Windows 10 ESU Year 2: Renew, Replace or Migrate
Year 1 ended October 13, 2026. Year 2 costs double, and your office probably has PCs on different clocks. Decide per device, not per fleet.
By William Bradshaw | October 21, 2026 | 10 min read
On October 13, 2026, the first year of commercial Windows 10 Extended Security Updates (ESU) ended and Year 2 began. The Year 2 license costs double what Year 1 did. Meanwhile the consumer ESU program runs to October 12, 2027, which means a small office with a mix of domain-joined PCs and a few standalone machines now has devices on different clocks, under different rules, and with different exits.
This guide is for owners, office managers and IT leads at organizations of roughly 10 to 50 seats, including Ohio townships, fire districts and other small public entities. It does not argue that ESU is good or bad. ESU is a bridge, and the only useful question is which PCs still need a bridge, which can move to Windows 11 on their current hardware, which should be replaced, and which should leave Windows entirely.
Every date and price below comes from Microsoft's own documentation, and we have left out figures Microsoft does not publish. Check your reseller's quote against the current Microsoft pages before you buy.
What Changed on October 13, 2026
Windows 10 support ended on October 14, 2025. Microsoft's lifecycle FAQ lists the commercial ESU coverage years as follows.
| Coverage | Ends |
|---|---|
| ESU Year 1 | October 13, 2026 |
| ESU Year 2 | October 12, 2027 |
| ESU Year 3 (last year) | October 10, 2028 |
Three things follow from that table. First, any PC that was enrolled in Year 1 now needs a Year 2 license to keep receiving security updates past October 13. Second, there is no Year 4: the commercial program stops on October 10, 2028, so every ESU dollar you spend buys time and nothing else. Third, a PC that never enrolled is not covered at all, and has received no security updates since October 14, 2025.
Separately, Microsoft's consumer ESU page says individuals can enroll any time until that program ends on October 12, 2027. That program has its own rules, covered next, and it excludes business machines.
Which ESU Covers Which Machine
There are three different ESU routes, and they are not interchangeable. Sorting your PCs into the right route is the first step.
Commercial ESU. Organizations buy it through Microsoft Volume Licensing. The device must run Windows 10, version 22H2 with the required update packages installed, and Microsoft's lifecycle FAQ says the qualifying editions are Enterprise, Education and Pro in commercial use. You activate each device with a multiple activation key found in the Microsoft 365 admin center, and you need a Product Key Reader or VL Administrator role to see it. The minimum purchase is one license, so a small office can license only the PCs that need it. Each ESU year has its own activation ID, so buying Year 2 changes nothing until the Year 2 license is installed and activated on each PC.
Consumer ESU. Microsoft's consumer page lists three ways to enroll: back up PC settings with Windows Backup at no cost, redeem 1,000 Microsoft Rewards points, or make a one-time purchase of $30 USD plus tax. It requires Windows 10 22H2 Home, Pro, Pro Education or Workstations, and a Microsoft account with administrator rights. One license can cover up to 10 devices.
The limits matter more than the price. Microsoft says the consumer program is not offered for devices joined to an Active Directory domain or Microsoft Entra ID, or enrolled in a mobile device management solution, that it cannot be used in commercial scenarios, and that kiosk-mode devices are excluded. A PC that runs your business is a commercial scenario. Treat every PC your organization owns or pays for as commercial, including a laptop the township issues to a board member: license it through commercial ESU or move it off Windows 10. A board member's own personal laptop is theirs to enroll, and the township's control for it is policy rather than licensing: keep township records off personal devices.
Cloud-hosted Windows 10. Microsoft states that ESU is available at no additional cost for Windows 10 virtual machines in Windows 365, Azure Virtual Desktop and several other Azure services, and that Windows 10 endpoints connecting to Windows 365 Cloud PCs are entitled to ESU for up to three years with an active Windows 365 subscription license. For a handful of users with an old PC and a modern need, a Cloud PC can be a way to keep the hardware in service while the desktop itself is supported. It is a subscription, not a one-time fix.
What Year 2 Costs
Microsoft's published commercial price for Year One is $61 USD per device through Volume Licensing, and its documentation states that the price doubles every consecutive year for a maximum of three years. At the Year One figure, that puts Year 2 at $122 per device and Year 3 at $244. Your reseller's quote may differ with tax, agreement type and currency, so treat these as the reference points rather than a promise.
The rule that catches late buyers is that ESU is cumulative. Microsoft states that ESU must be purchased by year with no partial periods, and that anyone who decides to purchase in Year Two has to pay for Year One too. So a PC you never enrolled costs $61 plus $122, or $183 at the reference prices, to be covered through October 12, 2027.
That arithmetic is the reason to be selective. A single PC covered through the whole program costs $61 plus $122 plus $244, or $427 at the reference prices, for a machine that is still on Windows 10 at the end. The longer a machine stays on ESU, the stronger the case for replacing it.
Renew, Replace or Migrate: A Decision Table by Device Role
Decide by what the machine does, not by how old it is. The table gives our default for each common role, and the reason.
| Device role | Default | Why |
|---|---|---|
| PC that passes the Windows 11 hardware check | Migrate in place to Windows 11 | Usually the cheapest exit: no new hardware and no more ESU spend. Test the line-of-business apps on one PC first. |
| Front-desk or task PC (email, browser, one web app) | Replace, or migrate to Linux | Low app risk, so little keeps it on Windows 10. Cheapest to move early. |
| Finance, records or payroll PC | Replace first; renew only to bridge | Highest consequence if it is breached, and the first machine an auditor or carrier will ask about. |
| Shared kiosk or counter PC | Migrate to Linux or replace | Single-purpose and shared, so it suits a locked-down browser or a thin client. |
| Hardware that cannot run Windows 11 | Migrate to Linux, or replace the hardware | Paying ESU on hardware with no Windows 11 path buys one to two years and ends at the same place. |
| PC tied to a line-of-business app | Renew Year 2 while the vendor catches up | The one case where ESU is the right tool. Get the vendor's Windows 11 date in writing, and set a hard cutoff. |
The migrate path is more practical than it sounds for the right machines. A PC that fails the Windows 11 hardware checks can often run a current Ubuntu LTS release well, which converts a disposal cost into a reuse. Our guide to migrating from Windows to Ubuntu covers which roles move cleanly and which should not.
If you are not sure which bucket a PC belongs in, ask what breaks if it is offline for a day. A machine that would stop payroll goes in the replace column. A machine that would only inconvenience one person is a candidate for the cheapest exit available.
What ESU Does Not Give You
ESU delivers critical and important security updates, as Microsoft's Security Response Center rates them. Microsoft's documentation is explicit about what is left out: new features, customer-requested non-security updates and design change requests. It also states that technical support is not included, and that ESU support covers only license activation, installation and possible regressions of the ESU itself, and only for organizations with an active support plan.
In practice, that means a Windows 10 PC on ESU stays patched against the worst vulnerabilities but gets no fixes for ordinary bugs, no new capabilities, and no help from Microsoft if something unrelated to security breaks. Your managed services provider becomes the support desk for that machine, not Microsoft.
Applications are on their own clock. Microsoft states that it will continue providing security updates for Microsoft 365 Apps on Windows 10 for three years after Windows 10 reaches end of support, ending October 10, 2028, but that devices stay on a fixed version and receive only security updates after Version 2608. Its support policy adds that if a problem occurs only on Windows 10, support will ask you to move to Windows 11. Keeping a PC on Windows 10 is a decision with a shrinking service level, even when the security updates keep arriving.
The Audit and Insurance Angle
Be precise about the risk, because overstating it helps nobody. A Windows 10 PC with active ESU coverage is still receiving security updates. The sharpest finding is the PC with no coverage at all, but a covered PC still needs to be disclosed and planned out.
CIS Controls v8 addresses this directly in Safeguard 2.2, “Ensure Authorized Software is Currently Supported.” The safeguard asks that only currently supported software be authorized in your software inventory, and that any unsupported software you still need carry a documented exception with mitigating controls and residual risk acceptance, reviewed at least monthly. An operating system is software. A Windows 10 PC with no ESU coverage is unsupported, and without a documented exception it fails the safeguard. A covered PC is still receiving security updates, but because ESU does not extend Windows 10's lifecycle, record it as an exception too, with an end date.
Cyber insurance applications ask the same thing in plainer words. Expect a question about whether any systems are past end of life, and expect it to be worded to catch the PC under the desk. Our Ohio cyber insurance questionnaire walkthrough covers how to answer those questions truthfully when the honest answer is “yes, and here is the plan.”
For Ohio political subdivisions, the cybersecurity program ORC 9.64 requires starts with identifying critical functions and cybersecurity risks (division (C)(1)), and an asset inventory is the usual evidence for that. A dated Windows 10 exit plan, with ESU purchases recorded as bridges and a retirement date for each, is the kind of evidence that holds up. “We are on ESU because we have not decided” is not.
Pair It With the Windows Server 2016 Deadline
Windows Server 2016 extended support ends January 12, 2027, less than three months from today. If your office has a server that old, it competes with your desktop refresh for the same budget, the same maintenance windows and the same attention.
Treat them as one program. A new server that arrives in the same quarter as new desktops can often share licensing conversations, imaging work and downtime. Our Windows Server 2016 end of life decision guide walks through that side of the decision, and the same per-workload logic applies: replace what is cheap to replace, bridge only what must be bridged, and write down every exception.
A 90-Day Plan for a 10 to 50 Seat Office
Ninety days gets a small office from a list of old PCs to a defensible position. The point is to spend ESU money only where it buys something.
Inventory
List every Windows 10 PC with its user, role, edition, domain or standalone status, and whether it is enrolled in ESU today. Include the machines nobody mentions, such as the conference room PC and the one running the door badge software. Note any LTSB or LTSC editions (common on badge readers and kiosks): Windows 10 ESU does not cover them, and they follow their own lifecycle dates. Any PC already on Year 1 that clearly has to stay on Windows 10, such as a line-of-business PC waiting on its vendor, gets its Year 2 license bought and activated now, not at day 31: Year 1 coverage ended October 13, so it misses every monthly security release until Year 2 is active.
Classify
Run the Windows 11 compatibility check, tag each PC with a role from the decision table, and mark which ones already have Year 1 coverage. Anything unenrolled and business-critical is urgent today.
Budget Year 2 for the remaining cases
Buy Year 2 for the line-of-business and bridge cases, and for the finance machines you cannot replace before the next audit. Remember the cumulative rule for any PC that skipped Year 1. Do not buy it for the PCs you plan to replace this quarter.
Replace or migrate the rest
Upgrade the Windows 11-capable PCs in place, order hardware for the rest, image the replacements, and migrate the Linux-friendly roles. Do finance and records PCs first, then task PCs, then kiosks. Keep the old drive until the user confirms nothing is missing, then wipe or destroy it under your records-retention schedule.
Document the exceptions
For every PC still on Windows 10, record the reason, the compensating controls, the ESU year it is covered through and the retirement date. That one page is what you hand an auditor, a carrier or a board.
Frequently Asked Questions
When does Windows 10 ESU Year 2 end?
Microsoft's lifecycle FAQ lists Year 1 ending October 13, 2026, Year 2 ending October 12, 2027, and Year 3 ending October 10, 2028. Year 3 is the last year of the commercial program.
Can I buy only Year 2 of Windows 10 ESU?
No. ESU is cumulative: buying into Year 2 means paying for Year 1 as well.
Can a domain-joined PC use the consumer Windows 10 ESU program?
No. Microsoft states the consumer program is not offered for devices joined to an Active Directory domain or Microsoft Entra ID, or enrolled in a mobile device management solution, and cannot be used in commercial scenarios.
Does Windows 10 ESU include technical support or new features?
No. ESU delivers critical and important security updates only. It excludes new features, customer-requested non-security updates and design change requests, and it does not include general technical support.
Does an ESU-covered PC count as an end-of-life system on an insurance questionnaire?
Usually, yes. Microsoft says ESU does not extend the product's lifecycle, so Windows 10 is past end of support even on a covered PC. Read the carrier's exact wording, disclose the Windows 10 PCs, and state that they are covered by paid ESU through a named date with a retirement plan attached. ESU coverage strengthens the answer; it does not turn it into a no.
Which Windows 10 PCs get ESU at no additional cost?
Per Microsoft, ESU is available at no additional cost for Windows 10 virtual machines in Windows 365, Azure Virtual Desktop and several Azure services, and Windows 10 endpoints connecting to Windows 365 Cloud PCs are entitled with an active Windows 365 subscription license.
Want a Second Opinion on Your Windows 10 Inventory?
Bullium's managed IT and vCIO teams help small offices and Ohio public entities sort every PC into renew, replace or migrate, and write the one-page exception record that auditors and carriers ask for. We start with a walkthrough of your current inventory. No commitment to engage further.
Related Reading
Windows Server 2016 End of Life Decision Guide
The server side of the same refresh cycle. Extended support ends January 12, 2027.
Migrating from Windows to Ubuntu
The migrate path for desktops that cannot or should not run Windows 11.
Ohio Cyber Insurance Questionnaire Walkthrough
How to answer the end-of-life systems question honestly and with a plan.
Ohio ORC 9.64 Cybersecurity Compliance
What a cybersecurity program looks like for Ohio political subdivisions.