Windows 10 reached end of support on 14 October 2025, so every Windows 10 PC that is not enrolled in Extended Security Updates (ESU) has received no security fixes since then. More than a year on, most organisations still have a tail of devices that cannot run Windows 11, belong to a forgotten business unit or run software nobody has tested. This guide covers the Windows 10 specifics: the official dates, how ESU is priced and activated, the Windows 11 hardware bar (TPM 2.0, Secure Boot, supported processors), how to measure readiness in Intune, and how to contain the devices that stay behind. It is for endpoint, desktop and security teams. The cross-platform decision framework is in the Operating System End of Life and Extended Support Guide.
This is an independent guide from NHI Mgmt Group, based on Microsoft's public documentation as of November 2026. It is not sponsored or reviewed by Microsoft. Product features change, so confirm settings against Microsoft's current documentation.
Key takeaways
- The deadline has passed. Windows 10 22H2 was the final version and support ended on 14 October 2025; unenrolled devices are already unpatched.
- ESU is a bridge priced to end. Commercial ESU costs USD 61 per device for Year One and doubles each year, for a maximum of three years, and you cannot join later without paying for the years you missed.
- Cloud-hosted Windows 10 gets ESU free. Windows 10 virtual machines in Windows 365, Azure Virtual Desktop and other listed Azure services are covered at no extra cost, which makes virtualising a straggler app a real option.
- TPM 2.0 and the processor list decide most upgrades. Intune's Work from anywhere report shows each device's Windows 11 readiness and the reason it fails, which is the work list for replacement.
- Stragglers need containment, not hope. Devices that cannot be upgraded or enrolled should be blocked from sensitive resources by compliance policy and segmented on the network.
What is changing and why
Microsoft's lifecycle policy gives each Windows release a fixed end date. For Windows 10 Home, Pro, Enterprise, Education and IoT Enterprise, that date was 14 October 2025 (the lifecycle pages show 15 October 2025 06:59:59 Pacific Time, the close of 14 October). Version 22H2 is the final feature release. After the end date, Microsoft provides no security updates, non-security fixes or technical support for Windows 10, except through ESU. Long-Term Servicing Channel (LTSC) editions follow their own lifecycles and are not part of the ESU programme.
The security consequence is simple: every Windows vulnerability disclosed after October 2025 that also affects Windows 10 stays open on unenrolled devices. Vulnerabilities that allow remote code execution or privilege escalation on Windows (MITRE ATT&CK T1210, T1068) become permanent footholds on those machines.
Official timeline and current status
Dates are from Microsoft Learn lifecycle and ESU pages and the Microsoft consumer ESU page, checked on 8 November 2026.
| Date | Event | Applies to |
|---|---|---|
| 14 October 2025 | End of support for Windows 10 22H2 | Home, Pro, Enterprise, Education, IoT Enterprise (non-LTSC) |
| November 2025 | ESU Year One begins | Commercial and education devices enrolled in ESU |
| 12 October 2027 | Consumer ESU programme ends | Home and personal devices enrolled through Settings |
| 13 January 2027 (06:59 Pacific Time) | End of mainstream support shown on the lifecycle page | Windows 10 Enterprise LTSC 2021 |
| October 2028 | End of the three-year maximum for commercial ESU (Microsoft states "a maximum of three years after end of support"; check the exact final date before planning to it) | Commercial and education ESU |
ESU options
| Route | Cost | Requirements and limits |
|---|---|---|
| Commercial ESU (Volume Licensing) | USD 61 per device Year One, doubling each consecutive year (Microsoft does not publish Year Two and Three figures); annual only; cumulative | Windows 10 22H2 with KB5066791 or later and the ESU Licensing Preparation Package KB5072653; activation by MAK |
| Cloud and virtual machines | No additional cost | Windows 365, Azure Virtual Desktop, Azure VMs, Azure Dedicated Host, Azure VMware Solution, Nutanix Cloud Clusters on Azure, Azure Local, Azure Stack Hub and Edge |
| Windows 10 devices used to reach Windows 365 Cloud PCs | Included with an active Windows 365 licence, up to three years | Device must be used to connect to the Cloud PC |
| Consumer ESU | Free with Windows Backup settings sync, 1,000 Microsoft Rewards points, or USD 30 one-off | Microsoft account; not domain joined, Entra joined or MDM enrolled; up to 10 devices; options can differ in the European Economic Area |
ESU delivers only critical and important security updates as rated by the Microsoft Security Response Center: no new features, no non-security fixes, and support limited to activation, installation and regressions caused by ESU updates.
Common ESU mistakes seen in practice: buying licences but never installing the MAK, so devices stay unlicensed; activating devices still on a pre-22H2 build, which are not eligible; missing the order of the prerequisites (KB5072653 must go on after KB5066791); assuming the MAK could be used before the end of support date, when Microsoft states keys only work from that date; and forgetting that each ESU year needs its own activation ID, so coverage lapses silently at the year boundary unless the new ID is deployed.
Who and what is affected
- Hardware below the Windows 11 bar: devices without TPM 2.0, without UEFI Secure Boot capability or with a processor outside Microsoft's supported list.
- Line-of-business applications: software certified only on Windows 10, drivers for lab or production equipment, and kiosks.
- Unmanaged and unknown devices: machines outside Intune or Configuration Manager that nobody inventoried, which are both the hardest to find and the most likely to be unenrolled.
- Generation 1 virtual machines: Windows 11 needs Generation 2 VMs with a virtual TPM; Generation 1 VMs cannot be upgraded in place.
- Accounts on those devices: local administrator accounts and cached domain credentials on unpatched machines become easier to harvest. Rotate local admin passwords with LAPS; see the Local Administrator Password Solution (LAPS) Guide.
| Windows 11 requirement | Minimum | Common blocker |
|---|---|---|
| Processor | 1 GHz, two or more cores, on Microsoft's compatible 64-bit list | Older generation CPUs not on the list |
| Memory | 4 GB | Low-end thin clients |
| Storage | 64 GB | Small eMMC devices |
| Firmware | UEFI, Secure Boot capable | Legacy BIOS (CSM) mode or MBR disks |
| TPM | Version 2.0 | TPM disabled in firmware or only TPM 1.2 |
| Graphics | DirectX 12, WDDM 2.0 driver | Old integrated graphics |
| Upgrade path | Windows 10 2004 or later with the 14 September 2021 update or later | Very old builds needing a feature update first |
Finding affected systems and identities
- Use Intune's readiness report: in Endpoint analytics, open Work from anywhere, select the Windows metric, then the Windows tab. Each device shows a Windows 11 readiness status (Capable, Not capable, Upgraded, Unknown) and a readiness reason listing unmet requirements. Devices must be enrolled in Intune, co-managed or attached through Configuration Manager 2107 or later, and active in the last 29 days.
- Treat Unknown as a finding: Unknown usually means an inactive device. Check last check-in and either retire it or bring it back into management.
- Cross-check other sources: compare Intune and Configuration Manager with Entra ID device objects, EDR agent lists, DHCP and network access control logs to find Windows 10 devices outside management. See the Asset Inventory and CMDB Security Guide.
- Verify ESU coverage: run slmgr.vbs /dlv on enrolled devices and confirm the ESU program name with License Status: Licensed. A device that shows no ESU licence is not receiving updates whatever the purchase records say.
- Record ownership and exit plans: for each remaining device, note owner, reason, route (upgrade, replace, virtualise, ESU, isolate) and target date.
Migration options
| Option | When to choose it | Trade-offs |
|---|---|---|
| In-place upgrade to Windows 11 | Capable devices; most of the estate | Fast and keeps data; needs app testing and a feature update policy |
| Replace hardware | Not capable devices near refresh age | Capital cost; use the work to retire old devices completely |
| Move the workload to Windows 365 or Azure Virtual Desktop | An application that only runs on Windows 10 | ESU included for those VMs; adds licence and connectivity costs |
| Commercial ESU | Devices that will be upgraded or retired within one to two years | Cost doubles yearly; security fixes only |
| Isolate | Devices that cannot be patched, upgraded or virtualised (equipment controllers) | Residual risk accepted; needs strong network and identity controls |
- Activating ESU: install KB5066791 (or later) and then KB5072653, find the MAK in the Microsoft 365 admin centre under Billing, Your Products, Volume licensing (Product Key Reader or VL Administrator role), then run slmgr.vbs /ipk with the MAK and slmgr.vbs /ato with the Year One activation ID f520e45e-7413-4a34-a497-d2765967d094. Use VAMT proxy activation for large offline fleets. Each new ESU year has its own activation ID.
- Small organisations: a handful of incapable PCs is usually cheaper to replace than to cover with ESU for three years, given the doubling price.
- Large organisations: treat ESU as a funded exception per device with an exit date, and report the remaining count to leadership monthly.
Isolating stragglers
- Block at sign-in: set an Intune compliance policy minimum OS version that excludes Windows 10 and require a compliant device in Conditional Access for sensitive applications. See the Conditional Access Guide.
- Segment: place unsupported devices in a dedicated VLAN or segment that only reaches the services they need, with no inbound management paths from them to the wider estate. See the Network Segmentation Guide.
- Reduce credentials: no privileged sign-ins on these devices, unique local admin passwords through LAPS, and no stored service account credentials.
- Keep EDR running: confirm your endpoint security vendor still supports Windows 10 on the version you run and for how long.
Testing and rollback
- Pilot ring: upgrade IT and volunteer users first with an Intune feature update policy, collecting application and driver issues.
- Application testing: test the top line-of-business applications and peripherals per department before broad rings.
- Broad rings: expand by department or site with a pause point between rings.
- Rollback: Windows keeps the previous version for a limited period after an upgrade, allowing users to go back through Settings; plan to fix and retry quickly rather than leave a device on Windows 10.
- ESU validation: after activation, confirm the next monthly ESU update installs on a sample before relying on coverage across the fleet.
Risks of doing nothing
- Accumulating unpatched vulnerabilities: every month adds fixes that unenrolled Windows 10 devices never receive.
- Compliance findings: unsupported components conflict with NIST SP 800-53 SA-22 and with patching requirements in frameworks and cyber insurance questionnaires.
- Escalating cost: joining ESU late still requires paying for earlier years, so delay does not save money.
- Lateral movement: an unpatched endpoint with cached credentials is an easy pivot into the domain.
| Framework | Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev. 5 | SA-22, SI-2, CM-8, SC-7 | Unsupported components replaced or justified; flaw remediation; inventory; boundary protection for isolated devices |
| NIST CSF 2.0 | ID.AM-08, PR.PS-02, ID.RA-01 | Lifecycle management; software replaced commensurate with risk; vulnerabilities recorded |
| MITRE ATT&CK v20 | T1210, T1068 | Exploitation that unpatched endpoints invite |
Metrics to track: Windows 10 device count by route, trending to zero; percentage of remaining Windows 10 devices with a verified ESU licence; count of Not capable and Unknown devices in the readiness report; days since last security update on each straggler; number of Windows 10 devices allowed through Conditional Access.
Practitioner checklist
- Pull the Windows 11 readiness list from Intune Work from anywhere and resolve every Unknown device.
- Reconcile Intune, Configuration Manager, EDR and network data to find unmanaged Windows 10 devices.
- Assign each remaining device a route, owner and exit date.
- Upgrade Capable devices in pilot and broad rings with feature update policies.
- Buy and activate ESU only for devices with a dated exit plan; verify with slmgr.vbs /dlv.
- Move Windows 10-only applications to Windows 365 or Azure Virtual Desktop where licensing allows.
- Block non-compliant Windows 10 devices from sensitive apps with compliance policy and Conditional Access.
- Segment devices that cannot be upgraded and remove privileged credentials from them.
- Track LTSC 2021 devices on their own lifecycle date, which is not covered by ESU.
Standards and references
- Microsoft Learn: Windows 10 Enterprise and Education lifecycle
- Microsoft Learn: Extended Security Updates (ESU) program for Windows 10
- Microsoft Learn: Enable Windows 10 Extended Security Updates
- Microsoft: Windows 10 Consumer Extended Security Updates
- Microsoft Learn: Windows 11 requirements
- Microsoft Learn: Work from anywhere report in Endpoint analytics
- Microsoft Learn: Windows 10 Enterprise LTSC 2021 lifecycle
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: Operating System End of Life and Extended Support Guide · Microsoft Intune Guide · Patch Management Guide · Local Administrator Password Solution (LAPS) Guide