Windows 10 end of support for business: ESU, Windows 11 or replacing your PCs

The short answer: Windows 10 has been out of support since 14 October 2025, and the right response differs from one PC to the next. A compatible PC moves to Windows 11. An incompatible PC is replaced or moved to a virtual desktop. Microsoft’s ESU programme, which is paid and time-limited, is only a bridge for machines that cannot move right away, for instance because of a business application. This guide helps you sort your fleet, avoid the ESU traps and choose the right Windows 11 version.

At ALLSAFE SOLUTIONS, a Microsoft partner, we handle these migrations from Casablanca as part of our managed IT services in Morocco. The dates and conditions quoted here come from Microsoft’s official documentation, checked in November 2026.

What changed on 14 October 2025

A Windows 10 PC does not stop working, which is exactly what makes the topic misleading. Microsoft stopped providing three things:

• technical support;
• feature updates;
• quality updates, including security and reliability fixes.

In practice, every vulnerability found after that date stays open on PCs that are not covered. Our alerts show this almost every month, as with the October 2026 Microsoft patches: fixes for Windows 10 exist, but only PCs enrolled in ESU are entitled to them. For a business, these PCs also weigh on an ISO 27001 project or a customer’s security questionnaire: you will have to explain why they remain unpatched.

The sorting to do, PC by PC

Start from a complete inventory, then place each machine in one of these situations.

PC situation	Recommended action	Watch out for
Compatible with Windows 11, applications validated	Migrate to Windows 11	Backup and pilot group testing
Compatible, but business application not validated	ESU in the meantime, while asking the vendor for a compatible version	Set an exit date
Incompatible and old	Replace the PC	Secure erasure and recycling
Incompatible and recent, or budget to spread	ESU for a limited time, then replacement	The price doubles every year
Drives a specialised machine or device	Isolate on the network, ESU, then review with the supplier	Cut internet access if possible
Windows 10 Home used at work	Move to a business edition or replace	Home is outside commercial ESU
Windows 10 Enterprise LTSC	Handle separately (see below)	Different lifecycle

For the renewal itself, whether buying, leasing or subscribing, see our guide on renewing your IT fleet. ALLSAFE can also supply PCs and licences, with or without installation.

Checking Windows 11 compatibility

Microsoft publishes the following minimum requirements:

Item	Windows 11 requirement
Processor	1 GHz or faster, two or more cores, 64-bit, compatible model
Memory	4 GB or more
Storage	64 GB or more available
Firmware	UEFI, Secure Boot capable
Security module	TPM version 2.0
Graphics	DirectX 12 or later, WDDM 2.0 driver
Display	High definition 720p, 9 inches or larger

For a direct upgrade, the PC must also run Windows 10 version 2004 or later, with the 14 September 2021 security update or newer. These are minimums: a PC with 4 GB of memory meets the rule, but it will be a struggle for someone working in Microsoft 365 and a heavily used browser.

As for tools, the PC Health Check app suits the Home, Pro and Pro for Workstations editions. For a managed fleet, Microsoft points to its management tools, such as Endpoint analytics in Intune. On a small fleet, a standard inventory is enough, as long as it records the processor, the TPM, UEFI boot mode and Secure Boot status.

Watch out for false negatives: a TPM that is present but disabled in the firmware, or a PC still booting in legacy BIOS mode, can appear incompatible. Check these settings before writing a machine off. Converting a disk for UEFI takes preparation and deserves a backup first.

ESU for businesses: what it covers and its traps

ESU stands for Extended Security Updates. The commercial programme applies to the Enterprise, Education and Pro editions in commercial use, and only to PCs on Windows 10 version 22H2.

ESU period	Coverage until
Year 1	13 October 2026 (ended)
Year 2	12 October 2027
Year 3, the last	10 October 2028

What it provides. Security updates rated critical and important, nothing more. No new features and no customer-requested non-security fixes. Support is limited to licence activation, installation of the updates and possible regressions.

The traps we come across:

1. Assuming that joining in Year 2 costs one year only. Licences are cumulative: joining today means paying for Year 1 as well, and the price doubles each year. Partial periods cannot be bought.
2. Forgetting activation. Buying the licence is not enough. Each PC needs the MAK key, then the activation ID specific to each year, after the prerequisite updates are installed (KB5066791 or later, then the KB5072653 preparation package). A PC that is not activated stays unpatched, even if the licence is paid for.
3. Choosing consumer ESU. It cannot be used in commercial scenarios and is not offered to devices joined to Active Directory or Microsoft Entra, or managed by an MDM.
4. Confusing ESU with support. Microsoft will not handle an application or printing problem on Windows 10.
5. Forgetting the exit date. After 10 October 2028, no further extension is planned for these editions.

The programme is sold through Microsoft volume licensing, from one licence upwards. Ask your reseller for the price when you decide, as it varies with the agreement and the period.

An alternative worth knowing. Microsoft includes ESU at no additional cost for Windows 10 running in Windows 365 or Azure Virtual Desktop, and on Azure virtual machines. A Windows 10 PC connecting to Windows 365 Cloud PCs is also entitled to it, for up to three years, with an active subscription. This route can suit a business application that will not migrate, and is worth reviewing as part of a Microsoft 365 and Azure cloud project.

Which Windows 11 version to target

Do not migrate to a version close to the end of its servicing. Microsoft publishes these dates in its lifecycle pages:

Version	Home and Pro: end of servicing	Enterprise and Education: end of servicing
23H2	Ended	November 2026
24H2	October 2026 (ended)	October 2027
25H2	October 2027	October 2028
26H2	October 2028	October 2029

For a fleet on Pro, 26H2 offers the longest runway, provided your applications and drivers are validated. Without a management tool, also keep an eye on PCs already on Windows 11: a Pro PC still on 24H2 is no longer up to date either. Our patch management guide explains how to track these versions.

Getting the Windows 11 migration right

1. Take inventory: hardware, edition, version, applications, printers and peripherals.
2. Validate critical applications: ERP, accounting software, VPN client, antivirus or EDR, scanner and printer drivers. Ask the vendor for written confirmation when needed.
3. Back up data and check that restores work, especially for files left on the local disk. See our backup and business continuity services.
4. Check BitLocker: recovery keys must be stored and accessible before any change. Our guide on BitLocker in business covers this in detail.
5. Test on a pilot group representing each business function, before any wider rollout.
6. Roll out in waves, avoiding sensitive periods such as accounting closes. The upgrade is a large download: schedule it so that it does not saturate a shared internet link.
7. Keep a way back: the option to return to the previous version is only available for 10 days after the upgrade.
8. Check afterwards: version, activation, active protection, encryption and business applications.

Which tools? On an Intune-managed fleet, a feature update policy lets you target a specific Windows version. It requires Intune Plan 1 and a Windows licence with the Autopatch entitlement, to be checked on your subscription, as explained in our Microsoft Intune for SMBs guide. Windows Update client policies (formerly Windows Update for Business) avoid offering the upgrade to non-compliant devices. On a few unmanaged PCs the upgrade can be done by hand, but this is also the right moment to set up central management.

A question of rights may also come up. If your users are still administrators of their PCs, use the migration to fix this, as explained in our guide on admin accounts and LAPS.

Three commonly forgotten topics

LTSC editions. They have their own schedule and are not covered by standard Windows 10 ESU. Windows 10 Enterprise LTSC 2021 reaches end of support on 12 January 2027. Microsoft recommends moving to Windows 11 Enterprise LTSC 2024 and offers a separate ESU for this edition. Windows 10 IoT Enterprise LTSC remains supported until 13 January 2032. So check the exact edition of industrial PCs and kiosks.

Secure Boot certificates. Several Microsoft Secure Boot certificates expired between June and October 2026. A device that has not received the 2023 certificates still starts and installs standard Windows updates, but it no longer receives new early-boot protections. Most devices get them automatically, sometimes with a firmware update from the manufacturer. Check this on the PCs you keep, especially the oldest ones.

Windows Update certificates. Microsoft has also announced that certificates used for trusted connections to Windows Update will expire in May and June 2027. No action is required from Windows 11 25H2 onwards; for other versions, see the conditions in the Windows message center.

If some PCs must stay on Windows 10

Sometimes a piece of software or a specialised machine blocks the migration. Reduce the exposure:

• enrol and activate the PC in ESU, or cut it off from the internet if its use allows it;
• isolate it in a dedicated VLAN, with only the strictly necessary traffic;
• remove admin rights, email and web browsing;
• check that your protection is still supported: Microsoft Defender for Business only covers Windows 10 while the system receives updates, and other vendors have their own schedules;
• document the risk, the owner and the exit date.

These measures are part of business cybersecurity in Morocco, and they do not replace leaving Windows 10.

The mistakes we fix

1. Discovering forgotten PCs: a reception PC, a production machine or a rarely used laptop, never inventoried.
2. Bypassing the hardware requirements with a trick found online, when Microsoft no longer guarantees updates for these devices.
3. Buying ESU without activating it, or without checking that the monthly patches really install.
4. Migrating to a version nearing end of servicing, which means doing the work again soon.
5. Neglecting the recycling of old PCs: disks to erase, licences to reassign, inventory to update.
6. Starting the migration on a closing day, or without a pilot group.

How we work

We start with an inventory of your PCs and the sorting described above. You receive the list of PCs to migrate, replace or place under ESU, with the points to validate with your vendors. We then test on a pilot group, roll out in waves and check each PC. After the migration, PCs are monitored 24/7, and a critical incident is handled in less than 15 minutes.

Still have PCs on Windows 10, or not sure how many are left? Request your free initial audit: we reply within 24 business hours.