Every Windows version has a retirement date; Windows 10's was October 14, 2025. Since that day, Microsoft ships it no technical support, no feature updates, and no quality updates — including security and reliability fixes — unless the machine is enrolled in Extended Security Updates (ESU). The PC keeps working. The protection is what stopped.
That sentence is doing a lot of work, so be clear about what it means: every vulnerability discovered from now on stays open forever on an unprotected Windows 10 machine. Attackers know the retirement calendar as well as anyone, and out-of-support Windows versions have historically been where ransomware lives longest.
What actually ended
- Security updates. The monthly patches that close newly found holes. This is the one that matters.
- Quality and reliability fixes. Bugs found after October 2025 stay bugs.
- Technical support. Microsoft no longer takes Windows 10 support cases.
- Feature updates. Ended long before; nothing new was coming anyway.
What did not end: activation, sign-in, your files, your applications. Nothing switches off. Which is exactly why so many machines are still running it — the danger produces no symptoms.
The consumer lifeline: ESU to 2027
The widely reported story through 2025 was that home users got one year of extended updates, ending October 2026. That is no longer true. Microsoft's consumer ESU page now states enrolled devices are protected through October 12, 2027, and there are three ways to enroll:
- Free. Sync your PC settings to your Microsoft account (Windows Backup) and the fee is waived.
- 1,000 Microsoft Rewards points. Points most people have accumulated without noticing.
- $30 USD. One time, plus tax — and a single enrollment covers up to 10 devices on the same Microsoft account.
The conditions: the machine must be on Windows 10 version 22H2 with current updates installed, and you must sign in with a Microsoft account that has administrator rights — a local-only account cannot enroll. ESU delivers security fixes only: no features, no support line.
For a household or a sole proprietor, this is genuinely good value. Ten devices, two more years, for free or thirty dollars. There is no scenario where an eligible machine should be left unenrolled.
Business ESU and its doubling clock
Organizations get a different deal, priced to make delay expensive. Per Microsoft's ESU documentation: $61 USD per device for Year One through volume licensing, and the price doubles every consecutive year, for a maximum of three years. It is cumulative — buy in later and you still pay for the years you skipped. Run the math on a 20-seat office that waits until Year Three and you are past $8,500 USD to keep old machines on life support.
Two useful exceptions: Windows 10 running as a virtual machine on Windows 365 or Azure services gets ESU at no extra cost, and physical Windows 10 PCs used to connect to a Windows 365 Cloud PC are entitled to ESU for up to three years with an active subscription.
The three-year business window closes in October 2028, and the schedule only rises. If your fleet still has Windows 10 machines, the budgeting question is not whether to move — it is which machines upgrade free, which get replaced, and in what order.
The decision, honestly
- Check eligibility first. If a machine meets the Windows 11 requirements — TPM 2.0, UEFI with Secure Boot, a supported processor — the upgrade is free and the whole question evaporates. Our checklist on whether to upgrade to Windows 11 walks through it.
- Enroll everything else in ESU today. Free or $30 for consumers; there is no reason to run exposed while you decide.
- Plan replacements for the ineligible. A PC that cannot run Windows 11 is generally seven or more years old. ESU buys time to replace it on your schedule instead of in a panic — use the time, but set the date.
- Do not run unpatched. Not for a month. One in four Canadian organizations were hit by ransomware in the past year, per the CIRA 2025 Cybersecurity Survey. Unpatched operating systems are precisely how those stories start.
For a single machine, our repair bench handles upgrades, ESU enrollment and honest replace-or-keep advice. For a fleet, this is a standard piece of a managed IT plan — inventory, eligibility report, staged upgrades, and the stragglers enrolled in ESU with an exit date attached. Take a brief.
Frequently asked questions
No. It boots, runs, and behaves exactly as before. What stopped on October 14, 2025 is the flow of security fixes — every newly discovered vulnerability now stays open on an unenrolled machine, permanently. The risk is invisible and it compounds monthly.
Yes, with a trade: Microsoft waives the fee if you sync your PC settings to a Microsoft account, or redeem 1,000 Microsoft Rewards points. Otherwise it is a one-time purchase of $30 USD plus tax, and one enrollment covers up to 10 devices on the same account.
Enrolled consumer devices receive security updates through October 12, 2027. That is the final date — ESU delivers security fixes only, no new features and no technical support, and the machine must be on Windows 10 version 22H2 to qualify.
Through volume licensing it is $61 USD per device for Year One, and the price doubles every consecutive year for a maximum of three years. It is also cumulative — join in Year Two and you pay for Year One as well. That pricing is designed to push migration, not fund delay.
ESU is a bridge, not a destination. If the machine meets Windows 11 requirements, the upgrade is free — take it. If it does not, weigh the ESU fee plus the machine's age against a replacement: a PC too old for Windows 11 is typically seven or more years old and near the end of its useful life anyway.