Moorfox
What does Windows 10 extended support cost a business?
Windows 10 Extended Security Updates cost $61 per device for year 1, $122 for year 2, and $244 for year 3. Licenses are cumulative, so late enrollment costs more. Purchase keys through a CSP partner or volume licensing portal, not from inside Windows.
ESU provides Critical and Important security fixes only. It requires Windows 10 22H2. After October 2028, no patches are available at any price. Compare the per-device ESU cost against replacement cost to decide whether to patch or retire the machine.
Windows 10 support ended October 14, 2025. The machines keep working; they just stopped getting security updates unless they are enrolled in Extended Security Updates (ESU). ESU delivers security fixes rated Critical or Important only: no new features, no non-security bug fixes, no support tickets. It requires Windows 10 22H2 with current updates installed.
The timing matters more than usual: ESU year 1 runs out on October 13, 2026, a few weeks from now, and the year 2 price doubles. Every Windows 10 machine still on a client site needs a decision before that date - upgrade it, pay for it, replace it, or get the risk accepted in writing.
What does Windows 10 ESU cost per device?
Extended Security Updates (ESU) cost $61 per device for year 1 (through October 13, 2026), $122 for year 2 (through October 2027), and $244 for year 3 (through October 2028). After October 2028, no patches are available at any price.
The pricing model is cumulative. A device joining in year 2 owes $183 ($61 + $122). A device joining in year 3 owes $427 ($61 + $122 + $244).
Buy keys through a Cloud Solution Provider (CSP) partner or via volume licensing. You cannot buy these keys from inside Windows.
For a fleet of 25 Windows 10 machines, year 2 costs $3,050 for a single year of patches. If the fleet rides all three years, the total hits $9,150. Many of these machines are 6-8 years old. Comparing the ESU cost per device against the replacement cost per device usually clarifies the financial decision.
Is there a free way to get ESU?
Free ESU exists in exactly two business shapes. Windows 10 virtual machines running in Windows 365 or Azure Virtual Desktop receive ESU at no charge. A physical Windows 10 device also gets ESU free while it acts as the client for a Windows 365 Cloud PC subscription. These are the only zero-cost paths for business environments.
Education pricing operates separately. Schools pay $1 for year 1, $2 for year 2, and $4 for year 3 per device. This rate does not apply to commercial entities.
The consumer ESU program is not a business path. It was a one-year program ending October 13, 2026. Enrollment occurred through Settings using a Microsoft account. Users could sync Windows Backup for free, earn 1,000 Microsoft Rewards points, or pay a one-time $30 fee covering up to 10 devices. There is no consumer year 2. A client machine that quietly rode consumer ESU loses updates in October 2026 regardless of action.
Microsoft 365 Apps (Office) on Windows 10 continue receiving security updates until October 10, 2028. This schedule is independent of the OS. Office updates do not patch Windows itself. The operating system remains exposed without ESU or replacement.
How do I inventory my Windows 10 fleet?
The first step is identifying every machine still running Windows 10. You need to know which devices are still active and which have already been decommissioned or upgraded. An accurate inventory prevents paying for ESU on ghosts or missing vulnerable boxes.
Next, determine Windows 11 capability for each device. The usual failures are TPM 2.0 and CPU generation. Use the PC Health Check app to test each machine individually. This tool reports per-machine compliance. Devices failing these checks cannot upgrade to Windows 11 officially.
Check the OS build number. ESU requires Windows 10 22H2 with current updates installed. Older builds like 21H2 or 20H2 are ineligible. Verify patch status to see which machines have stopped receiving updates. An unenrolled Windows 10 machine shows a gap in its update history.
The OS end-of-life lookup has the official dates, and if a machine's update components are stuck, the Windows Update repair sequence clears the blockage before it confuses the patch-state picture.
What is the decision process for the fleet?
Process the fleet in a strict order. First, inventory the machines. Second, test for Windows 11 capability. Third, upgrade the capable ones for free. This removes the largest segment of the fleet from the ESU equation without spending cash.
For the remaining machines, quote ESU year 2 against replacement. Calculate the cost per machine. Present this to the client as a one-line decision. ESU is a bridge with a posted closing date, not a plan.
For clients who refuse both options, put the risk in writing. Date the communication. When the unpatched machine is eventually compromised, that dated document is the difference between "we told you" and an argument.
Do not assume the client wants to keep the hardware. Many machines are 6-8 years old. The performance hit of Windows 10 on aging hardware often justifies replacement. The ESU cost alone can exceed the monthly cost of leasing a new device.
Moorfox's inventory lists every machine's OS build. The Windows 10 list and the 22H2 check build automatically. A saved script across a group pulls TPM and CPU details for the Windows 11 capability call. Patch status per machine shows which ones have quietly stopped receiving updates, which is what an unenrolled Windows 10 machine looks like.
What happens after ESU year 3 ends?
October 2028 is the end of the road: no more Windows 10 patches at any price, and Microsoft 365 Apps security updates on Windows 10 stop the same month. Whatever is still running Windows 10 on that date is unpatchable, so the three ESU years are the window for replacing the machines that cannot take Windows 11 - a quarter of the fleet per year gets it done without a budget spike.
Frequently asked questions
Can Windows 10 still be used after support ends?
The machine runs, but unpatched vulnerabilities accumulate daily. ESU or replacement are the only defensible options to maintain security.
How much does Windows 10 ESU cost for a business?
Costs are $61 for year 1, $122 for year 2, and $244 for year 3 per device. Prices are cumulative if joined late, so year 2 entry costs $183 total.
Is there a free way to get ESU?
Windows 365 and Azure Virtual Desktop virtual machines get ESU free. Physical devices get it free while acting as clients for a Windows 365 Cloud PC subscription.
Does ESU include feature updates or support?
No. ESU delivers security fixes rated Critical or Important only. It includes no new features, no non-security bug fixes, and no support tickets.
What happens after ESU year 3 ends?
After October 2028, no more patches are available at any price. Microsoft 365 Apps security updates on Windows 10 also stop the same month.