Windows 10 ESU · Year 2: 14 Oct 2026 – 12 Oct 2027
ESU Year 2: $61 doubles to $122 a device. Renew, upgrade, or replace?
Year 1 cover: to 13 October 2026. Year 2: 14 October 2026 to 12 October 2027, critical and important security updates only. A device without a licence for the current ESU year gets no new Windows security updates — and if you skipped Year 1, you pay for it too. Here is the decision, costed, with the eligibility check that actually determines which options you have.
Per device, in US dollars
The price doubles every year, and cover is cumulative.
Year 1
$61
Published by Microsoft
15 Oct 2025 – 13 Oct 2026
The entry year. ESU is cumulative, so anyone joining later pays for Year 1 too.
Year 2
$122
Calculated: 2 × Year 1
14 Oct 2026 – 12 Oct 2027
Double Year 1. Cover ends 12 Oct 2027, whenever it is bought.
Year 3
$244
Calculated: 2 × Year 2
13 Oct 2027 – 10 Oct 2028
Double again. The last year available.
The part that catches people out: ESU is cumulative. If you did not buy Year 1, you cannot start at Year 2 — you have to buy Year 1 retroactively as well, so on Microsoft’s published price and doubling rule the entry cost works out at $183 per device ($61 + $122, calculated), not $122. Microsoft also does not sell part of a year, and the low-cost consumer programme is not open to businesses.
Year 1 price as published by Microsoft; Years 2 and 3 calculated from Microsoft’s statement that the price doubles every consecutive year. US dollars, before regional pricing — not a Missan quote. What you actually pay depends on your licensing channel and region. Source: Microsoft — ESU programme and coverage dates · accurate as of . Confirm current terms with Microsoft or with us before budgeting.
Three options, honestly
There is no single right answer for a mixed estate.
Most businesses end up doing all three — upgrading what qualifies, replacing what is past its life, and paying ESU only on the handful of machines genuinely pinned by an application.
Buy ESU Year 2 (cover to 12 October 2027)
Year 2 is sold only as a whole year, with no part-year price, and its cover ends on 12 October 2027 whenever you buy it. It covers critical and important security updates and nothing else — no new features, no customer-requested non-security fixes, no general technical support, and no reduction in the work still ahead. Sensible where a machine runs something that genuinely cannot move yet: a licensed application tied to the OS, a machine attached to plant, or a device inside a certification you cannot casually re-open.
$122 per device for Year 2 (2 × $61)
Year 3 (13 Oct 2027 – 10 Oct 2028) doubles again, to $244 on the same rule, and it is the last year Microsoft offers.
Upgrade the machine in place to Windows 11
Free of licence cost where the hardware qualifies (Windows 10 Pro moves to Windows 11 Pro at no charge), and it ends the problem permanently rather than deferring it. The work is in the preparation — checking eligibility properly, confirming your line-of-business applications behave, and staging it so nobody loses a working day.
No licence cost — the cost is the project
Eligibility is not a formality. See the triage below before assuming a fleet qualifies.
Replace the machine
For hardware that cannot take Windows 11, this is the honest answer, and it was going to happen eventually. A machine that fails the processor check is several processor generations old and at or near the end of a reasonable service life anyway — you are choosing between replacing it deliberately now or replacing it urgently after a failure.
Capital cost, offset against ESU you stop paying
Do the arithmetic per device rather than per fleet. The answer differs across a mixed estate.
Which machines can actually take Windows 11?
This is the question that decides your options, and it is worth answering properly rather than assuming. Four things determine it.
The processor decides it. Windows 11 needs a processor on Microsoft’s supported list. As a rule of thumb: Intel Core 8th generation or newer, or AMD Ryzen 2000 desktop chips and Ryzen 3000 onwards (Ryzen 2000 laptop and "G" chips, such as the 2500U or 2400G, are not on it). This is the constraint that catches most estates: almost every 6th or 7th generation Intel Core machine is NOT eligible, and enabling TPM 2.0 does not change that. Plenty of otherwise healthy hardware falls here. For a single PC, Microsoft’s PC Health Check app confirms it.
TPM 2.0 must be present and enabled. It is sometimes present but switched off in firmware, so a machine that "fails" the check can pass after a BIOS setting change, provided its processor is supported. Worth checking properly before writing machines off — Microsoft has confirmed the requirement itself is non-negotiable.
UEFI firmware, Secure Boot capable. Machines installed in legacy BIOS mode can usually be converted rather than replaced, provided the hardware supports UEFI. It is routine work, but it is work, and it should be counted in the plan rather than discovered mid-rollout.
Your applications, not just the operating system. The blocker is rarely Windows. It is an accounting package, a machine controller, a scanner driver or a licence tied to a specific OS build. This is what decides how many machines genuinely need ESU rather than an upgrade.
On a fleet of any size this is not a machine-by-machine job done by hand. We can run it across the estate as a scoped assessment: a list of what upgrades, what needs replacing and what genuinely needs ESU, with the three groups costed separately. The free IT health check is a good place to start that conversation.
Where we come in
Missan is a Microsoft Cloud Solution Provider, so we can transact the ESU licences as well as advise on them. More usefully, we can do the part that decides the bill: work out how few devices genuinely need ESU at all.
The migration itself — eligibility across the fleet, application testing, staged rollout, and the inevitable handful of awkward machines — is delivered under an annual maintenance contract or as a project. If you are weighing up hardware, that sits alongside procurement so the new machines arrive configured rather than in boxes.
Questions we are being asked
When exactly do we have to decide about Windows 10 ESU?
Year 1 covers 15 October 2025 to 13 October 2026, Year 2 covers 14 October 2026 to 12 October 2027, and Year 3, the last, covers 13 October 2027 to 10 October 2028. A device without a Year 2 licence receives no ESU security updates after 13 October 2026 until Year 2 is bought and activated on it. The practical deadline for each machine is therefore the end of the cover it already has; where that date has passed, the machine is already without Windows security updates until the current year’s licence is activated on it. Year 2 can still be bought later in its window, but its cover ends on 12 October 2027 whenever you buy, and if you skipped Year 1 you pay for that too.
How much does Windows 10 ESU cost in Year 2?
Microsoft publishes a Year 1 price of USD 61 per device and says the price doubles every consecutive year. On that rule Year 2 works out at USD 122 per device and Year 3 at USD 244, or USD 427 across all three years. The Year 2 and Year 3 figures are our calculation from Microsoft’s published price and rule, in US dollars before regional pricing, and none of these is a Missan quote. What you actually pay depends on your licensing channel and region.
We skipped Year 1. Can we just start at Year 2?
Not without paying for Year 1 as well. Microsoft states that ESU is cumulative: if you buy in Year 2, you have to pay for Year 1 too. On Microsoft’s published Year 1 price and its doubling rule, that works out at USD 183 per device (USD 61 + USD 122, our calculation) rather than USD 122. Microsoft also does not sell part of a year. This surprises a lot of people, and it is worth knowing before you budget.
We already have Year 1. Does Year 2 cover start automatically?
No. Each ESU year is a separate licence with its own activation. For security updates after 13 October 2026, each device needs a Year 2 licence, with the Year 2 key installed and activated on it, even if Year 2 was bought in advance. The keys appear in your Microsoft 365 admin centre, whether you bought through Volume Licensing or a Cloud Solution Provider.
Can we use the cheap consumer ESU option?
No. Microsoft’s consumer ESU programme can’t be used in commercial scenarios, and it isn’t offered on devices joined to a domain or Microsoft Entra, or enrolled in mobile device management (MDM). Business devices go through the commercial ESU programme, priced as above: bought through Microsoft Volume Licensing or a Cloud Solution Provider, then activated on each device with a key from the Microsoft 365 admin centre. Missan is a Microsoft CSP, so we can arrange it directly.
Is it cheaper to upgrade to Windows 11 than to keep paying ESU?
For eligible hardware, almost always. Windows 10 Pro moves to Windows 11 Pro at no licence cost (Enterprise editions follow your existing Microsoft licensing), so you are comparing a one-off project against USD 122 per device for Year 2 and USD 244 for Year 3 on Microsoft’s doubling rule. For ineligible hardware the comparison is against a new machine, and that depends on the device. The right answer across a mixed estate is usually a mix: upgrade what qualifies, replace what is beyond its life, and use ESU only for the handful of machines genuinely pinned by an application.
What happens if we do nothing?
The machines keep working, but Windows itself stops receiving security updates once a device’s cover ends — 14 October 2025 for a device with no ESU, 13 October 2026 with Year 1 only, 12 October 2027 with Year 2 — so Windows vulnerabilities found after that date stay unpatched. In our experience it is often someone else who raises it first — a cyber insurer at renewal, an auditor, or a client’s security questionnaire. Running unpatched endpoints is also hard to defend if an incident does occur.
How many Windows 10 machines are you still running?
Tell us roughly how many, and what they run. We will scope an assessment of how many can upgrade, how many need replacing, and how few actually need ESU — before you commit to a year of it.
Get your Windows 10 estate assessed.
Start with the free IT health check, or tell us how many Windows 10 machines you run and we will scope an assessment of what upgrades, what has to be replaced and what genuinely needs ESU.