Windows 10 End of Support: The 2026 Roadmap
General Last week I visited a client’s office on the Anatolian side of Istanbul. 22 of their 38 PCs still ran Windows 10. “İsmet, the update warnings are driving us crazy, what do we do?” The answer is short: Windows 10 support ended on 14 October 2025. Microsoft is now shipping security patches only through paid Extended Security Updates (ESU), and the per-device fee doubles in October 2026. This article lays out the actual costs, the real risks, and a practical roadmap through the end of 2026 for SMBs still running Windows 10 — with examples from the field.
When exactly did Windows 10 support end?
On 14 October 2025, Microsoft stopped issuing free security updates for Windows 10 Home, Pro, Enterprise and Education. Devices keep working — but the monthly critical CVE patches no longer arrive automatically. Windows kernel and SMB vulnerabilities exploited since November 2025 are closed only on devices covered by an ESU licence.
What do ESU (paid support) prices look like in 2026?
Microsoft has structured commercial ESU to double in price every year, deliberately pushing organisations to migrate. Current published prices:
| Period | Date range | Per-device price (USD) | Cumulative total |
|---|---|---|---|
| ESU Year 1 | 15 Oct 2025 – 14 Oct 2026 | 61 USD | 61 USD |
| ESU Year 2 | 15 Oct 2026 – 14 Oct 2027 | 122 USD | 183 USD |
| ESU Year 3 | 15 Oct 2027 – 14 Oct 2028 | 244 USD | 427 USD |
The detail that catches people out: ESU is a cumulative licence. If you wait until October 2026 to buy in, Microsoft doesn’t sell you Year 2 alone — they back-bill Year 1 as well (183 USD per device). For a 50-PC organisation, that means a three-year ESU bill north of 21,350 USD. For the same budget you could buy brand-new Windows 11 Pro devices.
Are Microsoft 365 / Intune customers eligible for a discount?
Yes. Microsoft 365 E3/E5, Business Premium and Windows 365 Cloud PC subscriptions can grant automatic ESU coverage for Intune-enrolled devices. Volume discounts apply when purchased through the Cloud Solution Provider (CSP) channel. The catch: to receive the discount the device must be Intune-enrolled and Microsoft Entra ID hybrid join must be configured correctly. What we see in practice: roughly 40 % of SMBs with M365 Business Premium subscriptions never opened Intune enrolment policies — losing both the ESU discount and free access to Defender for Business they were already paying for.
Can my device move to Windows 11? Hardware requirements
Windows 11 has four hard requirements:
- TPM 2.0 enabled (in BIOS/UEFI it shows up as “Intel PTT” or “AMD fTPM”)
- UEFI Secure Boot supported and enabled
- Supported CPU list: Intel 8th generation (2018+) or AMD Ryzen 2000 series (2018+) and newer
- Minimum 4 GB RAM + 64 GB SSD (in real-world deployments we don’t recommend below 8 GB / 256 GB)
What we see in the field: most desktops bought in 2017 or earlier don’t make the CPU list. Don’t plan a migration without running PC Health Check first — of a recent 30-device estate we audited, 11 PCs that “passed because TPM was on” failed on the CPU requirement.
Which order should I refresh Windows 10 in? A 5-stage SMB plan
- Inventory first: use Intune, Microsoft Configuration Manager or PDQ Inventory to pull a CPU/TPM compatibility report for every Win10 device.
- Prioritise by risk: finance, accounting and endpoints that process personal data go first.
- Buy ESU as a bridge, not a destination: for critical devices that cannot upgrade, take Year 1 ESU through October 2026 — then replace them.
- New devices on Windows 11 Pro + Intune Autopilot: every new purchase should be Pro edition and Autopilot-ready (TPM 2.0 + Modern Standby).
- Move data to OneDrive / SharePoint: when a device gets replaced, the clients who say “I lost everything from C:” always have the same setup — local user profile. Enable Known Folder Move and the cut-over drops to thirty minutes.
Is running Windows 10 a compliance risk under KVKK / GDPR?
KVKK Article 12 (Turkey’s Data Protection Law, equivalent in spirit to GDPR Article 32) requires “appropriate technical measures”. Processing personal data on an operating system the vendor no longer supports has repeatedly been treated by the regulator as an “inadequate technical measure”. In 2025 a meaningful share of administrative fines cited “out-of-date software” as a contributing factor. An accounting department running Windows 10 without an ESU licence is exposed in a breach scenario — and the defence becomes much harder.
Frequently asked questions
Can I buy ESU as an individual? Commercial devices buy through CSP/VLSC channels. A separate Consumer ESU is available for 30 USD/year via your Microsoft account, or can be activated using Microsoft Rewards points — but it’s limited to one year only.
My company has 40 devices, I can’t run the migration myself. Can you help? Yes — at Xen Bilişim we deliver inventory scan, Intune Autopilot setup, Defender for Business policies and the Windows 11 migration as a single packaged engagement. A typical 40-device estate is completed within three weeks.
Will my legacy software run on Windows 11 without “downgrading”? Most legacy desktop applications run under Windows 11 compatibility mode. Only legacy industrial machines that require 32-bit proprietary drivers cause real trouble — we typically keep those running as Hyper-V Windows 10 VMs on an isolated VLAN.
In conclusion: the 2026 to-do list
After 20 years on the ground, I can say this plainly: October 2026 is your last reasonable window. Once Year 2 ESU hits 122 USD per device and Year 1 gets back-billed on top, staying on Windows 10 becomes more expensive than buying new hardware for most SMBs. If you don’t start the inventory and planning now, by October you’ll be buying whatever your supplier happens to have in stock.
To get a Windows 11 compatibility report for your fleet, find out whether ESU is actually necessary, or map out a migration roadmap — contact us. The first inventory scan is on us.