Every Windows 10 PC still in service needs one of three things this week: a paid ESU licence, a documented isolation plan, or a replacement date someone has signed. Support ended on 14 October 2025, and a machine with none of the three is an unpatched endpoint with a user on it.
Microsoft's pages describe Year One in two ways. Coverage starts at the end-of-support date, while the purchase year is described as starting in November 2025. Read your own licensing record rather than assuming.
Establish what ESU actually covers
ESU is a paid annual subscription that delivers security updates rated critical and important. It does not include new features, customer-requested non-security updates or design change requests. Technical support covers only licence activation, installation and regressions of the ESU itself, and it needs an active support plan.
A device is eligible only on Windows 10 version 22H2. Microsoft's lifecycle page shows 21H2 ended in June 2023 and 21H1 in December 2022, so a PC on either needs a feature update first. LTSC releases follow their own lifecycles beyond October 2025, so filter them out of this exercise.
Check eligibility and keys
Pull the Windows 10 feature version for every non-LTSC machine from your inventory tool and mark anything below 22H2 as ineligible until it is updated. Then check the keys. The ESU Multiple Activation Keys in the Microsoft 365 admin center were not usable until the end-of-support date, so a key sitting there is not proof of coverage.
Confirm activation on each device and record the result. Microsoft's ESU programme overview gives no activation steps. It points to a separate page, "Enable Extended Security Updates (ESU)", so follow that one for commercial environments.
Do the sums
Year One costs $61 per device through volume licensing. The price doubles each year for a maximum of three years, so the full run is $61 + $122 + $244 = $427 per device. You cannot buy partial years, and ESUs are cumulative.
That cumulative rule drives the timing. A device first enrolled in Year Two costs $183, because Year One must be paid too. Compare the figure for your year with a replacement quote plus the time to image the machine and move the user.
Coverage also has a hard stop. Enrolled commercial PCs get updates for a maximum of three years after end of support, so every "Replace by" date must fall before the last paid ESU year ends.
Windows 10 virtual machines in Windows 365, Azure Virtual Desktop and Azure virtual machines get ESU at no extra cost. Check whether any stragglers can move there.
Isolate what ESU will not cover
For any PC without ESU, work from the NCSC guidance on obsolete products. Its position is blunt: nothing in it makes continued use risk-free, and the only fully effective fix is to stop using the product.
Start by cutting the routes untrusted content takes to the machine: email, web browsing, file shares, network ports and removable media. Enforce this technically, because controls that are not technically enforced do not work. If the PC must reach a browser or office apps, make it a thin client for a remote desktop running patched software, with clipboard sharing and file transfer disabled.
Take a CNC controller PC stuck on Windows 10 because the vendor's driver never reached Windows 11. I would give it its own zone, allow traffic only to the file server holding the machine programs, block internet and email outright, disable USB ports and bring files in through a scanning gateway.
Treat every such PC as unmanaged and untrusted, much like a BYOD device. Define the traffic flows between zones, and do not assume the software firewall on a compromised device still works. Where you can, keep obsolete Windows clients in a separate Active Directory forest from the remote desktop service.
Re-imaging may clear resident malware for a while, but the vulnerability it used stays. Do not count it as a fix.
Detection and the people around the machines
Antivirus and intrusion detection still catch some malicious code, but their signatures may not be tuned for attacks on obsolete systems. Do not lean on them.
Logging without alerting achieves little, since many organisations record security events and never act on them. Make sure someone is paged when a legacy machine behaves oddly, and agree in advance who isolates it and how. Our incident response service can help you rehearse that, and managed monitoring can take on the alerting itself.
Also check third parties. Suppliers who connect their own devices may be running unsupported Windows too, so ask before an incident and put their connections in a separate zone.
Make the dated replacement list
The NCSC vulnerability management guidance calls a decision not to update a senior-level risk decision. Put each one in your risk register, with its time and budget, so the owner is visible. When a new vulnerability lands on a machine you cannot patch, triage it first; our CVSS calculator helps with the scoring. Then build a table like this, one row per machine:
| Asset | Owner | Why still on Windows 10 | ESU status | Controls applied | Replace by | Risk accepted by |
|---|---|---|---|---|---|---|
| (hostname) | (name) | (application, driver, budget) | (yes / no) | (zone, no web, no email) | (date, before ESU ends) | (name) |
Every row needs a real date and a named approver. Review the list regularly, because new threats and vulnerabilities can change the answer.
Where to start
- Export your Windows 10 inventory, filter out LTSC devices, and mark anything below version 22H2.
- Check licensing records for ESU keys, confirm each device activated, and compare $427 (or $183 if you enrol in Year Two) per device with your replacement quote.
- Move what you can into Windows 365 or Azure-hosted Windows 10 VMs, where ESU carries no extra charge.
- For the rest, block email, web browsing, file shares, removable media and unneeded ports, and place those machines in a separate zone.
- Turn on alerting for that zone, not just logging, and write down who contains an incident and how.
- Fill in the replacement table with owners and dates inside the paid ESU period, and get a senior person to sign the risk acceptance.
