If your business bought a year of Extended Security Updates for its Windows 10 PCs last fall, that year runs out on October 13, 2026. After that date, any PC that has not been upgraded, replaced or moved to Year 2 stops receiving security fixes. It will look exactly the same on the desk. That is the problem.
We covered the background and the upgrade path in Still on Windows 10? This article is about the decision in front of you this month: which PCs get a second year, and which do not.
The dates and the math (as of October 2026)
Extended Security Updates (ESU) is Microsoft’s paid program that keeps delivering critical and important security fixes to Windows 10 after its end of support. Microsoft’s lifecycle FAQ lists the business coverage periods:
| ESU year | Coverage ends |
|---|---|
| Year 1 | October 13, 2026 |
| Year 2 | October 12, 2027 |
| Year 3 (last) | October 10, 2028 |
On its ESU program page, Microsoft lists Year 1 at $61 USD per device through volume licensing and states that “the price doubles every consecutive year.” By that formula, Year 2 is $122 per device and Year 3 is $244. Microsoft also says ESU is cumulative: a business joining in Year 2 pays for Year 1 as well, so a late joiner pays $183 per device to be covered through October 2027.
Put another way, keeping one Windows 10 PC covered through the final year costs $427 in ESU fees alone, by Microsoft’s published formula. That is a meaningful share of the price of a new business PC, spent on a machine that will still have to be replaced.
Sort every PC into one of four piles
Go through your Windows 10 PCs one at a time. Each belongs in one pile.
- Can run Windows 11: upgrade it. If the PC meets Microsoft’s requirements, an in-place upgrade is usually cheaper than another year of ESU. Test your line-of-business software on one machine first.
- Cannot run Windows 11 and is due for replacement anyway: replace it. Paying $122 to keep an old PC limping for a year rarely makes sense when the replacement is already in the budget.
- Runs one application that will not work on Windows 11: buy Year 2, with a plan. Specialized equipment and older software are the legitimate reasons for ESU. Buy the year, and in the same meeting, set a date and a budget to retire the dependency.
- Nobody really uses it: retire it. Every office has a PC in a back room that “might be needed”. Wipe it properly and take it off the network.
If a replacement PC is ordered but will not arrive before October 13, a short gap is a real risk. Shipping to Alaska takes time. Either buy Year 2 for that machine or keep it off sensitive work and email until the replacement is in place.
If you buy Year 2, activate it
This is the step most often missed. Year 2 is a separate license with its own activation. Microsoft’s ESU setup instructions list a different activation ID for each year, and each PC must have the correct year’s license installed and activated. A PC with only Year 1 activated stops receiving updates after October 13, even though you paid for Year 2.
Once activated, check it. Confirm that each covered PC shows the Year 2 license as active, and that it actually installs the November security update. “We bought it” and “it’s working” are two different things.
Other things ending on October 13, 2026
- Windows Server 2012 and 2012 R2: according to Microsoft’s lifecycle FAQ, the third and final ESU year for these servers ends the same day. There is no further paid option for servers running on your own hardware. If one still runs your accounting system or file shares, it needs to be migrated now.
- Windows 11 version 24H2 (Home and Pro): Microsoft’s release information shows servicing for these editions also ends October 13, 2026. PCs already on Windows 11 need to be on version 25H2 to keep receiving updates.
If the deadline has already passed
You can still enroll. ESU is cumulative, so you pay for the year you missed, and the PC receives the updates it has been missing once it is activated and patched. The longer an unprotected PC sits on your network, the more newly discovered weaknesses pile up on it, so do not let “we’ll sort it out later” become next spring.
Why not just skip it?
A Windows 10 PC without security updates keeps working. It also becomes an easier way into your network each month, because attackers can study the fixes Microsoft releases for supported versions of Windows and look for the same weakness on machines that did not get them. Cyber insurance questionnaires often ask about unsupported systems, and one exposed PC can be the doorway to your file server and email.
The decision is not “pay or save”. It is “pay a little for a bridge, or replace now”, with a firm date on every bridge.
How FTI helps
Our managed IT service, built on Kaseya, keeps a live inventory of every PC we manage: its Windows version, whether it can run Windows 11, and which ESU year it has activated. Our AI-assisted operations flag the machines that do not match the plan, and our engineers work through them. We buy and activate ESU where it is justified, keep those PCs on our tested patch schedule (see timely, not rushed), and plan replacements so they arrive before they become emergencies.
