Windows 10 end of support took effect on October 14, 2025. Since then, Windows 10 devices no longer receive regular security updates, bug fixes or technical support from Microsoft unless they are enrolled in the paid Extended Security Updates (ESU) program. For businesses, unsupported devices increase ransomware risk and can create compliance problems. The practical options are to upgrade eligible PCs to Windows 11, replace ineligible hardware, buy ESU as a short-term bridge, or move users to cloud PCs.
Key Takeaways
- Windows 10 stopped receiving free security updates after October 14, 2025.
- ESU is a temporary, paid bridge for organizations, offered for a limited number of years with prices that increase each year.
- Windows 11 requires TPM 2.0, UEFI Secure Boot and a supported processor.
- Windows 10 virtual machines on Windows 365 and Azure Virtual Desktop receive ESU at no additional cost, according to Microsoft.
- Intune and Autopilot make upgrades and replacements faster and more consistent.
What End of Support Means for Your Business
- Security risk: newly discovered vulnerabilities are not patched on unsupported devices.
- Compliance risk: frameworks such as HIPAA, PCI DSS, SOC 2 and ISO 27001 expect supported, patched systems.
- Cyber insurance: insurers increasingly ask about unsupported operating systems.
- Software compatibility: vendors gradually stop supporting Windows 10.
Your Four Options
| Option | Best for | Considerations |
|---|---|---|
| In-place upgrade to Windows 11 | Hardware that meets requirements | Fastest and lowest cost; test critical apps first. |
| Replace hardware | Older PCs without TPM 2.0 or supported CPUs | Pair with Windows Autopilot for zero-touch setup. |
| Extended Security Updates | Devices or apps that cannot move yet | Temporary bridge only; cost rises each year. |
| Windows 365 or Azure Virtual Desktop | Remote workers, contractors, specialized apps | Cloud PCs can run on older endpoints. |
Step 1: Inventory and Readiness Check
Use Intune, Configuration Manager or Windows Update for Business reports to list every Windows 10 device with its hardware model, TPM version, CPU and Secure Boot status. Flag devices that are eligible for Windows 11 and those that must be replaced.
Step 2: Test Applications
Most Windows 10 applications run on Windows 11, but test line-of-business apps, drivers, VPN clients and security agents with a pilot group. Document any blockers and remediation steps.
Step 3: Plan the Rollout
- Pilot with IT and early adopters.
- Deploy in waves by department or location.
- Use Windows Update for Business feature update policies in Intune to control timing.
- Communicate changes in the Start menu, taskbar and settings to users.
Step 4: Handle Devices That Cannot Upgrade
Budget replacements and use Windows Autopilot so new devices arrive at the user ready to sign in. For specialized devices that cannot change quickly, enroll them in ESU and isolate them on the network until replacement.
Step 5: Harden Windows 11
Use the upgrade to apply security baselines, BitLocker, Windows Hello for Business, Defender for Endpoint and Conditional Access based on device compliance.
Still using Configuration Manager? See our comparison of Intune vs SCCM to plan your management approach.
How Skytech Enterprise Helps
Our Windows 11 migration service covers readiness assessment, app testing, staged deployment with Intune and hardware refresh with Autopilot. For cloud desktops, see Windows 365 Cloud PC and Azure Virtual Desktop. Contact us to plan your upgrade.
Frequently Asked Questions
Will Windows 10 stop working after end of support?
No. Windows 10 PCs continue to run, but they no longer receive security updates unless enrolled in Extended Security Updates, which increases risk over time.
How long can businesses buy Windows 10 ESU?
Microsoft offers commercial ESU for a limited number of years after end of support, with the price increasing each year. Check current terms with Microsoft or your licensing partner.
Is the Windows 11 upgrade free for business PCs?
Eligible Windows 10 Pro and Enterprise devices can typically upgrade to Windows 11 without an additional license cost, provided the hardware meets requirements.
What hardware does Windows 11 require?
Windows 11 requires a supported 64-bit processor, TPM 2.0, UEFI with Secure Boot, at least 4 GB of RAM and 64 GB of storage.
Can we use Windows 10 in the cloud instead?
Windows 10 virtual machines on Windows 365 and Azure Virtual Desktop receive Extended Security Updates without extra charge, which can bridge specialized workloads while you migrate.
Does running unsupported Windows affect compliance?
Yes. Most security frameworks and auditors expect supported, patched operating systems, so unsupported devices can create findings.