Windows 10 ESU Year 2 Starts Oct 14: Pay Double or Replace the PC

The dates come from Microsoft's own pages: Partner Center guidance (dated October 23, 2025) prints the three coverage windows, and the Lifecycle FAQ (updated August 24, 2026) lists the same end dates with the scope beside them: “Critical, Important.”

Sources: coverage windows — Microsoft Partner Center, Oct 23, 2025; $61, doubling and cumulative rules, $0 cloud entitlements — Microsoft ESU program page, Nov 17, 2025; $45 Intune/Autopatch — Windows IT Pro Blog, Apr 2, 2024; education — Microsoft Education Blog, Apr 2, 2024. Figures not marked “(Microsoft)” are the doubling rule applied by PCSP.

Microsoft prints only the $61; the $122, $244 and $427 are its own doubling rule applied. Two Year-2 seats cost more than the cheapest Windows 11 workstation on our shelf. Sources: Microsoft ESU program page, Nov 17, 2025; PCSP catalog, September 11, 2026.

The cumulative rule is Microsoft's own wording on that same program page: “If you decide to purchase the program in Year Two, you have to pay for Year One too, as ESUs are cumulative.” It also rules out partial periods and sets the minimum purchase at one license; the Lifecycle FAQ limits the program to “Enterprise, Education, and Pro in Commercial use.”

What the money buys is narrow: security updates rated Critical or Important, nothing else — no features, no non-security fixes, and, in the program page's words, “No, technical support isn't included in the ESU program.” The exception: the same page makes ESU free for Windows 10 virtual machines in Windows 365 and Azure, and for Windows 10 endpoints connecting to Windows 365 Cloud PCs “for up to three years, with an active Windows 365 subscription license.”

Year 2 is not a renewal that happens by itself. Microsoft's enablement guide (dated April 21, 2026) requires 22H2 with KB5066791, the “Licensing Preparation Package for Windows 10 KB5072653,” and a MAK from the Microsoft 365 admin center activated per device — with a separate activation ID for each coverage year; Year 2's is 1043add5-23b1-4afb-9a0f-64343c8f3f8d. The same guide draws the boundary that matters for the LTSC question below: “Windows 10 Long Term Servicing releases (LTSB/LTSC) have their own lifecycles and are NOT covered via the Windows 10 ESU program.”

The plan every small-business owner has heard of is the consumer one. Microsoft's consumer ESU page (opened September 4, 2026) offers it free with PC settings sync, for 1,000 Microsoft Rewards points, or as a “One-time purchase of $30 USD” covering “up to 10 devices,” and a June 25, 2026 editor's note on the Windows Experience Blog's original post extends coverage “through Oct. 12, 2027.”

Then the exclusions, verbatim from the same page: “Enrollment won't be offered for: Devices in kiosk mode. Devices joined to an Active Directory domain or Microsoft Entra and/or enrolled in a Mobile Device Management (MDM) solution.” A managed business PC is not eligible, full stop.

The honest edge case: a workgroup shop with local accounts and no MDM can use it, up to ten devices per Microsoft account — with the same Critical-and-Important-only coverage, no technical support, no Year 3, and a plan that vanishes the moment those PCs join a domain or an MDM. For a managed fleet, the commercial license and its $122 are the only Microsoft path.

Whether $122 is worth paying depends on what a year of patches contains, so we counted. Microsoft publishes every fix as machine-readable CVRF documents; we pulled the ten monthly documents from November 2025 through August 2026 (the August document and its predecessors, revised through September 4) and counted every CVE affecting “Windows 10 Version 22H2 for x64-based Systems,” with Microsoft's own severity and exploitation flags. Counted September 5, 2026: our figures from Microsoft's data, not a Microsoft summary.

Source: PCSP count from Microsoft Security Update Guide CVRF documents (Nov 2025 – Aug 2026, revisions through Sept 4, 2026), counted Sept 5, 2026. The September 8 release lands after this count.

The patch stream grew through Year 1 instead of tapering: 931 CVEs across ten releases, 50 rated Critical, 10 already exploited when Microsoft disclosed them. Source: PCSP count from Microsoft Security Update Guide CVRF documents, Nov 2025 – Aug 2026, counted September 5, 2026.

The stream is growing, not tapering: August fixed 160 Windows 10 bugs against 36 the previous November, and July's 313 is a third of the year on its own — July 2026 was the largest Patch Tuesday Microsoft has ever shipped, “a record 570 vulnerabilities” across all products (BleepingComputer, July 14). The bugs do not retire with the operating system: 913 of the 931 — 98% — also affect Windows 11 25H2 in the same documents; what stops on an un-enrolled Windows 10 PC is not the discovery, only the patch. And ten of the 931 carried Microsoft's “Exploited: Yes” flag at disclosure, five of them in February alone.

How many PCs are still on it. Nobody publishes an installed-base count, but two imperfect gauges agree. StatCounter's browsing-traffic measure put Windows 10 at 23.67% of US desktop Windows traffic in August 2026 (31.92% in October 2025). Lansweeper's July 14, 2026 analysis of its own customers' devices — a vendor's sample, not a census — puts it at 16.9% of Windows devices, 21.4% at small and medium businesses and 23.0% in healthcare and pharma, and, as relayed by The Register on July 16: “Only 14% of Windows 10 assets have ESU patches applied.” If that holds, the typical remaining Windows 10 PC is simply unpatched.

The escape hatch that comes up in every planning meeting is LTSC — the Long-Term Servicing Channel, the feature-update-free edition that runs on ATMs and lab instruments. The plan: reinstall the fleet on Windows 10 Enterprise LTSC 2021 and skip the ESU bill. Every clause of it fails on Microsoft's own pages.

Sources: Microsoft lifecycle pages for LTSC 2021, IoT LTSC 2021, LTSC 2019, Windows 11 LTSC 2024 and IoT LTSC 2024; Windows IT Pro Blog posts of Feb 20, 2026 (LTSB 2016) and Aug 5, 2026 (LTSC 2021 ESU). Microsoft prints end dates as 6:59:59 AM Pacific of the following day.

Windows 10 Enterprise LTSC 2021 ends on January 12, 2027 — ninety days after ESU Year 2 begins — with no extended phase. Microsoft's August 5, 2026 answer is a separate ESU for it on the terms you were trying to avoid: “available for purchase starting September 1, 2026,” “$61 USD per device” for Year 1, doubling, cumulative. IoT Enterprise LTSC 2021 is carved out, “in support through January 13, 2032” — but that is a different license.

Which is the second problem. The Windows commercial licensing overview (May 27, 2026) lists Enterprise LTSC only under Commercial Licensing, so a shop without a Volume Licensing agreement cannot buy it, and IoT Enterprise, per Microsoft's IoT licensing page (June 24, 2026), is an OEM license for “device makers that preinstall the operating system on new devices.” Microsoft's LTSC overview (July 14, 2026) says the channel “isn't intended for deployment on most or all the PCs in an organization.” LTSC is the right answer for the spectrometer PC and the CNC controller; for the office fleet it is a reinstall that buys ninety days and then presents the same $61 invoice under a different product name.

A Windows 10 PC in October has three futures — an ESU key, Windows 11, or replacement — plus two real alternatives, a Cloud PC and third-party micropatching. Here is each per seat for the twelve months from October 14, with catalog prices as of September 11, 2026.

Catalog prices and unit counts from PCSP live stock, September 11, 2026, for the exact configuration named; several configurations of one model draw on the same chassis pool, so we quote the depth of the SKU, never a category total. ESU figures by Microsoft's doubling rule.

The upgrade is free where the hardware allows it. Microsoft's Windows 11 page: “The upgrade from Windows 10 Home or Windows 10 Pro to the equivalent edition of Windows 11 is free,” conditional on the minimum requirements. A full Windows 11 Pro license, where no qualifying Windows 10 Pro exists, was $199.99 on the Microsoft Store on September 5, 2026 — three years of ESU cost more than two of those.

“Just upgrade” has its own October 13. Microsoft's Windows 11 release information (August 27, 2026) ends servicing for version 24H2 Home and Pro on October 13, 2026, the same day as ESU Year 1. A Pro machine upgraded last year and left on 24H2 is as unpatched after October 13 as a Windows 10 machine without ESU. The target is 25H2 — an enablement package for 24H2 devices, serviced until October 12, 2027 on Home/Pro and October 10, 2028 on Enterprise/Education — not 26H1, which Microsoft's 26H1 notes say “can't be installed as an in-place update on existing devices.” HP's tested-device table says the same thing from the other side: on September 11, 2026 every model in it carries “Hardware Not Supported” in the 26H1 column — the current Z2 G9 and Z2 Mini G1a as well as the G4 machines below.

Windows 365 earns its line for the entitlement, not the price: at the list prices we captured September 4 ($36 to $108.80 per user per month) a Cloud PC costs more than three Year-2 seats, but Microsoft's October 14, 2025 announcement says Windows 10 devices accessing Cloud PCs “will automatically be activated to receive security updates without any additional steps.” And 0patch: Acros Security's pricing page lists €24.95 (Pro) and €34.95 (Enterprise) per computer per year, and its June 2024 commitment covers Windows 10 for “at least 5 more years” — for “critical, likely-to-be-exploited vulnerabilities,” not every CVE. It changes nothing about the machine's status: the OS is still end-of-support to Microsoft, which is what the audit checklist and the policy definition key on.

The free upgrade is only free on hardware that passes Microsoft's floor. The requirements page (July 14, 2026) demands, among other things, a compatible processor and “Trusted Platform Module (TPM) version 2.0” — the two gates that decide most business fleets. On the TPM, Microsoft was blunt in December 2024: “TPM 2.0 is not just a recommendation—it's a necessity.”

The processor list is where a correction is owed. Microsoft's general “Windows 11 supported Intel processors” page (dated October 16, 2025) lists, by family: “8th Generation Core i3/i5/i7/i9 Processors” and every generation since; the Core X lines (“Intel Core 7000X Series,” 9000X, 10000X); “Xeon Scalable Processors,” “2nd Generation” and “3rd Generation Xeon Scalable Processors”; Xeon E-2100 through E-2400; and, the rows that matter here, “Xeon W-2100 Series” and “Xeon W-2200 Series.” For anything newer the page states: “Subsequently released and future generations of processors which meet the same principles will be considered as supported, even if not explicitly listed.”

What does not list those processors is a different document: the per-version “Windows 11, version 24H2 supported Intel processors” page, whose editor's note says it “is intended for OEMs and ODMs to understand the following CPUs may be used for new Windows 11 devices” — chips a manufacturer may put in a new PC, not PCs that may run the OS. An earlier compatibility list of ours read that narrower OEM list and concluded that Xeon W-2100/W-2200 workstations were excluded; that was wrong, and it is being corrected. The vendors agree with the general list: Dell (May 10, 2026), Lenovo (February 4, 2026) and HP (support document ish_4890350) list the Precision 5820/7820/7920, ThinkStation P520/P520c/P720/P920 and Z2/Z4/Z6/Z8 G4 as tested for Windows 11, and omit the Precision 5810/7810/7910, OptiPlex 3050/5050/7050, ThinkStation P320 and Z440/Z640/Z840/Z240.

Sources: Microsoft “Windows 11 supported Intel processors” (Oct 16, 2025); Dell KB 000187485 (May 10, 2026); Lenovo HT512623 (Feb 4, 2026); HP ish_4890350; TPM lines from the OEM spec sheets. Prices and unit counts: PCSP catalog, September 11, 2026, per exact configuration.

The CPU row is necessary, not sufficient: Dell's 5820 spec sheet lists TPM 2.0 as optional and Lenovo footnotes that P520/P720/P920 units sold in China lack it, so the test that settles a machine is Microsoft's own PC Health Check — its processor-requirements page (August 31, 2026) tells customers “seeking to determine Windows 11 eligibility for your device” to use it. Run it on one unit of each model before ordering twenty.

The other side of the gate: Windows 11 can be forced onto an E5 v4 Z840 or a 7th-gen OptiPlex, and some sellers ship machines that way. Microsoft's support article gives the consequence in the words the installer shows: “If you proceed with installing Windows 11, your PC will no longer be supported and won't be entitled to receive updates.” An unsupported install swaps a Windows 10 PC with a $122 patch option for a Windows 11 PC with none.

Take a 25-seat office where every desk runs Windows 10 Pro on hardware that cannot take Windows 11. The arithmetic uses Microsoft's price rule and our shelf on September 11, 2026, and respects unit depth: the cheapest Windows 11 Pro machine we stock had 12 units that day, so 25 seats draw on two configurations.

ESU per Microsoft's doubling and cumulative rules; hardware from PCSP live stock, September 11, 2026, per exact configuration (Z2 G4 E-2124G, 12 units; Z2 G4 i7-9700, 48 units). Shipping and staff time excluded on every row.

Year 2 alone is a third of the replacement bill; Years 2 and 3 together land $444.85 short of it and still leave 25 Windows 10 PCs. ESU by Microsoft's doubling and cumulative rules; hardware prices and unit counts from PCSP stock, September 11, 2026.

Year 2 alone is cheap: $3,050 for 25 seats is a third of the replacement bill, and if those PCs are being retired in the spring anyway it is the right purchase. Year 2 plus Year 3 is not: $9,150 for two years of patches on 25 machines that are still Windows 10 on October 10, 2028 and still need replacing, against $9,594.85 for 25 Windows 11 machines with a warranty — $444.85 apart.

Few fleets are all-or-nothing: an office with 15 eligible PCs and 10 on E5 v3 towers upgrades the 15 for $0 in licensing and decides only about the 10 — ESU Year 2 at $1,220 against $4,250.30 for ten Z2 G4 i7-9700s. Gone by mid-2027, ESU wins; still on desks in 2028, the replacement was cheaper by the time Year 3 was invoiced. Public-sector buyers also face the federal fiscal year-end on September 30 (our year-end budget guide).

An unpatched PC usually meets an auditor or an underwriter before an attacker, so here is the language on the record, quoted because the details cut both ways.

HIPAA. HHS's Office for Civil Rights addressed exactly this in its Fall 2021 cybersecurity newsletter on legacy systems — “an information system with one or more components that have been supplanted by newer technology and for which the manufacturer is no longer offering support,” which a Windows 10 PC without ESU is by definition. OCR says the risk analysis required by 45 CFR 164.308(a)(1)(ii)(A) must cover “ePHI used by legacy systems” and the risks be reduced “to a reasonable and appropriate level,” and its acceptable measures include upgrading, “contract with the vendor or a third party for extended system support” — ESU is a named mitigation — cloud migration, or segregating the system from the network. Not on the list: doing nothing and not writing it down.

PCI DSS. For any PC that touches cardholder data, Requirement 6.3.3 of PCI DSS v4.0.1 (June 2024) requires that patches and updates for critical vulnerabilities — those flagged by the risk-ranking process at Requirement 6.3.1 — be “installed within one month of release.” One caveat, because it is often misquoted: v4.0.1 says critical vulnerabilities, not “critical or high” — check which text your assessor works from. Either way, the requirement is structurally impossible on a machine whose vendor issues no patches; on ESU it is merely a schedule.

CISA. The agency's Bad Practices catalog puts unsupported software first: “Use of unsupported (or end-of-life) software in service of Critical Infrastructure and National Critical Functions is dangerous and significantly elevates risk… especially egregious in technologies accessible from the Internet.” It is addressed to critical infrastructure, but “CISA encourages all organizations” to act on it — and if your customers include a hospital, a utility or a federal agency, their vendor questionnaires are written with this page open.

Cyber insurance. Chubb's international Cyber ERM policy wording, version 2.2, defines a term to know before renewal: a “Neglected Software Exploit” is the exploitation of a vulnerability in software that, as of the first known date of exploitation, “has reached end-of-life or end-of-support status with the vendor that developed it,” or for which a patch “has been available to you, but has not been applied” (policy wording, definition 3.46). It is an international form and US policies differ, but “end-of-support status with the vendor” is a defined term insurers already write into cover. We will not claim insurers deny Windows 10 claims as a rule — no questionnaire we could find says so; what the documents say is that the question turns on vendor support status, which ESU preserves and an unsupported Windows 11 install forfeits.

We sell the replacement hardware, so read this as the disclosure it is: where $122 is the correct line item, and where the correct replacement is not a refurbished tower from us.

Buy ESU Year 2 when:

• The machine is tied to software or hardware that cannot move — the instrument PC certified with its analyzer, the CNC controller, the imaging workstation validated on Windows 10 only. A $122 key is cheaper than re-certifying a validated system, and HHS OCR accepts extended vendor support as a mitigation. Isolate it, document it, date it.
• The PC is being retired in the first half of 2027 anyway. Replacing a machine you will discard in five months wastes $321.94 or more; $122, or $183 for a late joiner, buys the bridge. The trap is the machine that was “being retired next quarter” last October too: still on a desk when Year 3 is invoiced at $244, and the bridge has cost more than the replacement.
• The fleet is very small. Three PCs on Year 2 cost $366; the technician's afternoon to reimage them costs more.
• You are a school. At $2 per device, ESU for 200 machines is $400; no replacement arithmetic competes with that.

Buy new, or buy elsewhere, when:

• Procurement or policy requires current-generation hardware with a manufacturer warranty. A refurbished Z2 G4 carries our one-year warranty, not HP's.
• The fleet is laptops. We do not stock them; the Windows 11 gate applies to notebooks exactly as above.
• You need small-form-factor or mini PCs under every desk. Our Windows 11-ready shelf is mostly full-size towers — Z2 G4, Z4 G4, Precision 5820, P520; on September 5 our SFF options were a handful of Z2 G4 SFF and Mini configurations (the SFF with an i7-9700 and Quadro T1000 was $826.00, 14 units). Do not plan a 25-seat SFF rollout around us.
• You want the machines to last to the mid-2030s, or need what a 2018 platform lacks — DDR5, PCIe 5, an NPU, current integrated graphics. A Z2 G4 is the right buy for three to five years of office work, not ten.
• Linux is a real option for the workload. A kiosk or a browser-only desk can stay on E5 v4 hardware for years under a supported distribution with a published lifecycle.

And one warning about the used market, including us. Machines on ineligible CPUs are being sold with “Windows 11” in the listing title, installed by bypassing the compatibility check that Microsoft says leaves the PC “no longer supported.” As of September 5, six listings on our own site fit that description — four Precision T7910 clearance units on Xeon E5-2690 v3/v4, an HP Z240 on a Core i7-6700 and an HP Z840 on two E5-2690 v3 — and we are relabelling them: do not buy those, from us or anyone, for a fleet that needs a supported Windows 11.

What we will not soften: leaving a domain-joined Windows 10 PC connected and unpatched after October 13 because $122 “feels like a lot” is not a defensible case. ESU, upgrade, replace, Cloud PC — each is a supported state. Doing nothing is the only one that is not.

When is Windows 10 end of life, and when does Windows 10 ESU end?

Windows 10 Home and Pro reached end of support on October 14, 2025; 22H2 is the final version. Commercial ESU runs three years: Year 1 ends October 13, 2026; Year 2 runs October 14, 2026 to October 12, 2027; Year 3 ends October 10, 2028, per Microsoft's Partner Center table. The consumer program ends October 12, 2027. There is no Year 4 at any price.

How much is Windows 10 ESU Year 2?

Microsoft prints $61 per device for Year 1 and states that the price doubles every consecutive year. Applied, that is $122 for Year 2 and $244 for Year 3, $427 in all; Microsoft's pages do not print $122 itself. Intune/Autopatch-managed devices: $45, then $90 by the same rule. Education: $1, $2, $4. Windows 10 VMs in Azure and Windows 365, and PCs connecting to Cloud PCs, pay nothing.

Can I buy Windows 10 ESU Year 2 without buying Year 1?

No. Microsoft's ESU page states that if you purchase the program in Year Two you have to pay for Year One too, as ESUs are cumulative. A device first enrolled in Year 2 therefore costs $61 plus $122, or $183, for twelve months of coverage. Partial periods cannot be bought either.

Can a Xeon W-2133 (HP Z4 G4, Dell Precision 5820, Lenovo P520) run Windows 11?

Yes. Microsoft's general Windows 11 supported Intel processors list carries Xeon W-2100 Series and W-2200 Series rows, and HP, Dell and Lenovo list the Z4 G4, Precision 5820 and P520 as tested. The per-version list that omits them is for OEMs building new devices. TPM 2.0 must be present and enabled; run PC Health Check per unit. An earlier list of ours got this wrong and is being corrected.

Does Windows 10 22H2 get updates after October 13, 2026?

Only with ESU Year 2 activated. The October 13, 2026 Patch Tuesday is the last update under Year 1; Year 2 devices need Microsoft's Year 2 activation ID on top of the prerequisites (KB5066791 and KB5072653). Without ESU the PC keeps working but receives no security updates. Defender security intelligence and Microsoft 365 Apps security updates continue on Windows 10, the latter until October 10, 2028.

Is switching to Windows 10 LTSC a way out of ESU?

Not for an office fleet. LTSC is Volume-Licensing-only Enterprise, and Microsoft says the channel isn't intended for deployment on most or all the PCs in an organization. Windows 10 Enterprise LTSC 2021 ends January 12, 2027 with no extended phase; its own ESU, sold from September 1, 2026, costs the same $61 and doubles. IoT Enterprise LTSC 2021 lasts to January 13, 2032 but is OEM-licensed for fixed-purpose devices.

What happens if I do nothing and keep Windows 10 after October 13, 2026?

Microsoft says the PC “will continue to function,” but it receives no security updates. The ten ESU Patch Tuesdays through August 2026 fixed 931 vulnerabilities in Windows 10 22H2 by our count, 50 Critical and 10 exploited at disclosure. A card-handling PC cannot meet PCI DSS 6.3.3, HIPAA's risk analysis must document the legacy system, and Chubb's policy defines an exploit of end-of-support software as a Neglected Software Exploit.