Windows 10 ESU years 1-3: Understanding the long...

For more than a decade, Windows 10 served as the primary operating system for businesses of all sizes. Microsoft officially ended support for Windows 10 on October 14, 2025. While Windows 10 computers did not suddenly stop working, organizations still using the operating system now face an important security and planning decision.

For businesses that are not ready to completely transition to Windows 11, Microsoft offers Windows 10 Extended Security Updates (ESU). ESU provides additional time to address legacy applications, aging hardware, budget limitations, and other challenges that may prevent immediate migration.

However, ESU should be viewed as a temporary bridge rather than a permanent solution.

What is Windows 10 ESU?

Windows 10 ESU allows eligible Windows 10 systems to continue receiving important security updates after the operating system's normal support lifecycle has ended.

ESU does not return Windows 10 to full support. Organizations should not expect new features or continued development of the operating system. Instead, ESU helps reduce security risks while an organization works toward migrating or replacing its remaining Windows 10 systems.

Without ESU, newly discovered Windows 10 vulnerabilities may remain unpatched. Antivirus, endpoint detection and response (EDR), firewalls, and other security products remain important, but they should not be considered replacements for operating system security updates.

Understanding the three-year ESU timeline

Microsoft provides commercial organizations with the option to purchase Windows 10 ESU coverage for up to three years.

Year 1 runs from October 2025 through October 2026. Organizations that still require Windows 10 can continue into Year 2 through October 2027, followed by a third and final year through October 2028.

Although three years provides organizations with additional flexibility, businesses should avoid treating 2028 as their new Windows 10 migration deadline. Ideally, every device receiving ESU should also have a plan for eventually upgrading or being replaced.

The cost of ESU increases over time

An important consideration with Windows 10 ESU is its escalating cost structure. Commercial ESU is purchased annually, and Microsoft's pricing increases in subsequent years.

For an organization with only a few Windows 10 computers, the initial cost may seem relatively small. However, the expense can become significant when multiplied across dozens or hundreds of computers over multiple years.

Organizations should also consider the administrative costs associated with maintaining these systems. IT teams must identify eligible computers, manage licensing, verify activation and updates, troubleshoot aging systems, maintain documentation, and eventually migrate or replace the devices.

Delaying a Windows 11 migration does not eliminate the project. In many cases, it simply moves the expense further into the future while potentially adding costs along the way.

ESU vs. replacing aging hardware

The age and condition of the hardware should also be considered when deciding whether to purchase ESU.

For example, a five- or six-year-old Windows 10 workstation that does not meet Windows 11 requirements may benefit from one year of ESU while a replacement is planned. Continuing to purchase ESU for several years, however, may not make financial sense.

Older computers can introduce other concerns, including declining performance, expired warranties, hardware failures, and compatibility issues with newer applications.

This raises an important question:

At what point does paying to maintain an ageing computer stop making financial sense?

Organizations should compare the total cost of maintaining a Windows 10 computer against the cost and long-term benefits of replacing it with supported Windows 11 hardware.

When does ESU make sense?

There are legitimate situations where Windows 10 ESU can be valuable.

Some businesses rely on legacy applications that have not been certified for Windows 11. Others may operate manufacturing equipment, specialized hardware, or vendor-supported systems that depend on Windows 10. Organizations replacing a large number of computers may also need to spread those purchases across multiple budget cycles.

In these situations, ESU provides additional security while the underlying technical or financial challenges are addressed.

However, if a computer already supports Windows 11, its applications are compatible, and there is no business requirement to remain on Windows 10, purchasing multiple years of ESU may simply delay an upgrade that will eventually be necessary.

Building an ESU exit strategy

Organizations should inventory their remaining Windows 10 computers and place them into three categories:

• Upgrade: The computer supports Windows 11 and can be upgraded.
• Replace: The computer does not meet Windows 11 requirements or is approaching the end of its useful life.
• ESU Exception: A legitimate technical or business requirement temporarily prevents migration.

Every ESU exception should have a documented reason and, whenever possible, an expected migration or replacement date.

ESU should be a bridge, not the destination

Windows 10 ESU gives businesses something valuable: additional time. It allows organizations to continue receiving important security updates while developing an organized Windows 11 migration strategy.

That additional time should be used strategically. As ESU progresses from Year 1 into Years 2 and 3, organizations should continually evaluate whether maintaining Windows 10 still makes financial and operational sense.

The goal should not be determining how long Windows 10 can remain in production. Instead, businesses should use ESU as a temporary security bridge while transitioning toward a more modern, secure, and sustainable Windows environment.