Windows 10 extended security updates (ESU) give enrolled PCs on version 22H2 critical and important security patches for up to three years after the October 2025 end of support. They do not bring new features, non-security fixes or technical support. ESU buys time to finish the move to Windows 11; it is not somewhere to stay.
A year after Windows 10 reached end of support, most organizations have done the easy part of the move. The machines that qualified have been upgraded. What is left is the awkward tail: the PCs that failed the hardware check, the one workstation that runs the software nobody wants to touch, and the laptops that were "next quarter" three quarters ago. This guide covers what ESU actually protects, what it leaves exposed, and how to close out the last of the fleet.
What do Windows 10 extended security updates actually cover?
They cover security updates and nothing else. Microsoft's ESU program documentation describes it as a paid annual subscription that lets enrolled PCs keep receiving updates rated critical and important by the Microsoft Security Response Center after support ended. For commercial and educational organizations, enrolled devices can receive those updates for a maximum of three years after end of support, which takes the last of them to October 2028.
There are two conditions that catch people out. First, the device must be running Windows 10 version 22H2. A machine still on an older release has to be brought up to 22H2 before it can enroll, which is itself a change that needs testing. Second, ESU is enrolled per device and renewed per year, and Microsoft prices each successive year higher than the last. The program is designed to be a bridge with a toll that rises, not a place to settle.
What does ESU not cover?
The exclusions matter more than the inclusions, because they are where the risk sits. According to Microsoft, ESU does not include:
- New features. Windows 10 is frozen. Anything new in Windows, including security features that need operating system changes rather than a patch, arrives only on Windows 11.
- Non-security fixes. Reliability and performance bugs, driver issues and compatibility problems that are not rated as security vulnerabilities stay unfixed.
- Design change requests. If something does not work the way your business needs, it will not be changed.
- Technical support. ESU support covers only the activation, installation and possible regressions of the ESU updates themselves. General support for Windows 10 has ended, with or without ESU.
There is also the software layer on top of Windows. Microsoft's end-of-support page for Windows 10 notes that Microsoft 365 Apps are no longer supported on Windows 10, although Microsoft is continuing security updates for them there until October 10, 2028. Office 2021 and Office LTSC 2021 reached the end of their own support in October 2026. A PC that is covered by ESU but runs an unsupported version of Office is still running unsupported software.
Third-party vendors follow their own timelines. Line-of-business applications, printer drivers and security tools are steadily dropping Windows 10 from their supported platforms. ESU does nothing for them. The same clock runs on servers, where older Windows Server releases reach end of support on dates of their own.
Which machines should be on ESU, and which should not?
ESU is the right answer for a small, named list of devices with a reason to wait and a date to leave. It is the wrong answer for machines that could be upgraded today and simply have not been. A practical way to sort the remaining fleet:
| Situation | Right move | Why |
|---|---|---|
| Hardware qualifies, nobody has scheduled the upgrade | Upgrade in place now | ESU spends money to delay work that has no blocker. |
| Hardware qualifies but TPM or Secure Boot is switched off | Change the firmware settings, then upgrade | Many "failed" machines only need a setting changed, not a replacement. |
| Hardware cannot run Windows 11, replacement is budgeted | ESU until the replacement arrives | A short, dated bridge is what ESU is for. |
| Runs software certified only on Windows 10 | ESU, isolated, with a vendor deadline | Push the vendor for a supported version and limit what the machine can reach meanwhile. |
| Nobody knows what the machine does | Find out before deciding | Unknown machines are the ones that cause incidents. |
The last row is more common than it should be. Before buying a single ESU license, it is worth confirming that every Windows 10 device on the network is accounted for, assigned to someone and needed at all. Machines that turn out to be spares or forgotten kiosks can often be retired outright.
Why do so many PCs fail the Windows 11 check?
Windows 11 needs a supported processor, TPM 2.0, UEFI firmware with Secure Boot capability, and enough memory and storage. Older processors are the requirement no setting can fix. But a surprising share of failures are machines whose hardware supports TPM 2.0 and Secure Boot and simply ship with them disabled in firmware, or were installed in legacy BIOS mode years ago. Those are fixable remotely or in a short visit, and they turn a replacement line item into an upgrade.
That is why the first step of any remaining migration should be a per-device readiness report: processor, TPM, Secure Boot, firmware mode, memory and disk, with a verdict for each machine of upgrade, change a setting, or replace. Without it, organizations tend to overbuy replacements on one side and leave fixable machines on Windows 10 on the other.
How do you finish the Windows 11 move?
Organizations that have stalled usually stall at the same points. A sequence that gets the tail done:
- Inventory everything still on Windows 10. Pull the list from your management console, not from memory, and attach an owner and a purpose to every device.
- Test the applications that worry people. Put the line-of-business software, scanners, label printers and specialty peripherals on a small pilot group of Windows 11 machines and confirm they work. Chase vendors for supported versions where they do not.
- Upgrade in rings. Push in-place upgrades remotely during agreed windows, a few machines at a time, keeping files, applications and settings. Windows keeps a rollback option for a period after the upgrade if a machine misbehaves.
- Replace on one plan. Group the machines that cannot run Windows 11 into a single replacement plan, enroll the new devices before they ship and move each user's data on the day of the swap.
- Enroll only the remainder in ESU. Every device on ESU should have a written reason and a retirement date. Review the list at each renewal.
- Apply a Windows 11 baseline. Security settings, update policy and a familiar Start menu and taskbar, applied at upgrade time, so the first morning on Windows 11 is not a stream of support calls.
The fleet also needs keeping current after the move. Windows 11 feature updates arrive on their own cadence, and an upgraded machine that then stops patching is no better off. Steady patch management is what keeps the migration from having to be repeated. Updates are one section of a wider cybersecurity checklist for businesses.
What should an organization with a handful of Windows 10 PCs do right now?
If the remaining machines are few, the cost of leaving them is mostly risk rather than money: an unpatched or unsupported PC is a foothold for ransomware and an awkward answer on a cyber insurance questionnaire. Confirm each one is either enrolled in ESU with a retirement date, scheduled for upgrade, or scheduled for replacement. Anything that fits none of those should come off the network.
Atlas runs this as a project for organizations that want it finished rather than managed indefinitely. Our Windows 11 migration service covers the readiness report, application testing, staged upgrades, firmware fixes, replacement planning and ESU enrollment for the devices that genuinely need to wait.
Frequently asked questions
Is Windows 10 still safe to use with Extended Security Updates?
Safer than without them, because critical and important vulnerabilities still get patched. But ESU does not fix non-security bugs, add new protections or cover the applications on top of Windows, so an ESU machine carries more risk than a supported Windows 11 machine. Treat it as temporary.
How long can a business get Windows 10 security updates?
Commercial and educational organizations can receive ESU updates for a maximum of three years after the October 14, 2025 end of support, enrolled one year at a time. There is no fourth year.
Does ESU include help from Microsoft if something breaks?
No. Technical support is not part of ESU beyond problems with activating and installing the ESU updates themselves, and that requires an active support plan with Microsoft.
Can we skip ESU and keep using Windows 10 anyway?
The computers will keep working, but they will stop receiving security fixes. Every vulnerability found after that point stays open on those machines permanently, which is the reason insurers and auditors ask about unsupported operating systems.
The Cyber-Insurance Questionnaire Gap Check
Covers MFA, endpoint protection, backups, email security, incident response and training. Each question comes with the evidence an underwriter expects to see.