Windows 10 at Work After October 13, 2026: Extend, Upgrade or Replace

Every date and price in this article is Microsoft’s own, or simple arithmetic on Microsoft’s list price, and every source is linked, so you can check it yourself.

1. What actually happens on October 13

Windows 10 support ended on October 14, 2025. Free security fixes stopped that day. Since then, for an ordinary office PC on Windows 10, the way to keep getting security fixes has been Microsoft’s paid Extended Security Updates program (ESU for short), which is sold one year at a time:

The PC itself keeps working. Microsoft’s own answer is that support is discontinued, “but the software will continue to function.” What ends on October 13 is the flow of security fixes to any PC that has Year 1 and nothing after it.

It also helps to know what ESU is and isn’t. Microsoft describes it as “critical and important security updates.” It includes no new features, and technical support isn’t included. ESU keeps a PC patched; it doesn’t make it current.

Microsoft’s coverage dates for each ESU year →

2. Why the consumer extension headlines don’t apply to your office

You may have read that Windows 10 security updates now run to October 12, 2027. That is true for Microsoft’s consumer program, which home users can join free (with conditions) or for a one-time fee. It is a different program, and Microsoft is explicit that it is not for business: the consumer program “can’t be used in commercial scenarios.”

Microsoft also says enrollment isn’t offered on PCs joined to a company domain or directory (a central company sign-in system) or enrolled in device-management software (the tools an IT team uses to control PCs remotely). So a PC your company has joined to its domain or enrolled in device management won’t be offered it, and even where it is offered, business use isn’t allowed. For a business PC, the dates in the table above are the ones that count.

Microsoft’s consumer ESU page, with the commercial restriction →

3. Who needs Year 2

Any ordinary business PC that will still run standard Windows 10 after October 13 and should keep getting security fixes needs Year 2. (There are exceptions. Microsoft includes ESU at no extra cost for Windows 10 virtual machines in some of its own cloud services, and Windows 10 PCs used to connect to Microsoft’s own subscription cloud PCs are entitled to it while that subscription is active. Special long-term editions of Windows 10, called LTSC, follow their own schedules. This article is about the everyday office PC.) Four details catch people out:

• Year 1 doesn’t roll over. Year 2 is a separate purchase, and Microsoft’s activation steps use a separate activation ID (a code that switches on one specific year) for each year. So Year 2 has to be installed and activated on each PC; buying it without activating it does nothing for that PC.
• Skipped Year 1? You pay for it anyway. Microsoft says “ESUs are cumulative”: a business that joins in Year 2 pays for Year 1 too. It also can’t buy part of a year.
• The PC has to be ready. Microsoft requires Windows 10, version 22H2 with update KB5066791 or later, and then its ESU licensing preparation package, KB5072653, before the ESU key will work.
• Year 3 is the end. Microsoft sells business ESU for a maximum of three years. After October 10, 2028 there is no Year 4 to buy.

And some PCs don’t need ESU at all. If a PC can run Windows 11, Microsoft’s answer on the upgrade is short: “It’s free.” The catch is that only PCs on Windows 10, version 22H2 that meet the minimum hardware requirements can take it. For those PCs, the upgrade is almost always the better use of your money than a year of ESU.

Microsoft’s ESU prerequisites and activation steps →

5. How to find every Windows 10 machine

You can’t decide PC by PC until you have the list. The fastest start is our free, one-click Windows 10 PC Check: open it on a PC in Microsoft Edge or Google Chrome and it tells you whether that PC runs Windows 10. It runs in the browser and sends nothing to us, so you can send the link to your whole team and ask each person to click once.

Check a PC now with the free Windows 10 PC Check →

Then fill the gaps the one-click check can’t reach:

1. Pull the report. If your PCs are managed, your device-management or asset report can list every Windows 10 machine at once. To check a single PC by hand, press the Windows key and R, type winver, and press Enter.
2. Look where Windows 10 hides. The front-desk PC, the one attached to a lab instrument or large-format printer, the conference-room PC, spare laptops in a drawer that still sign in to email, and home PCs your staff use for work.
3. Test each one for Windows 11. Microsoft’s PC Health Check app checks a PC against the Windows 11 requirements and explains why it does or doesn’t qualify.
4. Write down a decision for each PC: upgrade, replace, or extend with Year 2, with a date. The PCs you extend become next year’s replacement list.

This date and the other IT deadlines coming up are on our deadline tracker.

How to use Microsoft’s PC Health Check app →

6. If you’re in a regulated field

This is not legal advice. We are an IT and security provider, not a law firm, and your compliance counsel has the final word on how any rule applies to you.

For HIPAA covered entities and their business associates, such as many medical and dental practices and the firms that serve them, the HIPAA Security Rule requires a risk analysis: “an accurate and thorough assessment of the potential risks and vulnerabilities” to electronic patient information. It then requires “security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level.” A PC that holds patient information and no longer receives security fixes is the kind of risk a risk analysis should consider, and the risk-management step should address.

The federal Cybersecurity and Infrastructure Security Agency (CISA) lists unsupported software as a bad practice. Its warning is aimed at organizations supporting critical infrastructure: “Use of unsupported (or end-of-life) software in service of Critical Infrastructure and National Critical Functions is dangerous…” CISA also “encourages all organizations to engage in the necessary actions and critical conversations to address Bad Practices.”

45 CFR 164.308, HIPAA administrative safeguards →
CISA’s list of bad practices →