Windows 10 support has ended. What now?

Microsoft ended support for Windows 10 on 14 October 2025. Windows 10 no longer gets security updates, bug fixes or technical support. Any device still running it is a risk you carry every day.

What end of support means

• No security patches. New flaws are found each month and are never fixed on Windows 10.
• No bug fixes. If something breaks, it stays broken.
• No support. Microsoft no longer helps with Windows 10, and software vendors drop it over time.

Extended Security Updates (ESU)

Microsoft sells Extended Security Updates for up to three more years. ESU buys time, but the price doubles each year.

Year	Price per device	For 100 devices
Year 1	$61	$6,100
Year 2	$122	$12,200
Year 3	$244	$24,400

ESU comes on top of your existing licences. It delays the problem and does not solve it.

The risks of staying on Windows 10

Flaws stay open. Microsoft patched over 900 Windows vulnerabilities in 2024, many critical and open to remote attack with no user action. Such flaws now stay open on Windows 10.

Compliance. HIPAA, PCI DSS, SOC 2, CMMC and the NIST CSF expect supported, patched software. An unsupported system can bring audit findings, fines or lost clients.

Cyber insurance. Policies increasingly require patching and current software. An insurer may deny a claim from a breach on an unpatched Windows 10 machine.

Ransomware. Attackers target known, unpatched flaws. WannaCry in 2017 used a Windows flaw that had been patched months before but was never applied.

Other software. As vendors drop Windows 10, business apps and security tools stop working well on it.

Six steps to Windows 11

1. Take an inventory

List every Windows 10 device with its processor, RAM, TPM version and age. List every application and its version, and mark the business-critical ones. Map each device to its user and department.

Microsoft Intune, PDQ Inventory or Lansweeper can find devices for you.

2. Check the hardware

Requirement	Windows 11 minimum
Processor	1 GHz, 2 or more cores, 64-bit
RAM	4 GB, with 8 GB advised for business
Storage	64 GB, with 128 GB or more advised
TPM	Version 2.0
Firmware	UEFI with Secure Boot
Display	9 inches diagonal, 720p

TPM 2.0 is the most common blocker. Many computers made before 2018 lack it. Microsoft’s PC Health Check tests one device, and Intune or SCCM report on many.

Sort devices into three groups.

1. Compatible devices are ready to upgrade.
2. Upgradeable devices need a BIOS update or a setting, such as turning on the TPM.
3. Incompatible devices must be replaced.

3. Test your applications

Most Windows 10 apps run on Windows 11. Test these before you roll out.

• Line-of-business apps your work depends on.
• Industry software that needs a specific Windows version.
• Custom apps that rely on particular Windows features.
• Drivers for printers, scanners, lab instruments and manufacturing controls.

Build a Windows 11 test machine and ask each vendor to confirm support.

4. Set the budget

• Hardware. Business laptops cost $800 to $1,500 each, and desktops $600 to $1,200. Add monitors, docks and peripherals.
• Licences. Microsoft 365 Business Premium and Enterprise include Windows 11. Otherwise Windows 11 Pro costs $199 per device.
• Labour. Allow 2 to 4 hours per device to back up data, set up the machine and install apps.
• Training. The new interface takes a little learning, more for less technical staff.
• Downtime. Allow half a day per user.

5. Roll out in phases

Phase	Weeks	Who
Pilot	1 to 2	5 to 10 confident users from different departments
Early adopters	3 to 4	20 to 30 users, at least one per department
General rollout	5 to 12	Everyone else, 10 to 20 a week, highest-risk roles first
Exceptions	13 to 16	Special workstations, meeting room machines and fixed apps

Avoid each department’s busy periods.

6. Tell people early

• Announce the timeline at least 60 days ahead.
• Explain that the reason is security.
• Give each user or department its date.
• Ask staff to back up personal files and note their printers.
• Offer training before and after.
• Set up one channel for questions.

Which hardware to replace

Laptops four or more years old usually need replacing anyway, since they fail more and cost more to keep. Compatible devices two or three years old are worth upgrading in place. Devices one or two years old should almost all be compatible.

If the budget is tight, replace in this order.

1. Incompatible devices used by finance, HR and executives.
2. Incompatible devices used for regulated work.
3. The oldest devices, most likely to fail.
4. The slowest devices, which cost the most time.
5. Every other incompatible device.

Leasing, or device as a service, spreads the cost over 36 to 48 months and includes warranty and support. It typically costs $30 to $60 per device each month.

Application notes

• Microsoft 365 apps all support Windows 11. If you still run Office 2016 or older, move to Microsoft 365.
• Web apps work the same on both systems.
• Line-of-business apps cause the most trouble. Ask each vendor for its Windows 11 timeline, and find another if it has none.
• Custom apps can break on hardcoded paths, retired Windows features or old drivers. Test them early.

If you still run Windows 10

1. Buy ESU for each remaining device.
2. Move the riskiest devices first. These hold sensitive data, face the internet or belong to privileged users.
3. Add compensating controls, such as network segmentation, closer monitoring, application allow-listing and limited internet access.
4. Shorten the ESU period to cut cost.
5. Write down the risk, so leadership accepts it knowingly.

Every month on ESU adds cost and risk.

Questions people ask

Can we skip Windows 11?

No. Windows 10 stopped getting security updates on 14 October 2025, and Microsoft has announced no successor to Windows 11.

How many PCs will need replacing?

A three- or four-year refresh usually leaves 10% to 20% incompatible. A fleet of five years or more can reach 40% to 60%. Only a full compatibility check will tell you.

How much disruption should we expect?

With planning, most users lose under half a day. Settings and data can move in advance, and Microsoft 365 data is already in the cloud. Reinstalling apps and learning the new interface cause most of the delay.

Home or Pro for business devices?

Always Pro or Enterprise. Home lacks BitLocker, Group Policy, Azure AD join, Remote Desktop hosting and Hyper-V.

Is an in-place upgrade safe?

Yes, for most devices, and it keeps files, settings and apps. A clean install on new hardware avoids carrying old problems forward. Most organisations use both.