Windows 10 ESU Year Two: The Cost Curve Says Finish Your Refresh
Windows 10 reached end of support in October 2025. One year on, the only supported way to keep a Windows 10 business PC patched is Microsoft’s Extended Security Updates (ESU) program, which is now in its second year and covers enrolled commercial devices through October 2027. The consumer version of ESU was a one-year arrangement and has already ended, so from this point forward ESU is strictly a business licensing decision.
The short version for anyone still carrying Windows 10 machines: year two is available, enrollment is cumulative — you cannot skip year one and pay only for year two — and the per-device price roughly doubles each year of the program. Microsoft built ESU as a bridge with a rising toll, and by year two the math starts favoring finishing the hardware refresh over renewing again.
How ESU year two works
- Coverage window. Year two runs through October 2027. A third and final year takes commercial coverage to October 2028, and then the program ends for mainstream business use. There is no year four to plan around.
- Cumulative enrollment. A business that never enrolled and wants in now also pays for year one. Arriving late does not save money; it just delays the bill.
- Version requirement. Devices must be on Windows 10 22H2 and current on servicing updates to receive ESU patches. A machine that has drifted behind needs to be brought current first.
- Security-only. ESU delivers critical and important security fixes. No feature updates, no non-security bug fixes, and no general Microsoft support for Windows 10 problems.
- Cloud carve-outs. Windows 10 devices used primarily to reach Windows 365 Cloud PCs, and Windows 10 virtual machines running in Azure, are entitled to ESU at no extra charge. If part of your fleet is really a thin client into a cloud desktop, the math changes for those specific machines.
What a year of ESU does not fix
ESU keeps known vulnerabilities patched. It does not make Windows 10 a supported platform in any broader sense. New peripherals and hardware increasingly ship without Windows 10 drivers. Software vendors are steadily dropping Windows 10 from their support matrices, which means a line-of-business application can lose vendor support on that PC no matter what Microsoft patches. Microsoft 365 Apps continue receiving security updates on Windows 10 for a while longer, but running them there is an unsupported configuration, and all feature development targets Windows 11.
There is also the paperwork problem. Cyber insurance questionnaires and client security reviews increasingly ask whether every endpoint runs a supported operating system. "Supported through a paid extension we intend to renew" is an answer you have to explain. "Windows 11 on current hardware" is not.
The cost curve is doing exactly what it was designed to do
We are deliberately not quoting per-device prices here — they vary by licensing channel and change, so check current pricing with your licensing provider. The structure is what matters: the price roughly doubles each year, and the cumulative rule means late joiners pay for the years they skipped. Run year-two-plus-year-three ESU across a few dozen machines and you are a meaningful way toward the cost of simply replacing them with hardware that arrives with a warranty, better performance, and a supported operating system for the next five years. ESU spend buys nothing durable. Hardware spend does.
The case for finishing the refresh now
Most machines still on Windows 10 at this point are there for one of two reasons: they fail the Windows 11 hardware requirements — TPM 2.0 and a supported processor generation — or nobody got around to them. The second group is a scheduling problem, not a technical one; upgrade them in place and be done. The first group is generally hardware from around 2018 or earlier, which puts those machines past a sensible replacement age regardless of what Microsoft charges for patches.
A staged finish works better than a scramble. Inventory what is left and why each machine is still on Windows 10. Replace the oldest and most exposed first — anything used for email, browsing, or remote access carries more risk than an isolated shop-floor box. Run replacements in monthly waves so setups stay routine instead of becoming a project, and set the end date ahead of the October 2027 renewal so you are not writing another ESU check by default.
Where year two genuinely makes sense
ESU is not a mistake in every case. A PC that drives specialized equipment — a machine controller, a lab instrument, a piece of imaging gear — may be pinned to Windows 10 by its vendor, and replacing the attached equipment is a capital decision on its own timeline. A line-of-business application certified only on Windows 10 with a vendor fix in progress is a fair reason to buy a year. So is a small remainder of machines already scheduled for retirement mid-cycle. The common thread: ESU should cover a named list of exceptions with an exit date, each one isolated and watched more closely than the rest of the fleet — not a whole company’s default plan.
Decide before the renewal, not at it
The worst outcome is renewing every October because the refresh never got planned, paying a doubling toll for hardware that gets older and slower each year. A year after end of support, the businesses in the best shape are the ones that treated ESU as scaffolding and kept building. Managed IT from Equal Tech Solutions covers the whole path: inventorying what is left on Windows 10, handling ESU enrollment for the true exceptions, and running a staged Windows 11 refresh that fits your budget. We serve businesses in Cleveland, Chattanooga, and across the Southeast US. Contact Equal Tech Solutions to get the last of your Windows 10 fleet on a real exit plan.