Windows 10 End of Support: What Businesses Should Do Now

Windows 10 reached end of support on 14 October 2025, so Microsoft no longer provides technical assistance, feature updates or security updates for it. PCs enrolled in the Extended Security Updates (ESU) programme still receive security updates. A business still running Windows 10 should find every machine, check each one against the Windows 11 hardware requirements, upgrade or replace what it can, and use ESU only as a bridge for the devices that need more time. Run the work through Microsoft Intune so you can track it device by device.

What changed when Windows 10 support ended?

Windows 10 PCs still start and run. What stopped is the flow of fixes: Microsoft says that without continued software and security updates, a Windows 10 PC is at greater risk from viruses and malware. Three related dates are easy to miss:

• Microsoft 365 Apps. Support for Microsoft 365 Apps on Windows 10 ended on the same day, but Microsoft is continuing security updates for Microsoft 365 on Windows 10 until 10 October 2028.
• Office 2021 and Office LTSC 2021. Microsoft set their end of support for October 2026, one year after Windows 10.
• Windows 10 LTSB and LTSC. These long-term servicing releases have their own lifecycles and are not covered by the Windows 10 ESU programme, so check their dates separately.

How do you find every Windows 10 machine?

Start with the devices you manage, then look for the ones you do not. If your PCs are enrolled in Intune, the Windows feature update device readiness report gives a per-device view of compatibility risks for the Windows version you choose. Each device gets a readiness status:

• Low, medium or high risk, depending on known app, driver and system requirement issues.
• Replace device, meaning it cannot upgrade to the target version.
• Upgraded, already on the target version or later.
• Unknown, where Microsoft's advice is to check the device is configured to send Windows diagnostic data.

The report is generated on demand, and its data comes from Windows diagnostic data with an end-to-end delay of up to about 52 hours, so switch diagnostic data on well before you need the numbers. Then look outside Intune: reception and meeting-room PCs, machines attached to equipment, shared workstations and laptops that rarely connect. For each device, record the user, model, Windows version and the applications it runs.

Can your existing PCs run Windows 11?

Check each machine against Microsoft's minimum hardware requirements for Windows 11:

• Processor: 1 GHz or faster with two or more cores, on a compatible 64-bit processor or system on a chip.
• Memory: 4 GB or more. Storage: 64 GB or more.
• System firmware: UEFI, Secure Boot capable.
• TPM: version 2.0.
• Graphics: compatible with DirectX 12 or later, with a WDDM 2.0 driver.
• Display: high definition (720p), 9 inches or larger, 8 bits per colour channel.

To upgrade directly, a device also needs Windows 10 version 2004 or later with the 14 September 2021 security update or later. The readiness report lists which system requirements a device does not meet, which tells you quickly whether you are looking at an upgrade or a replacement. Treat the minimum as a floor: if users already struggle with a machine, replacing it may be a better use of the upgrade window.

What do Extended Security Updates give a business?

ESU is an annual subscription that keeps critical and important security updates coming to enrolled Windows 10 PCs after end of support. For organisations, Microsoft's rules are:

• Version: devices must run Windows 10, version 22H2, with update KB5066791 or later, and the ESU licensing preparation package KB5072653 installed after it.
• Length: up to three years after end of support for commercial and educational organisations, bought one year at a time. Partial periods are not sold.
• Cumulative years: if you join in Year Two, you must buy Year One as well.
• Scope: security updates only. No new features, no non-security updates and no general technical support. Microsoft supports only activation, installation and possible regressions of ESU itself, and organisations need an active support plan for that help.
• Minimum: one licence.

Which year are you buying? Microsoft's ESU FAQ says Year One starts in November 2025, but it does not give exact start and end dates for each year. Twelve months later, in November 2026, a purchase may need to cover Year Two as well as Year One, so confirm the coverage years with your licensing provider before you order.

To enrol, buy ESU licences through Microsoft volume licensing, then activate each PC with the Multiple Activation Key (MAK) shown in the Microsoft 365 admin center under Billing, Your Products, Volume licensing. Seeing the key needs the Product Key Reader or VL Administrator role. Install it with slmgr.vbs /ipk, activate it with the activation ID for the right ESU year, and confirm the licence status with slmgr.vbs /dlv.

Cloud desktops change the picture. Microsoft includes ESU for Windows 10 virtual machines in Windows 365, Azure Virtual Desktop and Azure virtual machines. Windows 10 PCs that connect to Windows 365 Cloud PCs are also entitled to ESU for up to three years with an active Windows 365 subscription licence.

Should you upgrade, replace or move to a Cloud PC?

Microsoft recommends upgrading eligible PCs to Windows 11 using Windows Autopatch or Microsoft Intune, or moving to a new Windows 11 PC, and names a Windows 365 Cloud PC as a further option. Decide per device:

• In-place upgrade for devices that meet the requirements and show low or medium risk, managed through Intune or Windows Autopatch.
• Replace devices marked "Replace device" and machines you would retire soon anyway. A new PC comes with Windows preinstalled, and Windows Autopilot turns that installation into a business-ready device, applying settings and policies and installing apps, without re-imaging. Our Autopilot page explains why devices should be registered through your supplier at the point of purchase.
• Windows 365 or Azure Virtual Desktop where users need Windows 11 but the hardware cannot run it, or where staff work across several devices. Our comparison of Azure Virtual Desktop and Windows 365 covers how to choose between them.
• ESU for the few devices that cannot change yet, such as a PC tied to equipment software that its vendor does not yet support on Windows 11. Give each one a retirement date.

How do you test applications before upgrading?

Microsoft's Windows 11 planning guidance lists testing applications as a core step, alongside a deployment plan, readiness criteria, a review of infrastructure and tools, and a servicing strategy. In practice:

• Use the app and driver columns in the readiness report, and the compatibility risks report, which summarises the risks affecting the most devices.
• List the business applications staff depend on: accounting and payroll software, banking and e-signature tools, printer and scanner drivers, VPN software and anything that needs a hardware key.
• Run a pilot group of IT staff plus one person from each department, and have each application owner sign off before the wider rollout.

Plan for what comes next as well. Microsoft releases one Windows 11 feature update a year. Each version is supported for 36 months on Enterprise and Education editions, and for 24 months on Home and Pro editions, so version changes should become routine rather than another project.

How should you run the rollout with Intune and Autopilot?

1. Create a feature update policy in Intune for the Windows 11 version you tested. Microsoft describes these policies as a way to target an upgrade to a newer version while preventing devices from moving beyond it. They need Microsoft Intune Plan 1 and a Windows licence that includes the Autopatch entitlement, and they support Pro, Pro Education, Enterprise and Education editions.
2. Deploy in rings: the pilot group first, then one department at a time, regenerating the readiness report between rings.
3. Keep update rings for the user experience. Restart behaviour and installation timing still follow your Windows Update policy settings, including update rings.
4. Use Autopilot for replacements and resets. Autopilot can also reset, repurpose and recover devices, which helps when a leaver's laptop goes to a new starter. Configuring automatic enrolment into Intune needs a Microsoft Entra ID P1 or P2 subscription.
5. Track to zero. Report weekly on devices still on Windows 10, devices on ESU and their retirement dates.

Our Intune service plans enrolment, application deployment, device policies and compliance, with a pilot before wider rollout. For a device-by-device plan for your remaining Windows 10 machines, contact us.