| Windows 10 end of life is the end of support for standard Windows 10 version 22H2, which came on 14 October 2025. PCs still work, but devices without applicable Extended Security Updates no longer receive the regular Windows security fixes they need. Some specialist editions have different dates. |
Support for standard Windows 10 version 22H2 ended on 14 October 2025. PCs still work, but devices without applicable Extended Security Updates no longer receive the regular Windows security fixes they need. Some specialist editions have different dates, so check the edition before deciding what to do.
The next step for a business is to sort the remaining PCs into three groups: upgrade to Windows 11, replace, or keep temporarily under commercial ESU. The right choice depends on hardware compatibility, business applications and how long each device is still needed. This guide covers each option, the current ESU dates, what happens to Microsoft 365 Apps and Secure Boot, and how to plan the move.
What does Windows 10 end of life mean for a business?
From 14 October 2025, Microsoft stopped releasing regular security updates, feature updates and general technical support for standard Windows 10 version 22H2, including the Home, Pro, Enterprise and Education editions. Microsoft’s Windows 10 release information confirms that the October 2025 update was the final one for those versions.
Nothing switches off. The PC starts, applications open and files stay where they are. The change is that newly discovered vulnerabilities may remain unpatched on devices without applicable updates. Previously installed protection does not disappear, and not every vulnerability affects every edition, build or configuration, but the exposure grows as new issues are found and left unfixed.
Do all Windows 10 editions share the same date?
No. The 14 October 2025 date applies to standard version 22H2. Long-Term Servicing editions (LTSB and LTSC) and IoT editions have separate lifecycles. For example, Windows 10 Enterprise LTSB 2016 reaches the end of its extended support on 13 October 2026, while LTSC 2019 runs into 2029. Check the exact edition and version of each device rather than treating Enterprise as one support category.
Is there a difference between end of support and end of life?
The terms are used interchangeably here. Microsoft uses end of support to describe the date it stops providing updates and assistance for a product. For planning, what matters is whether each device is still receiving the security updates it needs, either through a supported Windows version or through ESU.
Which option fits each Windows 10 device?
Sort each remaining device by its situation rather than its age. A fleet can end up with a mix of upgrades, replacements and a small number of temporary exceptions.
| Device situation | Practical next step |
|---|---|
| Eligible hardware and compatible applications | Pilot a supported Windows 11 release, then schedule the rollout. |
| Eligibility blocked by a setting or firmware | Check the vendor-supported fix, protect recovery access, then retest. |
| Ineligible or unreliable hardware | Plan replacement, including applications, files, peripherals and secure disposal. |
| A business dependency prevents migration | Check commercial ESU eligibility, activate and verify updates, and assign a migration owner and date. |
Give every device kept on the old system a named owner and a planned end date. A temporary exception without a date can become permanent.
How do you check whether a PC can run Windows 11?
Microsoft’s Windows 11 requirements set a higher bar than Windows 10. A device needs all of the following:
- Processor. A compatible 64-bit processor with two or more cores at 1 GHz or faster.
- Memory and storage. At least 4 GB of RAM and 64 GB of storage, though business workloads need more.
- Firmware. UEFI firmware that is Secure Boot capable.
- TPM. Trusted Platform Module version 2.0.
- Graphics and display. DirectX 12 compatible graphics and a high-definition display.
Device age and processor generation are rough clues only. Microsoft’s processor guidance points individual customers to the PC Health Check app, and across a fleet a device management tool or an IT provider can report eligibility for every machine at once.
What if a device fails the check?
Find the reason before deciding to replace the device. A TPM may be built into the firmware but switched off, or Secure Boot may be disabled. A supported firmware or configuration change can resolve these, but confirm that BitLocker recovery keys are stored and a backup is current before changing firmware settings. Rerun the check afterwards. If the processor itself is unsupported, replacement or ESU are the realistic paths.
Does meeting the minimum mean a device is suitable?
No. The minimum requirements establish eligibility, not whether a device will run your workload well. A machine with 4 GB of RAM may qualify but struggle with Microsoft 365, a browser and line-of-business software open together. Consider the condition of the battery, storage and screen as well.
Should you upgrade to Windows 11?
For eligible devices with compatible applications, upgrading is the long-term answer. The upgrade from Windows 10 is free for eligible devices, and it returns the PC to a supported operating system with regular security updates.
Two checks matter before the rollout. First, install a Windows 11 release that is still in support for your edition. Microsoft’s Windows 11 release information shows that version 24H2 Home and Pro reach end of servicing on 13 October 2026, while version 25H2 runs to 12 October 2027 for those editions. Enterprise and Education editions have longer servicing periods. Moving a PC onto a Windows 11 release that is about to end would only create another deadline.
Second, test business applications, drivers and peripherals on a representative device. Printers, scanners, VPN clients, label printers and specialist software are worth checking first. Microsoft Intune can manage the upgrade and the update policies afterwards.
How does commercial ESU work for Windows 10?
Extended Security Updates provide critical and important security updates for version 22H2 after the end of support. Microsoft’s commercial ESU guidance is clear about what ESU does not include: new features, non-security fixes, design changes or general technical support beyond ESU activation and installation issues.
Commercial ESU runs for a maximum of three years, in fixed annual coverage periods set out in Microsoft’s partner guidance:
| Commercial ESU period | Coverage dates |
|---|---|
| Year 1 | 15 October 2025 to 13 October 2026 |
| Year 2 | 14 October 2026 to 12 October 2027 |
| Year 3 | 13 October 2027 to 10 October 2028 |
The years are cumulative. Buying late does not start a fresh twelve-month period, and a device joining in year two also requires year one. The per-device cost doubles each year, and Microsoft publishes the current pricing on its ESU page. Confirm eligibility, channel pricing and deployment effort before committing.
Can a business use consumer ESU?
No. Microsoft’s consumer ESU page states that the consumer programme cannot be used in commercial scenarios. Consumer coverage now runs to 12 October 2027, and existing consumer enrolments continue automatically, but it is not a licensing shortcut for business PCs.
Does ESU make Windows 10 safe to keep?
ESU keeps a device receiving security updates, but it does not restore ordinary product support or add features. Confirm that ESU is activated on each device and that the updates actually install. Endpoint protection and network restrictions can reduce exposure further, but they do not replace operating system updates.
Is ESU cheaper than replacing a PC?
It can be for a short period. Compare the ESU cost for the period you actually need with the device’s condition, the work needed to migrate it and the cost of a replacement. Because the cost rises each year and the coverage periods are fixed, ESU is useful when there is a specific reason to delay, such as a line-of-business application waiting on a vendor update, and a plan to finish the move.
Where a device fails the Windows 11 check and is already near the end of its working life, replacement may make more sense. Hardware lifecycle planning helps time replacements across the fleet, and Device as a Service or IT hardware leasing can spread the cost. Retired PCs still hold business data, so plan secure IT disposal as part of the replacement.
What happens to Microsoft 365 on Windows 10?
Microsoft 365 Apps continue to run. Microsoft’s guidance on Microsoft 365 Apps on Windows 10 says the apps receive security updates through 10 October 2028. Feature updates stop at version 2608, with the timing depending on the update channel.
Support is limited. If an issue does not occur on Windows 11, Microsoft may ask you to move to Windows 11 to resolve it, and support cases for those apps cannot request bug fixes or product changes. Keep the boundary clear: app updates do not patch Windows itself, and Windows ESU does not restore full Microsoft 365 Apps support. This timeline applies to Microsoft 365 Apps, not to every perpetual Office edition or third-party application.
What about other business software?
Check each critical application with its vendor. Some vendors stop supporting their products on an unsupported operating system, which can affect new versions, fixes and help-desk support. Record the answer for each application in the device inventory so it informs the upgrade, replace or ESU decision.
Why do Secure Boot certificates matter?
Secure Boot checks that trusted software starts the PC. Microsoft explains in When Secure Boot certificates expire on Windows devices that the original 2011 certificates began expiring in June 2026. An affected device continues to start and install standard updates, but it can lose the ability to receive new protections for the early boot process.
Many devices receive the new certificates through Microsoft-managed updates, but some need an OEM firmware update or administrative action. Do not assume that Windows 11 or an ESU licence proves the certificates are in place. Verify the deployment status on each device, and include firmware updates in the migration plan.
What should the Windows 10 migration plan include?
Record each device’s owner, Windows edition and version, hardware eligibility, critical applications and ESU status. Test a representative device before the wider rollout, including printers, scanners, VPN access and specialist software. Confirm backups and recovery keys, allow for rollback, and check that security tools and updates are working after the move.
Record every device
List the owner, edition, version, hardware eligibility, critical applications and ESU status. An IT asset management register keeps this current.
Test a representative device
Check applications, drivers, printers, scanners, VPN access and specialist software on a supported Windows 11 release.
Protect recovery
Confirm backups and BitLocker recovery keys, and agree how to roll back if a device has problems.
Roll out in waves
Move devices in groups, prioritised by exposure and business impact, so the whole team is not disrupted at once.
Verify afterwards
Check that security tools, updates and Secure Boot certificates are in place on each upgraded or replacement device.
Prioritise by exposure and business impact, not age alone. A newer, unpatched laptop used for sensitive work may need attention before an older device already covered by ESU. An IT roadmap folds the work into the wider technology budget.
Tell staff when their device will move, what will change and how long it will take. Ask them to save work to OneDrive or SharePoint beforehand, and check afterwards that their files, signatures and browser bookmarks are in place. A short guide to the new Start menu and settings, with a clear route to the IT helpdesk, helps the first week go smoothly.
Does Windows 10 affect insurance or privacy obligations?
Cyber insurance cover depends on your policy wording, the disclosures you made and the facts of an incident. Some proposal forms ask whether systems are supported and patched. Ask your broker or insurer how your policy treats unsupported systems and devices covered by ESU, and keep your answers accurate. Our guide to cyber insurance explains what insurers look at.
Under the Privacy Act, businesses must protect personal information with security safeguards that are reasonable in the circumstances. Unsupported software can increase risk when assessing whether safeguards are reasonable, but the operating system label alone does not establish a breach, and upgrading alone does not establish compliance. Our guide to Privacy Act security safeguards covers the wider duty.
Windows 10 support from Exodesk
Exodesk can help you check device compatibility, plan replacements and roll out Windows 11. For devices that need to stay where they are for a while, we can arrange and activate commercial ESU and confirm that updates are installing. Exodesk has supported New Zealand businesses since 1989. Today, our Christchurch and Dunedin teams support businesses nationwide.
See our managed IT services or contact us to discuss the PCs still running Windows 10 and the applications they support.
Frequently Asked Questions
When did Windows 10 reach end of life?
Support for standard Windows 10 version 22H2 ended on 14 October 2025. PCs still work, but devices without applicable Extended Security Updates no longer receive regular Windows security fixes. Some LTSC and IoT editions have different dates.
Will my Windows 10 PC stop working?
No. The PC continues to start and run applications. Newly discovered vulnerabilities may remain unpatched on devices without applicable updates, so the exposure grows over time.
Is it safe to keep using Windows 10 for business?
Without ESU, the device no longer receives the regular security updates it needs. Endpoint protection can reduce exposure but does not replace operating system updates. Upgrade, replace or cover the device with commercial ESU while you plan the move.
Can a Windows 10 PC upgrade to Windows 11 for free?
Yes, if the device meets the Windows 11 hardware requirements. Install a Windows 11 release that is still in support for your edition, and test business applications and peripherals first.
Which Windows 11 version should we upgrade to?
Use a release still in support for your edition. Windows 11 version 24H2 Home and Pro reach end of servicing on 13 October 2026, while version 25H2 runs to 12 October 2027 for those editions. Enterprise and Education editions have longer servicing periods.
How do I check if a computer can run Windows 11?
Run the PC Health Check app on an individual device, or use a device management tool to report eligibility across the fleet. If a device fails, find the reason first, because a disabled TPM or Secure Boot setting may be fixable.
What are Extended Security Updates for Windows 10?
ESU provides critical and important security updates for version 22H2 after the end of support. It does not add features or restore general technical support. Commercial ESU is available for up to three years in fixed annual periods.
What are the commercial ESU dates?
Year 1 runs from 15 October 2025 to 13 October 2026, year 2 from 14 October 2026 to 12 October 2027, and year 3 from 13 October 2027 to 10 October 2028. The years are cumulative, so joining in year two also requires year one.
Is ESU cheaper than replacing a PC?
It can be for a short period. Compare the ESU cost with the device condition, the work needed to migrate it and the cost of a replacement. Commercial ESU becomes more expensive each year and uses fixed annual coverage periods, so it suits a specific reason to delay and a plan to finish.
Can a business use consumer ESU?
No. Microsoft states that the consumer ESU programme cannot be used in commercial scenarios. Business devices need commercial ESU.
Will Microsoft 365 still work on Windows 10?
The apps can continue to run, and Microsoft provides security updates for Microsoft 365 Apps on Windows 10 through 10 October 2028. This does not extend Windows support or remove the need for Windows security updates. Support options are limited, so plan the operating system move as well.
What happens when Secure Boot certificates expire?
An affected device continues to start and install standard updates, but it can lose the ability to receive new protections for the early boot process. Some devices need a firmware update or administrative action, so verify the certificate status on each device.
Does running Windows 10 affect cyber insurance?
It depends on your policy wording, your disclosures and the facts of an incident. Ask your broker or insurer how the policy treats unsupported systems and devices covered by ESU.
Where should a business start?
Start with a device inventory that records the owner, edition, version, Windows 11 eligibility, critical applications and ESU status. Then sort devices into upgrade, replace or ESU, and give every exception an owner and an end date.
NEXT STEP
Plan the remaining Windows 10 devices
Exodesk can help you check device compatibility, plan replacements and roll out Windows 11. Contact us to discuss the PCs still running Windows 10 and the applications they support.
Or see our managed IT services.
