Windows 10 business ESU Year 1 has ended: a practical plan for Australian SMEs

Year 1 of Microsoft's paid business Extended Security Updates (ESU) for Windows 10 finished on 13 October 2026 (Microsoft Learn). Free security updates had already stopped a year earlier, on 14 October 2025 (Microsoft). Years 2 and 3 of business ESU are still available, but each year costs more.

So if your office still has Windows 10 PCs, now's a good time to stop and make a plan. That's not because every PC is suddenly broken. It's because a "we'll sort it later" decision has quietly turned into a recurring bill.

This post is about desktops and laptops. If you're also running old servers, our Windows Server 2016 end-of-support plan covers that side.

What has ended, and what's still available

A few details matter for small businesses:

• Business ESU costs more each year. Microsoft lists Year 1 at US$61 per device, and the price doubles each year for up to three years. It's sold by the whole year only, so you can't buy six months (Microsoft Learn). Check local pricing with your licensing partner.
• Late joiners pay for the years they missed. ESU is cumulative, so buying in Year 2 means paying for Year 1 as well (same source).
• It only covers Windows 10 version 22H2, and it's security fixes only. No new features and no general technical support (same source).
• The consumer program isn't meant for businesses. Microsoft says it can't be used in commercial scenarios. It isn't offered for kiosk-mode devices, or for PCs joined to Active Directory or Microsoft Entra, or enrolled in device management (Microsoft).
• Antivirus doesn't replace updates. Microsoft's own FAQ makes this point: without operating system security updates, the system itself stays exposed (Microsoft).

Step 1: Find every Windows 10 machine

Most businesses can name their office PCs. It's the other ones that get missed:

• the reception or front-counter PC
• the warehouse or workshop computer that runs the label printer or a machine controller
• a kiosk, sign-in screen or time clock
• the spare laptop in a drawer, or the one a staff member takes home
• the PC "only used for" the old accounting file, or one supplier's portal

To check a single machine, go to Settings > System > About and look under Windows specifications for the edition and version (Microsoft Support). The same page shows the processor and RAM, which you'll need for Step 2.

If your devices are already managed in Microsoft Intune or a similar tool, it can usually give you this list for the whole fleet. Microsoft's own guidance points to Intune and Windows Autopatch for upgrading eligible PCs (Microsoft Learn). If nothing is managed centrally, a simple spreadsheet works fine. List the device, the user, its location, the Windows version, the CPU, the RAM, and what it's used for.

Step 2: Work out what's blocking each upgrade

When a business is still on Windows 10, there's usually one of four reasons.

The hardware doesn't meet Windows 11's minimums. Windows 11 needs a compatible 64-bit processor, 4 GB RAM, 64 GB storage, UEFI with Secure Boot, and TPM 2.0 (Microsoft Learn). Older PCs often fall short on the processor or the TPM. If a PC is eligible, the upgrade from Windows 10 Home or Pro to the same Windows 11 edition is free through Windows Update (Microsoft).

A line-of-business app. This might be an old practice-management, job-costing, stock or POS program, or something built in-house years ago. Ask the vendor whether it's supported on Windows 11. If there's no vendor any more, that's your real problem, and it goes well beyond the PC.

Peripherals and drivers. Label printers, scanners, card readers, lab or workshop equipment. Check that drivers exist for Windows 11 before you commit.

"It works, so leave it." That's understandable. But a PC can work fine and still be unpatched.

Don't forget Office, too. Office 2016 and 2019 are already out of support, and Office 2021 and 2024 run on Windows 10 but aren't supported there (Microsoft).

Step 3: Decide what happens to each machine

Give every device one of these four labels:

1. Upgrade in place. The hardware meets the requirements and your apps and peripherals are supported on Windows 11. This is usually the cheapest option. Test one PC first, then do the rest.
2. Replace. The hardware fails the requirements, or the PC is old enough that paying for ESU on it doesn't make sense. Budget for it now, not when it dies.
3. Move the workload to the cloud. This suits an old app that only a few people use, or staff who just need a secure desktop from anywhere. Microsoft offers ESU at no extra cost for Windows 10 virtual machines in Windows 365, Azure Virtual Desktop and Azure VMs. Windows 10 PCs connecting to a Windows 365 Cloud PC are covered for up to three years while the subscription is active (Microsoft Learn). It's a bridge for running the old app while you work out its future. It isn't a permanent home for it.
4. Short ESU bridge. Use this only for a specific machine with a specific reason and an end date. For example, "this PC runs the old job system until the replacement goes live in March". Because Year 2 costs double Year 1 and late buyers pay back-years, paying for ESU on every PC is rarely the cheapest option.

If several machines end up stuck on the same old app, the PCs aren't really the problem. The system is. Our post on legacy system modernisation for Australian businesses covers how to approach that without a big-bang rewrite.

Owner checklist

• List every Windows 10 device, including kiosks, warehouse PCs and spare laptops
• Record version, CPU, RAM and TPM status for each
• Ask each software vendor in writing whether their app supports Windows 11
• Check drivers for printers, scanners and specialist equipment
• Label each device: upgrade, replace, cloud, or ESU bridge (with an end date)
• For any ESU bridge, confirm the device is on 22H2 and get a quote that includes any back-years
• Put replacements into this financial year's budget
• Check Office versions while you're there
• Set a date to review the list again before 12 October 2027

What OrionX would build

The plan above works on a spreadsheet. For a business with more than a handful of PCs, a few small pieces of tooling make it faster and stop the list going stale:

• A device inventory pull. A script that queries Intune or Microsoft Entra (via Microsoft Graph), or runs a small PowerShell check on unmanaged PCs, and writes each device's Windows edition and version, CPU, RAM, TPM and Secure Boot status into one table. No walking around with a clipboard.
• A readiness report. Each device scored against the Windows 11 minimums, joined to what it's used for and which apps it runs, so every PC lands in one of the four buckets automatically. Anything that can't be decided gets flagged for a human.
• An app compatibility register. One row per line-of-business app and peripheral: vendor, Windows 11 support status, who asked and when, and the devices that depend on it. That's how you find the one old app holding up ten PCs.
• Upgrade waves with a pilot. Eligible PCs grouped into rings in Intune or Windows Autopatch: one test machine, then a small group, then everyone, with a rollback plan for each wave.
• A cloud desktop for the stuck app. Where an old app has no Windows 11 path yet, it can run on a Windows 365 Cloud PC or Azure Virtual Desktop while we work out whether to replace it or rebuild it.
• A simple tracking view and reminders. A dashboard showing counts by status, plus an alert for any ESU-bridge device that's coming up to its end date, so "temporary" doesn't become another year.

Need a hand sorting it out?

Usually the hard part isn't the upgrade itself. It's the one old app, or the PC nobody remembers is running something important. That's the kind of thing we untangle for SA businesses.

Start with a free 20–30 minute chat about where your machines and systems are at. If it's a good fit, we'll follow up with one free demo tailored to your setup (one per business). No pressure, just a clear picture of what to do next.

Sources

• Microsoft: End of support for Windows 10
• Microsoft Learn: Product Lifecycle FAQ – Extended Security Updates
• Microsoft Learn: Extended Security Updates (ESU) program for Windows 10
• Microsoft: Windows 10 Consumer Extended Security Updates
• Microsoft Learn: Windows 11 requirements
• Microsoft Support: Find information about your Windows device