Windows 10 ESU Deadline: Stop Paying More for Old PCs

If your office still runs Windows 10, the bill for keeping it safe is about to go up. Microsoft ended mainstream support for Windows 10 on 14 October 2025, and the first year of paid Extended Security Updates (ESU) ends on 13 October 2026. Businesses that bought Year 1 now face a choice: pay double for Year 2, or finish the upgrade they have been postponing.

The bigger risk is the office that did nothing at all. A Windows 10 PC with no ESU has not received a security patch since October 2025. It still boots, it still opens Tally and email, and it looks fine. That is exactly why it gets ignored until ransomware, a failed audit or a client security questionnaire exposes it.

This guide explains what the ESU deadline means for Indian businesses, the mistakes that make it expensive, and a clear plan to fix it in the next few weeks.

What the Windows 10 ESU Deadline Actually Means

ESU is Microsoft's paid bridge for organisations that cannot move every PC to Windows 11 on time. According to Microsoft's ESU documentation, it works like this for commercial customers:

• Up to three years: ESU runs for a maximum of three years after end of support, until October 2028.
• Bought one year at a time: each year is purchased as a full year. There are no partial periods.
• Price doubles each year: Microsoft lists USD 61 per device for Year 1, USD 122 for Year 2 and USD 244 for Year 3.
• Cumulative: if you join in Year 2, you must also pay for Year 1.
• Security only: ESU delivers critical and important security updates. There are no new features, no non-security fixes and no general technical support.
• Version 22H2 only: the PC must be on Windows 10 version 22H2 to receive ESU updates.

So 13 October 2026 is not the day Windows 10 stops working. It is the day every unmigrated PC becomes more expensive to protect, and the day unprotected PCs fall one more month behind on patches.

The Hidden Cost of Waiting Another Year

Many businesses treat ESU as a cheap way to delay. For a small number of machines, it can be. For a whole office, the numbers change quickly. Take 50 PCs as an example. Year 2 alone at the listed price comes to USD 6,100, and a latecomer paying Year 1 and Year 2 together pays USD 9,150. That money buys security patches only. It does not make the PCs faster, and it does not solve the hardware problem that caused the delay.

There are quieter costs too:

• Software support drops away. Vendors of browsers, antivirus, accounting and ERP tools gradually stop testing on Windows 10.
• Audits get harder. Security reviews, ISO 27001 audits and client questionnaires routinely ask about unsupported operating systems.
• Older hardware fails more often. Many PCs that cannot run Windows 11 are also near the end of their useful life, so the helpdesk load keeps climbing.

5 Mistakes That Make the Upgrade Expensive

1. Not knowing how many Windows 10 PCs you have

Offices often guess. The real count includes the reception PC, the CCTV viewing station, the machine connected to the biometric attendance device and the old laptop in the accounts cabin. Fix: pull a list from your endpoint management or antivirus console, then walk the floor to catch the rest.

2. Buying ESU for every PC by default

Renewing everything is the easy option and the costly one. Fix: buy ESU only for PCs with a dated replacement plan, such as machines running a line-of-business application that is still being certified for Windows 11.

3. Ignoring Windows 11 hardware requirements

Windows 11 needs a supported processor, TPM 2.0 and Secure Boot. Some PCs only need a firmware setting switched on. Others cannot be upgraded at all. Fix: run a compatibility check first so you budget for real replacements, not guesses.

4. Forgetting the applications

The operating system is rarely the problem. Old printer drivers, a legacy billing tool or a USB token driver for digital signatures can stop work on day one. Fix: test each critical application on a pilot Windows 11 machine before rolling out.

5. Upgrading without a data plan

Staff keep files on the desktop, not the server. A rushed reinstall can wipe years of work. Fix: move user data to OneDrive, a file server or a backed-up share before any PC is touched.

The Fix: A 6-Step Windows 10 Exit Plan

You can finish most of this in four to eight weeks for a typical SME office. Here is the order we recommend.

1. Inventory every endpoint. Record hostname, user, department, Windows version, processor, RAM, TPM status and purchase date. A simple sheet is enough to start. Our guide on IT asset management best practices shows how to keep it current.
2. Sort PCs into three groups. Group A can upgrade in place. Group B needs a firmware change or a small hardware fix. Group C must be replaced.
3. Decide ESU PC by PC. Buy ESU only for Group C machines that cannot be replaced before October, and write down the replacement date for each one.
4. Test applications on a pilot group. Upgrade three to five users from different teams. Check accounting software, printers, scanners, VPN, DSC tokens and any government portal they use daily.
5. Roll out in waves. Upgrade by department, after hours, with data backed up first. Keep a short checklist per PC so nothing is missed.
6. Harden and monitor. After the move, confirm updates are applying, antivirus is healthy and BitLocker is on for laptops. A steady patch management process keeps the new setup safe.

Options When You Cannot Replace Every PC Yet

Budget cycles do not always line up with Microsoft's calendar. If you need more time, you still have sensible choices:

• Targeted ESU: cover only the machines that must stay on Windows 10, and keep them on a written replacement schedule.
• Cloud desktops: Microsoft states that Windows 10 virtual machines in Windows 365 and Azure Virtual Desktop receive ESU at no additional cost. For some teams, a cloud desktop on older hardware is a practical bridge.
• Isolate what you cannot patch: if a PC runs a machine controller or legacy tool that will never be upgraded, take it off the internet, put it on its own network segment and restrict USB use.
• Phase the hardware spend: replace the oldest and most exposed machines first, such as those used for banking, email and remote access.

Frequently Asked Questions

Will my Windows 10 PCs stop working after 13 October 2026?

No. They keep running. What stops is the flow of security updates for PCs whose ESU coverage has ended, which makes them easier targets over time.

Is Windows 10 ESU worth buying for Year 2?

Only for PCs with a clear reason and a replacement date. As a blanket policy, it costs more each year and delays a move you will have to make anyway.

Can we upgrade old PCs to Windows 11 without new hardware?

Sometimes. Many business PCs from the last few years meet the requirements once TPM and Secure Boot are enabled in firmware. A compatibility check will tell you which ones.

Does antivirus protect an unpatched Windows 10 PC?

Antivirus helps, but it cannot fix vulnerabilities in the operating system itself. It is a layer, not a replacement for security updates.

How Affix Center Helps

Affix Center helps offices across Mumbai and Maharashtra plan and complete this move with minimal downtime. Our IT operations team can run the endpoint inventory, check Windows 11 readiness, test your business applications, and upgrade PCs in planned waves after office hours. Where machines need replacing, we help you size and procure the right hardware, and our cybersecurity services can harden the new setup once it is live.

If your team is still on Windows 10, now is the time to make the plan. Talk to Affix Center for a Windows 10 exit assessment before the next ESU bill arrives.