Windows 10 stopped getting free security updates on 14 October 2025. Microsoft did not switch the machines off — they still boot, still run Outlook, still print. What stopped was the monthly security patch, unless you pay for Extended Security Updates.
That paid programme is sold per device, per year, and the price is designed to make you leave. For businesses it runs $61 per device for year one, $122 for year two and $244 for year three. Year one ends on 13 October 2026. It is also cumulative: if you skip year one and buy in year two, you pay for both.
So a Windows 10 laptop you have been ignoring is about to go from $61 a year to $122 a year, and a five-machine problem quietly becomes a $610 line item. Here is the order we would work through it.
1. Count them properly
Most offices have more Windows 10 machines than anyone thinks. The ones people forget are the shared machines: the reception PC, the machine wired to the label printer, the old laptop in the conference room, the spare that gets handed to temps. Walk the office and write down every machine, not just the ones with a person assigned to them.
2. Find out which ones can actually run Windows 11
Some can be upgraded for free. Some cannot, because of the processor generation or a missing security chip called TPM 2.0. This is not something you can tell by looking at the machine or by how fast it feels — a perfectly quick five-year-old laptop can be blocked. Microsoft's PC Health Check tool answers it per machine in about a minute.
3. Sort each machine into one of three piles
- Upgrade. It qualifies for Windows 11. Do it, and stop paying anything.
- Replace. It does not qualify and it is somebody's daily machine. Two years of ESU is most of the way to a new laptop, and you get a faster machine instead of an older one.
- Pay, deliberately. It does not qualify, it runs one thing that cannot move yet, and you have a date by which that will change. Paying is fine. Paying because nobody looked is not.
4. Do the upgrades before the rush, not during it
Every upgrade has a chance of a surprise — a scanner driver, an old line-of-business app, a saved password nobody has. Those are half-hour problems in September and all-day problems in the week the deadline lands.
5. Do not leave an unpatched machine on the main network
If something has to stay on Windows 10 without ESU, it should not be sitting on the same network as everything else with a browser and email on it. That is a longer conversation, but the short version is: an unpatched machine is a way in, and it does not have to be an important machine to be a useful one.
How we handle this: covered machines are inventoried, so the question “which of these can take Windows 11” is a report, not an afternoon of walking around. Patching and upgrades are part of the monthly service — see the services page.