Windows 10 ESU Year Two: Why Replacing the Machines Beats Renewing

If your business bought Windows 10 Extended Security Updates (ESU) last year, you bought time. That time runs out on October 13, 2026, when the first year of Microsoft's commercial ESU program ends. On October 14, year two begins, and the price per device doubles.

For most small and mid-sized businesses, the right move is not to renew. It's to replace the machines that are still on Windows 10 and be done with it. Here's why.

Microsoft priced commercial ESU at $61 per device for the first year, and the price doubles each year for a maximum of three years. Year two runs from October 14, 2026 through October 12, 2027 at $122 per device. Year three, if you went that far, would be $244 per device.

Coverage is also cumulative. A business that skipped year one and decides to buy now pays for year one as well. Microsoft doesn't sell partial years, so there's no paying for a few months while you figure things out.

You may have seen headlines that Microsoft extended free Windows 10 updates. That extension applies to home users with personal Microsoft accounts. Business devices aren't covered by it.

ESU delivers security patches, and that's all. No new features, no fixes for everyday bugs, and no technical support from Microsoft. The machine doesn't get faster, the battery doesn't hold a charge any longer, and the hardware is no less likely to fail. You're paying to keep an aging computer patched for twelve more months, nothing more.

Windows 11 requires relatively modern hardware, including a TPM 2.0 security chip and a processor from roughly 2018 or later. In most cases, the machines that couldn't make the jump are from 2018 or earlier, which makes them eight years old or more. Most businesses plan to replace computers every four to five years, so these devices are well past that point and almost certainly out of warranty.

That changes the math. $122 this year plus $244 next year is $366 per device, a meaningful share of the price of a new business-class laptop, spent on a machine you will still have to replace.

If some of your Windows 10 machines are actually eligible for Windows 11, the upgrade itself is free. There's no reason to pay ESU on those at all.

The ESU invoice is the visible cost. The less visible ones add up faster.

Old hardware fails on its own schedule, not yours. Aging drives, batteries, and fans tend to give out at the worst possible time, and a failed machine means lost work and an emergency purchase at whatever price is available that week.

Every exception takes someone's time. A handful of Windows 10 machines in a Windows 11 environment means a separate update track, extra compatibility checks, and more things to keep track of. That's time your IT team or provider isn't spending on anything else.

Insurers and auditors ask about it. Cyber insurance applications and security questionnaires routinely ask whether you run unsupported operating systems. ESU keeps the devices technically patched, but "we're paying extra to keep eight-year-old machines running" isn't a strong answer, and it gets harder to defend each year the program winds down. Our guide to cyber insurance IT requirements covers what underwriters are looking for.

The replacement doesn't get cheaper by waiting. It just lands in a year where you've also paid double for ESU.

There's one narrow case. If a specific machine runs software or equipment that genuinely can't move to Windows 11 yet (a computer that controls a piece of shop floor equipment, for example, or a line-of-business application the vendor hasn't certified), buy year two for that device only. Document why, and set a date to retire it.

ESU works as a planned exception with an end date. It doesn't work as the default plan for the whole fleet.

Start with an inventory of every device still running Windows 10: make, model, age, and who uses it.

Then sort them into three groups. Machines that are eligible for Windows 11 should be upgraded now, at no license cost. Machines that aren't eligible should be replaced. True exceptions, the ones tied to software or equipment that can't move yet, are the only ones that should get year two ESU, each with a documented retirement date.

Order replacements now. New machines need to be set up to your standards, and lead times on business hardware can stretch in the fall.

Whatever doesn't fit this year's budget belongs in your 2027 plan, not in another year of ESU. Our post on IT budgeting for 2027 covers how to prioritize.

If replacements for a few machines genuinely can't arrive before October 14, covering those specific devices for year two while the rollout finishes is reasonable. Just set the end date now, so year two doesn't quietly turn into year three.