Windows 10 extended security updates: year one ends on 13 October

Published: 6 October 2026

Windows 10 reached end of support in October 2025. Plenty of businesses weren’t ready to move every machine, so they bought Microsoft’s Extended Security Updates (ESU) to keep the stragglers patched for another year. That year ends on Tuesday 13 October 2026.

Nothing on the screen will change on the 14th. That’s the problem. A PC that quietly stops receiving security fixes looks exactly like one that doesn’t, right up until something gets in through a hole that was patched for everyone else.

To make it more confusing, you may have read that the deadline moved. It did, but only for personal PCs. For most business machines, 13 October is still the date that matters.

What actually ends on 13 October

Commercial ESU is sold one year at a time, for up to three years. Microsoft’s published coverage windows are: year one to 13 October 2026, year two from 14 October 2026 to 12 October 2027, and year three to 10 October 2028 (Microsoft Lifecycle FAQ).

Three details catch people out:

• It doesn’t auto-renew. Each year is a separate purchase. Microsoft’s partner guidance is explicit that these licences don’t renew (Partner Center).
• Each year needs its own key. Year two has its own activation ID, so buying it isn’t enough. The new key has to be deployed to every covered PC (Microsoft Learn).
• It’s cumulative. You can’t skip year one and buy year two. If you didn’t enrol last year, catching up means paying for both.

The same day, support also ends for Office LTSC 2021, the one-off-purchase version of Office, along with Project and Visio LTSC 2021 (Microsoft announcement). If you bought Office outright a few years ago to avoid a subscription, check which version it was.

“Didn’t Microsoft extend it?”

Partly. In June 2026 Microsoft extended the consumer ESU programme, the one for personal PCs, to 12 October 2027, with existing enrolments carrying on automatically (Microsoft). That’s the change most of the headlines were about.

It doesn’t help most businesses. Consumer ESU excludes devices joined to an Active Directory domain or Microsoft Entra ID, or enrolled in device management such as Intune. In other words, it excludes almost every properly managed business PC. If someone in your business enrolled their work laptop through the free consumer route, it’s worth checking whether that device was eligible in the first place.

What year two costs, and what it’s really buying

Microsoft priced year one at US$61 per device and says the price doubles each consecutive year (Microsoft Learn). On that rule, year two is around US$122 a device and year three around US$244. Microsoft doesn’t publish sterling prices, so your actual figure depends on how you buy and the exchange rate on the day.

Put that next to a replacement PC and the maths gets simple quickly. A machine that needs year two and year three is costing you more than a third of a modest new business laptop, purely to stand still, and it still won’t run Windows 11 at the end of it. ESU makes sense for a small number of machines you genuinely can’t move yet: the PC running a piece of production kit, or the one awkward application waiting on a supplier. It makes no sense as a fleet strategy.

The Cyber Essentials problem

If you hold Cyber Essentials, or a customer or insurer expects you to, this is the bit that bites. The scheme requires all in-scope software to be licensed and supported, with critical and high-risk updates applied within 14 days (NCSC requirements v3.3).

IASME, which runs the scheme, is clear about Windows 10: a device enrolled in ESU and implemented correctly is compliant, and one that isn’t enrolled is treated as unsupported and won’t pass (IASME knowledge hub). So a year-one PC that drifts out of coverage on the 14th turns into a non-compliant device in scope. If your renewal is coming up, that’s a fail waiting to happen. If it isn’t, your certificate now describes an environment you no longer have.

The fix is either to cover it, replace it, or take it out of scope properly: isolated, with no internet access. “We’ll just not mention it” isn’t on the list.

What keeps updating anyway (and why that isn’t enough)

Two things carry on regardless of ESU. Microsoft 365 Apps will keep getting security updates on Windows 10 until 10 October 2028, though feature updates stop at version 2608 (Microsoft Learn). And Microsoft Defender’s security intelligence updates continue through at least October 2028.

Neither of those patches Windows itself. Up-to-date Outlook and antivirus on an unpatched operating system is a nicely painted front door on a house with no back wall. Attackers don’t need the front door.

Your options, most sensible first

1. Upgrade what can be upgraded. Windows 11 needs TPM 2.0, Secure Boot capable UEFI firmware and a processor on Microsoft’s supported list (requirements). The PC Health Check app will tell you per machine. Plenty of PCs bought since 2018 qualify and have simply never been upgraded.
2. Replace what can’t. If it fails the hardware check and it’s a normal office PC, replacement is almost always cheaper than two more years of ESU.
3. Buy year two only for the genuine exceptions, with a written reason and a date each one will be retired. That turns ESU back into what it was meant to be: a bridge, not a destination.
4. Consider the cloud for the awkward ones. Windows 10 virtual machines in Azure Virtual Desktop and Windows 365 receive ESU at no extra cost. Physical Windows 10 PCs used to reach Windows 365 Enterprise Cloud PCs can also qualify, subject to conditions such as Entra join and regular sign-in (Microsoft Learn).

How to check where you stand this week

• Count the Windows 10 machines. Your device management or RMM tool should list operating system versions. If you don’t have one, that’s a finding in itself.
• For each, know its ESU status: never enrolled, year one only, or year two bought and its key deployed.
• Run PC Health Check on anything not yet on Windows 11, and note what’s blocking the rest.
• Look for Office 2021 LTSC and other one-off Office installs reaching end of support.
• Check your Cyber Essentials renewal date against the list above.
• Make sure patching is reported, not assumed. A device that stops receiving updates should show up as a problem on someone’s dashboard, not as silence.

If you’d like a second pair of eyes, our free security and IT health check covers device support status and patching alongside the rest of your environment, in writing. Or see how we keep managed devices patched and on supported software, and why that matters for Cyber Essentials.