Windows 10 ESU Year One Ends on 13 October 2026: The Windows 11 Readiness Plan for Small and Mid-Size Businesses

Windows 10 reached end of support on 14 October 2025. Every security update those devices have received since has come from the Extended Security Updates programme, and for organisations that programme is sold in three one-year terms. Year one ends on 13 October 2026. Year two runs to 12 October 2027, year three to 10 October 2028, and Microsoft has announced nothing beyond that.

So for most businesses 13 October 2026 is not the day the lights go out. It is a renewal decision with a price attached, taken with two years of runway left at most — and one you want to make on purpose rather than discover on an invoice.

Be precise about what ESU is. It delivers security updates rated Critical and Important, and nothing else: no new features, no non-security fixes, no technical support for Windows 10 itself. It is a bridge with a toll booth on it. The engagement that gets a fleet across is our Windows 11 migration and Windows 10 ESU transition service, and the whole point of the ESU line in it is that it ends.

In June 2026 Microsoft extended the consumer ESU programme by a year. Personal-use devices are now covered through 12 October 2027, which Microsoft states on its consumer ESU page. Enrolment happens from Windows Update, at no charge if you sync your PC settings with Windows Backup, for 1,000 Microsoft Rewards points, or as a one-time purchase of $30 plus applicable tax.

That headline travelled far, and it has reassured business owners who should not be reassured. The consumer programme is for personal devices. Microsoft excludes devices joined to an Active Directory domain or to Microsoft Entra ID, devices enrolled in a mobile device management solution, devices in kiosk mode, and devices already carrying a commercial ESU licence.

Read that list against your own estate. If your laptops are domain-joined or sitting in Microsoft Intune — which is the entire point of managing them — the 2027 date is not yours. Yours is 13 October 2026.

One nuance, because it comes up with owner-operators and contractors: a personally owned machine that is merely Microsoft Entra registered — the state you get when someone adds a work account to their own PC — is not an Entra-joined company device and can still use the consumer route. That is a fair answer for a handful of personal machines. It is not a fleet strategy.

Commercial ESU is licensed per device, per year, and bought either through volume licensing or through a Cloud Solution Provider partner, with a minimum of one licence. Microsoft's ESU fees are Microsoft's charges to you, on your agreement, and they sit separately from any partner's service fee. Ask for that split in writing.

Four mechanics decide how painful your renewal is.

The years are cumulative, not a menu. If you skipped year one and want coverage now, you buy year one as well as year two. Waiting does not save the earlier year's cost; it defers and then compounds it.

The price rises at each renewal. That escalation is the design of the programme, which is why every device you put on ESU should carry a written exit date. Confirm the current list price and which SKU you are quoted before you commit — the cloud-managed licence and the key-based one are not the same product line.

The prerequisites take a patch cycle. A device has to be on Windows 10 version 22H2, with the current cumulative update and the ESU licensing preparation package installed, before it can be enrolled. Machines months behind on patching cannot be licensed the week before the date and left to sort themselves out.

Activation depends on how the device is managed. Estates patched through WSUS or Configuration Manager deploy a Multiple Activation Key to each endpoint. Devices managed in Intune or Windows Autopatch have the licence assigned to the device object in the cloud instead — no key to inject, and enrolment state visible in reporting. If the fleet is not in Intune yet, that is the piece to fix first, because it is also what delivers the upgrades.

Two entitlements are easy to miss. Microsoft's documentation gives Windows 10 version 22H2 session hosts in Azure Virtual Desktop ESU automatically, and a Windows 10 device used to connect to a Windows 365 Cloud PC is entitled to ESU while that subscription is active. Check the overlap before you buy ESU twice.

The mistake that turns this into a crisis is treating the fleet as one project with one answer. It is four answers, applied device by device, and the split is decided by a hardware check you can run this week.

Upgrade the machines that qualify. Windows 11 needs TPM 2.0, UEFI with Secure Boot, a supported 64-bit processor, 4 GB of memory and 64 GB of storage. The upgrade itself is available at no additional Microsoft charge for eligible, licensed Windows 10 devices, so on qualifying hardware it is much the cheapest path. Deliver it as an in-place upgrade through Intune feature update policies in rings — pilot first, then waves — which preserves applications, settings and user data.

Check the near-misses before you write them off. Plenty of devices that fail a readiness scan fail on firmware rather than silicon: TPM switched off in the BIOS, or the machine still booting in legacy mode instead of UEFI. Those are configuration fixes, not capital expenditure, and finding them is the highest-value hour in the assessment.

Bridge only what genuinely cannot move. Buy ESU for the specific devices that must stay in service, each with a named owner and a date it comes off. A short, shrinking, costed list is a plan; a blanket renewal across the fleet is a subscription to the problem.

Replace or re-host the rest. If a machine was due for replacement anyway, the refresh quote and the ESU quote are the same conversation, and new hardware arrives ready for Autopilot and zero-touch deployment so nobody images anything by hand. Where the user needs a current managed desktop and there is no hardware budget, a Cloud PC turns the old machine into a viewer for a Windows 11 desktop you control. Either way, device migration automation moves the user state across.

There are about five working weeks between today and 13 October 2026. Spend them in this order.

First, count. Pull the device list from Intune, then reconcile it against your RMM tool, Active Directory and your DHCP leases. The machines that hurt are always the ones missing from one of those lists: the reception PC, the machine in the workshop, the laptop of the person who left. Record edition, Windows 10 version, TPM state, Secure Boot state, processor and owner.

Second, decide per device, in writing, with a name and a date against each row. Anything undecided at the end of that week defaults to the ESU bridge, which should be a choice rather than a surprise in November.

Third, start the ESU paperwork now if any bridge devices exist. Procurement through a CSP partner or volume licensing is not instant, and the 22H2 baseline plus the licensing preparation package needs a patch cycle to land. The licence has to be live before 13 October, not ordered that week.

Fourth, do the reversible work first. Run the pilot ring on machines whose users can tolerate a bad afternoon, confirm the applications behave, then open the waves. Leave the finance workstation and the machine wired to the label printer until the pattern holds.

Fifth, write down what is still on Windows 10 on 14 October 2026 and what is wrapped around it: which devices, whose ESU licence, which exit date, and what happens if the licence lapses. That document is what your insurer, your auditor and your board will ask for.

The dates that follow this one are on our Microsoft deadlines page, and several land in the same twelve months, so sequence them together rather than one panic at a time.

Whoever does this work, ours or anyone else's, a few questions separate a plan from a pitch.

Which devices are you proposing to upgrade, which to bridge on ESU, and what is the exit date for each bridge device? If the answer to the last part is silence, the proposal is a renewal, not a migration.

Which ESU SKU, at what current list price, and on whose bill? Microsoft's ESU fees are yours, billed on your agreement. A partner's fee for doing the work should be a separate, stated line.

What does it take to get the fleet into Intune first, if it is not there already? Cloud-assigned ESU licences, feature update rings and the reporting that proves compliance all depend on it, and an ongoing managed Intune service is a different commitment from a one-off setup. Ask which one you are buying.

How are applications tested before the waves start, and what is the rollback if an in-place upgrade fails halfway? An answer that does not mention a tested backup is not an answer.

And what is fixed price, what is hourly, and when do I pay? We quote project work in writing before it begins and take payment after you approve delivery. Ask for the same commitment wherever you go.