Windows 10 end of support: what to do with the machines you still have

Windows 10 support ended on October 14, 2025. Microsoft stopped shipping quality updates, security fixes and technical support for it on that date, and it has not shipped any since. If your office still has machines on it, you are either paying for Extended Security Updates or you are running unpatched.

Windows 10 end of support is a budget problem for a business, not a technical one. The machines keep working. Nothing bricks. What changes is the price of the extension, and it changes this fall. Microsoft’s own numbers are below, and they are worth reading before you renew anything.

The price doubles every year, and it is cumulative

Microsoft sells Extended Security Updates to organizations through the Volume Licensing program at $61 per device for Year One, and the price doubles every consecutive year, to a maximum of three years. That gives you a ladder:

Year	List price per device
Year One	$61
Year Two	$122
Year Three	$244

Three full years of ESU is $427 per device at list. For a 40-person office that never moved, that is roughly $17,000 to keep an operating system alive that Microsoft already retired.

The part that catches people is the cumulative rule. Microsoft is explicit: if you buy in Year Two, you pay for Year One as well, because ESU coverage is cumulative. Skipping Year One to save money does not save money. A business enrolling for the first time in Year Two owes $61 plus $122, so $183 per device, for coverage that ends at the same time as everyone else’s.

Year One started in November 2025 and the program is sold in one-year blocks with no partial periods. Year Two pricing lands this fall. If you have been coasting since last October, this is the renewal where the number gets uncomfortable enough to force the conversation.

Two more licensing details that matter at this size. The minimum purchase is one license, so you can cover four holdout machines without buying a block of fifty. And Windows 10 virtual machines running in Windows 365, Azure Virtual Desktop or Azure VMs get ESU at no additional cost, which occasionally changes the math for a business that was already considering hosted desktops.

The $30 version you read about does not apply to your office

There is a consumer ESU program. It costs $30 once, or nothing at all if you sync your PC settings to a Microsoft account, or 1,000 Microsoft Rewards points. One license covers up to ten devices and it runs through October 12, 2027. That sounds like an obvious workaround for a small office, and every few months someone asks us about it.

It does not work, and not because of a technicality anyone can argue their way around. Microsoft’s consumer ESU page states the program will not be offered for devices joined to Active Directory, devices joined to Microsoft Entra, or devices enrolled in a mobile device management solution. That is a description of essentially every managed business PC. If your machines are domain-joined or sitting in Intune, the enrollment path is closed to them.

Detaching a fleet from Entra or pulling it out of MDM to qualify for a $30 consumer license would cost you conditional access, device compliance, remote wipe and centralized patching. You would be trading your entire security posture for a $30 license. Do not do it.

Step 1: get an accurate count, and check the version

You cannot make this decision on a guess about how many old machines are floating around. Pull an actual inventory from whatever manages your endpoints, and record the Windows version alongside the model and age. If nothing manages your endpoints, that is the finding, and it is a bigger one than the Windows version. This is table stakes for managed IT.

Two things disqualify a machine from ESU regardless of what you are willing to pay:

• It must be running Windows 10, version 22H2. Older builds are not eligible. If a machine has been off the network long enough to be stuck on an earlier feature update, it needs to get to 22H2 first.
• Long-Term Servicing releases are not covered. LTSB and LTSC builds have separate lifecycles and are not part of the Windows 10 ESU program. If you have an LTSC machine driving a piece of equipment, check its own end date, because ESU will not extend it.

That second one bites manufacturing and medical clients more than anyone. The PC attached to the scanner or the label printer is often LTSC precisely because nobody wanted it changing, and it needs its own answer.

Step 2: sort every machine into one of three piles

Pile one: upgrade in place. A Windows 10 machine can move to Windows 11 directly if it is on version 2004 or later and has the September 14, 2021 security update or later installed. The hardware bar is the harder test. Microsoft’s published requirements are a 1 GHz or faster 64-bit processor with two or more cores from the compatible processor list, 4 GB of memory, 64 GB of available storage, DirectX 12 graphics with a WDDM 2.0 driver, UEFI firmware that is Secure Boot capable, and TPM 2.0.

TPM 2.0 and the processor list are what actually fail. A 2017 desktop with plenty of RAM will still be rejected because its CPU is not on the supported list, and there is no supported way around that.

Pile two: replace. Anything that fails the Windows 11 check and is more than about five years old should be replaced rather than extended. A new business-class laptop lands in a range most owners already know, and at $61 to $122 per year per machine you are spending a meaningful fraction of a replacement to postpone one. Run the numbers against your actual refresh cycle. Our IT budget guide for small businesses walks through how to spread that across a fiscal year instead of eating it in one quarter.

Pile three: actually stuck. This is the pile ESU exists for. A line-of-business application that will not run on Windows 11. A machine attached to hardware whose vendor has not certified a newer OS. A workstation running software you are contractually required to keep on a specific version. Pay for ESU on these, isolate them on the network, and put a date on when the underlying dependency gets fixed.

If pile three has more than a handful of machines in it, the problem is the application vendor, not Microsoft. Start that conversation now, because it is the long pole.

Step 3: actually activate it, which is not automatic

Buying the licenses does not patch anything. ESU has to be installed and activated per device, and the order of operations matters.

Per Microsoft’s activation documentation, the prerequisites are Windows 10 version 22H2 with KB5066791 or later installed, and then the ESU Licensing Preparation Package, KB5072653, installed after KB5066791. Installing them out of order is the most common reason activation fails.

To find your key, you need the Product Key Reader or VL Administrator role in Microsoft Entra ID. In the Microsoft 365 admin center, go to Billing > Your products, open the Volume licensing tab, select View contracts under Contracts, find the License ID holding the ESU licenses, then use the three-dot menu and choose View product keys.

On each device, from an elevated Command Prompt:

slmgr.vbs /ipk <your ESU MAK>
slmgr.vbs /ato 1043add5-23b1-4afb-9a0f-64343c8f3f8d
slmgr.vbs /dlv

That middle value is the Year Two activation ID. Year One is f520e45e-7413-4a34-a497-d2765967d094 and Year Three is 83d49986-add3-41d7-ba33-87c7bfb5c0fb. The activation IDs are the same across all eligible editions and every enrolled device. The last command verifies the result: you want to see the ESU program name with a license status of Licensed.

Devices need to reach Microsoft’s activation endpoints for this to work. If a machine is deliberately offline, there is a phone activation path using slmgr.vbs /dti to produce an installation ID, and the Volume Activation Management Tool handles proxy activation for larger offline batches.

What ESU does not buy you

It buys critical and important security updates. That is the entire product. It does not include new features, non-security fixes, design change requests, or general technical support for Windows 10. Microsoft will help with problems caused by ESU itself, and that is where the line sits.

So a Windows 10 machine on ESU is patched against known exploited vulnerabilities and nothing else. Driver problems, application compatibility breakage and performance issues are yours. It is a holding pattern with a meter running, which is the correct way to think about it when you are deciding how long to stay in one.

While those machines are in the holding pattern, make sure they are covered by real backup and recovery, because an unsupported endpoint running a legacy application is exactly the box you cannot afford to lose and cannot quickly rebuild.

The verdict

Pay for ESU only on machines with a named reason they cannot move, and write the reason down. Upgrade everything that passes the Windows 11 hardware check. Replace the rest on a schedule you control rather than after an incident forces it.

The ladder is designed to make waiting expensive, and it works. At $61 the extension is cheap enough to be sensible for a genuine holdout. At $244 in Year Three it is more than a rounding error on a new machine, for an operating system that will be three years past retirement. Most businesses we work with should be out of the program entirely before they reach that rung.

If you are not sure how many of your machines pass the Windows 11 check, or what the replacement wave costs spread across next year, we can inventory it and give you the number. Get in touch and we will tell you which pile each machine belongs in, including the ones where the honest answer is that you do not need to spend anything yet.

Prices in this article are Microsoft’s published US list prices for the Volume Licensing program. Menu paths, KB numbers, activation IDs and program dates were verified against Microsoft’s own current documentation in September 2026.