Windows 10 ESU Year Two: Pay $122 a Device or Replace the PC?

The first year of paid Windows 10 security updates (ESU) is closing this week. In year two the price per device goes from $61 to $122, and in year three it reaches $244. The price doubles every year and Microsoft sells ESU for three years at most, so the road ends in October 2028.

For anyone building next year’s IT budget, the real question is not whether to buy ESU. It is which machines get ESU and which ones leave Windows 10 without it.

What ESU buys, and what it does not

ESU covers critical and important security fixes only. No new features, no general technical support. Microsoft’s own page limits support to activating and installing the ESU licence and any regressions the updates themselves cause. If a PC gets slow, nobody calls you back.

Two rules hit the budget directly:

• The licence is cumulative. Buy year two and you pay for year one as well. A company that skipped year one pays $183 per device ($61 + $122) in year two.
• No part-year pricing. There is no six-month ESU. Retire a machine in March and you have still paid for the full year.

The numbers here come from Microsoft’s published year-one price and its “doubles every year” rule. Currency, tax and reseller margin change your actual invoice, so get the quote from your partner in writing.

The maths for a 50-device office

Situation	Per device	50 devices
Bought year one, renewing year two	$122	$6,100
Never bought, starting now	$183	$9,150
All three years	$427	$21,350
Year three alone	$244	$12,200

The table says this: every year you keep a device on ESU, the next year’s bill is twice as large. Replacing a machine after two years of ESU feels easy, but the heaviest charge, $244, arrives in year three. Write the replacement date down now.

One decision does not fit every device

Three groups are enough for most inventories.

1. PCs that can move to Windows 11. Machines that meet the hardware requirements and run Windows 10 22H2 can be upgraded. Paying ESU on these is wasted money. Intune can push the upgrade in bulk, usually a weekend job.

2. PCs that cannot upgrade but have more than two years of life left. Compare the price of a new PC with the three-year ESU total ($427). If the quote is clearly higher and the machine is old anyway, buy ESU for one year and plan the replacement.

3. PCs you should retire anyway. Older than five years, no SSD, constant faults. Do not spend ESU money on them. Treat it as the down payment on the new device.

One caveat: ESU covers the operating system only. An old accounting package, drivers or an Office version follow their own support dates.

Ways to get ESU without a separate fee

According to Microsoft’s documentation, ESU for Windows 10 comes at no extra charge in these cases:

• Windows 10 running on a Windows 365 Cloud PC
• Azure Virtual Desktop and Azure virtual machines
• Endpoints connecting to a Windows 365 Cloud PC (with an active Windows 365 licence, for up to three years)

Reusing an old laptop as a thin client for a Cloud PC can cost less than a new machine. The Cloud PC subscription is its own per-user cost though, so put both quotes side by side.

How to write it into the budget

1. Take the inventory: model, age, Windows version, Windows 11 eligibility, user.
2. Split it into the three groups and count devices in each.
3. Create two separate lines for 2027: device replacement and the ESU bridge.
4. Give the ESU bridge an end date. ESU without an end date becomes a permanent cost.

Frequently asked questions

I skipped year one. Can I buy year two directly? No. Because the licence is cumulative, year one is added to the invoice: $183 per device.

Will the PCs stop working without ESU? They keep running. They just stop receiving security fixes, so new vulnerabilities pile up every month. For a user who browses the web and reads email, that is a serious risk.

Does the home-user ESU programme apply to us? No. The consumer programme is separate. Company devices need the commercial licence.

Do I have to buy ESU for every device? The minimum is one licence. You can enrol only the devices that need it.

Could a PC that “cannot” run Windows 11 simply have TPM switched off? Yes. Some machines have TPM 2.0 and Secure Boot but ship with them disabled in BIOS. Check that before the PC goes on the replacement list.

If you want us to run the inventory and sort each device into its group with you, get in touch.