Windows 10 End of Life: How to Stay Secure After October 14, 2025 #

Extended Security Updates (ESU) and Your Upgrade Options #

Windows 10 reaches end of support on October 14, 2025. After that date, most PCs will no longer receive security or quality updates. Your computer will keep working, but risk rises over time. This page explains your options and how to stay protected.

Your Three Choices #

1. Upgrade to Windows 11
   If your PC meets requirements like TPM 2.0 and Secure Boot, you can upgrade for free and keep getting full updates. This is the best long-term path. (Free Windows 11 compatibility tool)
2. Replace the PC
   New PCs ship with Windows 11 and modern security features. This is the simplest path if your system is older.
3. Use Windows 10 Extended Security Updates (ESU)
   ESU gives enrolled Windows 10, version 22H2 devices ongoing critical and important security updates after Oct 14, 2025. This is a bridge while you plan your upgrade. Consumer ESU runs through October 13, 2026.

Important: ESU only adds security updates. It does not add features or performance improvements.

For Business and IT: ESU Basics and Deployment #

What Businesses Get #

• ESU provides monthly critical and important security updates for Windows 10, version 22H2.
• It is meant as a temporary bridge to Windows 11. Not a permanent solution.
• ESU is a paid subscription that extends security updates for Windows 10, version 22H2, after Oct 14, 2025. It covers critical and important updates only.
• Business ESU enrollment is available in 1 year ($61), 2 year ($122), and 3 year ($244) extensions at a cost. The total cost to extend for all 3 years is $427. Some Azure-hosted scenarios and Windows 365 Cloud PCs include ESU at no extra cost.

Coverage Duration #

Commercial and education organizations can receive security updates for up to three years after end of support for Windows 10.

Prerequisites #

• Devices must run Windows 10, version 22H2, and have KB5046613 or later installed to enable ESU keys.
• You need administrative privileges on each device.

How to Enable ESU in Commercial Environments #

1. Obtain ESU licenses through your licensing program and retrieve ESU product keys in the Microsoft 365 admin center.
2. Install and activate the ESU key on each device. (For MAK scenarios, this can include commands like installing the key and activating it.)
3. Use your management stack to scale deployment: Intune, WSUS, Configuration Manager, or script-based rollout.
4. Track which devices have ESU and which are moving to Windows 11. ESU is a bridge, not a destination.

Cloud and Virtualization Scenarios #

No additional ESU configuration or keys are needed for Windows 10 VMs in Azure Virtual Desktop, Azure VMs, Azure Dedicated Host, Azure Local (Azure Stack HCI), Azure Stack Hub, Azure Stack Edge, and Windows 365. Windows 10 devices accessing Windows 365 Cloud PCs can also be entitled to ESU if Microsoft Entra conditions are met.

Pros and Cons of Each Path #

🏢 Business & Enterprise FAQ #

🕒 When does Windows 10 support end? #

Microsoft will end support for Windows 10 on October 14, 2025. After that date, devices running Windows 10 will no longer receive security or quality updates unless enrolled in the Extended Security Updates (ESU) program.

🔐 What are Extended Security Updates (ESU)? #

ESU is a Microsoft program that delivers critical and important security patches for Windows 10 devices after the end-of-support date. It allows organizations to maintain security compliance while completing a phased migration to Windows 11 or cloud-based environments.

💼 Who qualifies for the business ESU program? #

Any organization running Windows 10 Version 22H2 can purchase ESU coverage through:

• Microsoft Volume Licensing
• Cloud Solution Provider (CSP) partners
• Microsoft 365 Admin Center (for small businesses)

📅 How long does business ESU coverage last? #

ESU extends updates for up to three years beyond the end of support — through October 2028. Each year is licensed separately and must be renewed annually.

💲 How much does ESU cost for business devices? #

Pricing varies by licensing channel, but Microsoft provides the following estimates:

• Year 1: about $61 per device
• Year 2: about $122 per device
• Year 3: about $244 per device
  
  Azure-based devices and Windows 365 Cloud PCs may qualify for free ESU coverage.

🧩 Which editions of Windows 10 are eligible? #

Eligible editions include:

• Windows 10 Pro
• Windows 10 Enterprise
• Windows 10 Education
• Windows 10 IoT Enterprise

All devices must be running Version 22H2 and have current servicing-stack updates installed.

⚙️ How do we activate ESU licenses? #

1. Obtain ESU MAK or Volume Licensing keys.

2. Run these commands on each device (or deploy via Intune/SCCM):

   slmgr /ipk <ESU_product_key>
slmgr /ato


3. Verify activation in Settings → System → About → Windows activation.

☁️ Can ESU be managed through Microsoft Intune or Azure? #

Yes. ESU keys and update policies can be deployed through:

• Microsoft Intune
• Configuration Manager (SCCM)
• Windows Server Update Services (WSUS)
• Azure Update Management

💻 Are Azure or virtual devices covered automatically? #

Yes. Devices running Windows 10 in these environments receive ESU at no extra cost:

• Azure Virtual Machines (VMs)
• Azure Virtual Desktop (AVD)
• Windows 365 Cloud PCs
• Azure Stack HCI, Hub, and Edge

🔐 What updates are included in ESU? #

ESU only includes critical and important security fixes. It does not include new features, non-security fixes, or performance updates.

📦 Can we mix ESU and Windows 11 devices? #

Yes. Many organizations run hybrid fleets. Track Windows 10 ESU-enrolled devices separately in your RMM, Intune, or ConnectWise Manage for compliance.

🧾 Does ESU help meet compliance requirements? #

ESU helps maintain patch-management compliance by ensuring ongoing security updates. However, it’s not a permanent compliance solution — unsupported systems should still be replaced or upgraded to Windows 11 as soon as possible.

🧠 What’s the best strategy for small businesses? #

1. Inventory all devices and confirm Windows 10 22H2.
2. Upgrade eligible systems to Windows 11 now.
3. Purchase ESU for devices that can’t upgrade immediately.
4. Plan replacements or migrations before 2028.

🕹️ Can we enroll shared, kiosk, or IoT devices? #

Yes. ESU supports shared and embedded systems running Windows 10 Enterprise or IoT Enterprise editions.

🔒 What happens after ESU ends in 2028? #

Windows 10 will stop receiving all updates permanently.
Microsoft recommends completing migration to Windows 11 or Windows 365 Cloud PCs before the final ESU year.

🧰 What should my business do right now? #

• Confirm every Windows 10 device is on version 22H2.
• Identify which PCs will upgrade vs. need ESU.
• Obtain licenses early through your CSP or Volume Licensing provider.
• Build a Windows 11 migration timeline with vendor support by 2026.

Practical Next Steps #

• Small businesses: Decide which devices to upgrade now and which to protect with ESU. Prepare licensing, keys, and deployment via Intune or WSUS. Document a Windows 11 migration timeline.

Sources #

• Extended Security Updates (ESU) program for Windows 10 — Microsoft Learn. Details on scope, cost, limitations, and duration.
• Enable Extended Security Updates (ESU) — Microsoft Learn. Commercial prerequisites, activation endpoints, and deployment guidance.