Windows 10 ESU Deadline: 10-Week Migration Plan

Year 2 ESU doubles to $122 USD per device. Here's a week-by-week plan to move your remaining Windows 10 PCs to Windows 11 before October 13.

Windows 10 left mainstream support on October 14, 2025, but for most businesses the real deadline arrives this fall. Year 1 of the Windows 10 ESU program (Extended Security Updates) delivers its final patches on October 13, 2026. After that, every Windows 10 PC in your fleet either needs a Year 2 licence at double the price, or it needs to be running Windows 11. Roughly 10 weeks remain. That's enough time to finish a migration, but only if the project starts this week.

We've spent the past year helping Quebec SMBs through this exact transition, and the pattern is consistent. Companies that treat it as a structured project finish comfortably before the deadline. Companies that wait until October end up buying ESU licences they never planned to buy. Here's the countdown plan we use with clients, built around an Intune fleet audit and a staged Autopilot rollout.

Key Takeaways

Year 1 Windows 10 ESU coverage ends with the October 13, 2026 Patch Tuesday.
Year 2 commercial ESU costs $122 USD per device, double the Year 1 price.
ESU is cumulative: skipping Year 1 then enrolling in Year 2 costs about $183 USD per device.
The free consumer extension to October 2027 excludes domain-joined, Entra-joined, and Intune-managed PCs.
An Intune audit plus a staged Autopilot rollout can migrate a typical SMB fleet in 10 weeks.

What Happens When Windows 10 ESU Year 1 Ends

The ESU program lets organizations keep receiving critical and important security updates for Windows 10 devices after end of support. Year 1 cost $61 USD per device through volume licensing, and the price doubles every consecutive year for a maximum of three years (per Microsoft Learn). That puts Year 2, which runs from October 2026 to October 2027, at $122 USD per device, and Year 3 at $244 USD.

Two details catch businesses off guard. First, ESU is cumulative. Microsoft's documentation is explicit: enrolling a device in Year 2 without having bought Year 1 means paying for both years, about $183 USD per device. Second, the news that circulated in June about Microsoft extending free Windows 10 updates to October 2027 applies only to the consumer program. As BleepingComputer reported, PCs joined to an Active Directory domain or Microsoft Entra, or managed through an MDM like Intune, are excluded from consumer ESU. Your business fleet can't ride on that extension.

There are a few genuine exceptions. Windows 10 virtual machines running in Windows 365, Azure Virtual Desktop, or Azure VMs get ESU at no extra cost, and a physical Windows 10 PC used to connect to a Windows 365 Cloud PC is covered while the subscription stays active. Windows 10 LTSC releases follow their own lifecycle and sit outside this program entirely. For everyone else, the choice is binary: pay double for another year of patches, or finish moving to Windows 11.

Two IT managers reviewing a Windows 11 migration plan with laptops and printed charts

The Math: Year 2 ESU or Finish the Windows 11 Migration

Take a typical 25-PC office that hasn't started. Year 2 ESU for the whole fleet costs $3,050 USD, and at the end of it you face the same decision again at $244 per device. The licences buy patches and nothing else. No new hardware, no performance gains, no feature updates.

Now run the migration numbers. The Windows 11 upgrade itself is free for any Windows 10 PC that meets the hardware requirements: TPM 2.0, a supported processor, and at least 4 GB of RAM. In the fleets we audit, most machines bought after 2019 qualify. If 18 of those 25 PCs are eligible, your real cost is project labour plus replacing 7 aging machines, hardware you'd likely replace within 18 months anyway. Paying for patches on PCs that already qualify for a free upgrade is the worst outcome on the table.

There's a compliance angle too. Quebec's Law 25 expects security measures proportional to the sensitivity of the personal information you hold. Explaining to clients, or to the Commission d'accès à l'information, why a breach came through an operating system you knew was unsupported is not a conversation you want to have.

The 10-Week Countdown Plan

Here's the schedule we run for clients, adjusted to start the week of August 10.

Weeks 1 and 2: Audit the Fleet with Intune

You can't plan what you can't see. If your devices are already enrolled in Intune, the Endpoint analytics "Work from anywhere" report shows Windows 11 hardware readiness for every device: which PCs qualify, which fail, and why. Export it and you have your migration inventory in an afternoon. If your fleet isn't in Intune yet, start there; our step-by-step Intune setup guide walks through enrolment. While you're at it, confirm that any machine likely to need ESU runs Windows 10 22H2 with current cumulative updates, a hard prerequisite for the program.

Weeks 3 and 4: Sort Devices into Three Groups

Split the inventory three ways. Group A is eligible for an in-place upgrade. Group B fails the hardware check and gets replaced. Group C is blocked by a line-of-business application that isn't Windows 11 ready and becomes an ESU exception. Order Group B replacements now; hardware lead times of two to four weeks are common, and you want those devices delivered before week 6. Pick a pilot group of 5 to 10 percent of Group A, weighted toward users who work in your critical applications daily.

Weeks 5 to 8: Staged Windows 11 Rollout with Autopilot

Upgrade the pilot group in week 5 using an Intune feature update policy, then hold a week to catch application issues while the group works normally. Broaden in rings after that: early adopters in week 6, the rest of Group A through weeks 7 and 8. Replacement devices arrive registered for Windows Autopilot, so provisioning means unboxing and signing in; Intune applies your security baseline automatically. If that baseline needs work first, our guide to essential Intune configurations covers the policies worth deploying before the fleet grows. With OneDrive Known Folder Move in place, user data follows the account and most cutovers take under an hour per device.

Weeks 9 and 10: Close Out the Stragglers

Buy Year 2 ESU licences only for the Group C exception list, activate them with the MAK from the Microsoft 365 admin centre, and give every exception a written retirement date tied to an application upgrade. Wipe the replaced machines, confirm BitLocker recovery keys are escrowed before disposal, and update your asset inventory. Done before Patch Tuesday.

Project team gathered around a laptop reviewing Windows 11 deployment progress

Where a Managed IT Partner Fits In

A 10-week migration competes with everyone's day job, and that's usually why it slips. Our managed IT services team runs this as a fixed-scope project: the Intune audit, procurement, Autopilot provisioning, after-hours cutovers, and ESU purchases for genuine exceptions through our licensing channel. If you just want a second opinion on your inventory before deciding, a free IT assessment will tell you where your fleet stands.

FAQ

Can my business use the free consumer Windows 10 ESU until 2027?

No. The consumer program Microsoft extended through October 12, 2027 covers personal devices only. PCs joined to an Active Directory domain or Microsoft Entra, or managed through an MDM such as Intune, are explicitly excluded. Business-managed devices need commercial ESU licences or an upgrade to Windows 11.

How much does Windows 10 ESU Year 2 cost for a business?

Year 2 costs $122 USD per device through volume licensing, double the $61 Year 1 price. ESU is also cumulative, so a device that skipped Year 1 pays for both years, about $183 USD. Canadian dollar pricing varies by licensing partner, and Year 3 doubles again to $244 USD.

Is the Windows 11 upgrade free for my Windows 10 PCs?

Yes, for eligible hardware. Any Windows 10 PC with a valid licence that meets the requirements, including TPM 2.0 and a supported processor, upgrades to Windows 11 at no licensing cost. The real costs of a migration are project time and replacing the machines that fail the hardware check.

What happens if we do nothing after October 13, 2026?

Your Windows 10 PCs keep working, but they stop receiving security updates. Every vulnerability disclosed afterward stays open permanently, which raises ransomware risk and weakens your position under Quebec's Law 25 if personal information is ever compromised on an unpatched machine.

Sources

Ten weeks is tight but workable, and every week of delay moves more devices from the upgrade column to the ESU column. If you'd rather hand the countdown to a team that has run it before, contact us and we'll scope your migration this week.

Windows 10 ESU Ends October 13, 2026: Your 10-Week Plan