seguridad
Este artículo está disponible solo en inglés.
On October 13, 2026, the last free security update for home and small office copies of Windows 10 shipped. The PCs still boot, the apps still open and nothing on screen looks different. But every Windows flaw found from now on stays open on those machines for good. If a few of them are still on your network, this is the month to decide what happens to each one.
How We Got Here
Microsoft ended mainstream support for Windows 10 on October 14, 2025. To soften the cutoff, it offered a one-year consumer Extended Security Updates (ESU) program. Home users could enroll for free by syncing settings with Windows Backup, by redeeming 1,000 Microsoft Rewards points, or by paying a one-time $30. That year is now over. Consumer ESU will not be extended, and a Windows 10 PC that relied on it no longer receives operating system patches.
Businesses have a separate, paid track. Commercial ESU runs for up to three years, through October 2028, and the price rises each year so that staying on Windows 10 gets steadily more expensive.
An unsupported operating system does not break on the day support ends. It keeps working while the list of known, unpatched holes grows every month.
Why an Unpatched PC Is a Liability
Attackers read Microsoft’s monthly security bulletins just like defenders do. Every Patch Tuesday from now on will fix flaws in Windows 11 code, and much of that code is shared with Windows 10. Each bulletin is effectively a list of ways into a Windows 10 machine that will never be fixed. The risk does not stay on that one PC. A compromised machine on the office network is a starting point for stealing credentials, spreading ransomware and reaching file shares.
There is a paperwork cost as well. Cyber insurance questionnaires, PCI DSS for card payments and HIPAA risk assessments all ask about supported, patched systems. An unsupported operating system can turn a claim or an audit into an argument.
What Still Gets Updates, and What Does Not
The end of support is not all-or-nothing, which confuses people. Here is where things stand for a Windows 10 PC without ESU:
| Component | Status without ESU | What it means |
|---|---|---|
| Windows security patches | Stopped | Kernel, networking, print and login flaws stay open |
| Microsoft Defender signatures | Continuing for now | Helps detect known malware, but cannot patch the system it protects |
| Microsoft 365 apps | Security fixes through October 2028 | Office stays patched, but Microsoft will not fix Windows 10 specific problems |
| Browsers such as Chrome and Edge | Still updated, for a limited time | Vendors drop old systems eventually, and a patched browser on an unpatched OS is still exposed |
| Technical support and new features | Ended | No help desk, no new drivers or features from Microsoft |
Antivirus that keeps updating is not a substitute for operating system patches. It recognizes known malware. It does nothing about a flaw in Windows that lets an attacker in without dropping a recognizable file.
What Commercial ESU Actually Costs
For organizations, ESU is priced per device and doubles each year: about $61 for year one, $122 for year two and $244 for year three. The years are cumulative. A business that joins now, in year two, must also pay for the year it skipped. That makes one PC cost roughly $183 for a single year of coverage, and over $400 to reach October 2028. That is more than many entry-level business laptops cost.
There are two exceptions worth knowing. Windows 10 machines used to connect to Windows 365 Cloud PCs or Azure Virtual Desktop receive ESU at no extra charge, and some education licences are heavily discounted. The LTSC (Long-Term Servicing Channel) editions used on kiosks, medical carts and factory PCs follow their own, longer support dates, so check those devices separately before you replace them.
Upgrade, Pay or Retire: Deciding PC by PC
Most offices find that their remaining Windows 10 machines fall into three groups.
- Eligible for Windows 11. Run Microsoft’s PC Health Check app, or check Windows Update. Windows 11 needs a supported 64-bit processor (roughly Intel 8th generation or AMD Ryzen 2000 series and newer), 4 GB of RAM, 64 GB of storage, UEFI with Secure Boot, and TPM 2.0. Many PCs fail only because TPM or Secure Boot is switched off in the firmware settings, which takes five minutes to fix. The upgrade is free and keeps files and apps.
- Ineligible, but running something that must stay. A machine that controls a lab instrument, a CNC router or a legacy accounting package may justify a year of ESU while the vendor certifies Windows 11. Isolate it on its own network segment, remove web browsing and email, and set a firm replacement date.
- Ineligible and ordinary. A five or six year old office PC is usually cheaper to replace than to cover with ESU, and the new one will be faster and support features like Windows Hello and modern encryption. Old hardware can get a second life on ChromeOS Flex or a Linux distribution such as Linux Mint for light web use, as long as it is wiped first.
Avoid the workaround of forcing Windows 11 onto unsupported hardware with registry changes or third-party tools. It often installs, but Microsoft says such PCs are not entitled to updates, and future feature updates can fail or stop arriving. You end up back where you started.
A One-Week Windows 10 Cleanup Plan
- Day 1: Inventory every PC with its Windows version, processor, TPM status and owner. Your RMM, Intune or a simple script can export this.
- Day 2: Enable TPM and Secure Boot in firmware where they are just switched off, and recheck eligibility.
- Day 3: Back up and upgrade the eligible machines. Confirm BitLocker recovery keys are stored before you start.
- Day 4: Price replacements for the rest, and buy ESU only for machines with a documented reason to stay.
- Day 5: Isolate any remaining Windows 10 PCs, and securely wipe the ones you retire before recycling or donating them.
En resumen
The free extra year for Windows 10 is over, and paid coverage for businesses only gets more expensive from here. For most offices the cheapest secure path is simple: upgrade what qualifies, replace what does not, and keep paid ESU for the few machines with a real reason to stay. Every month a Windows 10 PC stays online without patches, the list of known ways into it gets longer.
Still have Windows 10 machines in the office?
Internet Pros audits your PCs for Windows 11 readiness, handles upgrades with backups and BitLocker keys in place, sources replacement hardware, and securely retires the old machines. Contáctanos to plan your Windows 11 move.
