Still running Windows 10? What your business should do now

Microsoft ended mainstream support for Windows 10 on October 14, 2025. Since then, the only way to keep receiving security patches has been the Extended Security Updates (ESU) program, and for home and very small business users the one-year consumer version of that program ran out in October 2026. If there are still Windows 10 computers in your office, now is the time to make a decision about each one.

The computers will keep turning on and working. The problem is what you cannot see: every month new Windows vulnerabilities are found and fixed, and a PC that no longer receives those fixes stays exposed to them permanently.

Why an unpatched PC is a business risk

• Ransomware and malware routinely target known, unpatched flaws. Once a weakness is public, attackers can scan for machines that never received the fix.
• One PC can affect everyone. An infected workstation can reach shared drives, the server and cloud accounts that the user is signed in to.
• Insurance and compliance. Many cyber insurance applications ask whether you run unsupported operating systems. Answering "yes", or answering "no" when it is not true, can affect cover after an incident.
• Software support drops away. Over time, browsers, accounting packages, printers and line-of-business apps stop supporting Windows 10, which causes problems that have nothing to do with security.

Step 1: Take an inventory

Before deciding anything, list every Windows 10 device: desktops, laptops, front-desk PCs, the machine attached to a lab instrument or plotter, and any computer that only gets turned on once a month. For each one, note who uses it, what it is used for, how old it is, and whether it can run Windows 11. Microsoft's free PC Health Check app will tell you whether a computer meets the Windows 11 requirements. The common blockers are an older processor or a missing TPM 2.0 chip.

Step 2: Upgrade the PCs that can run Windows 11

For computers that meet the requirements, the in-place upgrade to Windows 11 is usually free and keeps files and applications. It is still worth doing with some care:

• Back up the computer first, and confirm that critical business software supports Windows 11.
• Upgrade a test machine before rolling out to the whole office.
• Schedule upgrades outside working hours. They can take an hour or more on older hardware.
• Check printers, scanners and VPN software afterward. These are the most common things that need a driver update.

Step 3: Replace what cannot be upgraded

Computers that fail the Windows 11 check are usually five or more years old. In most cases replacing them is cheaper over time than keeping them alive, especially once you factor in staff time lost to slow machines. When you replace them, plan for data migration and the secure disposal of old drives. A hard drive or SSD from a retired office PC can still contain client files, saved passwords and email.

Step 4: Use extended updates only as a bridge

Businesses that genuinely cannot move a machine yet, for example a PC that runs specialized equipment software, can buy commercial Extended Security Updates through Microsoft volume licensing. Commercial ESU is available for up to three years after end of support. It is priced per device, the price increases each year, and joining late generally means paying for the years you missed. Windows 10 virtual desktops running in Windows 365 or Azure Virtual Desktop have historically received ESU at no extra charge, which can be a practical option for a single legacy application. Check current pricing and terms with your licensing partner, and treat ESU as time to finish a migration, not as a long-term plan.

Step 5: Isolate anything that has to stay

If a Windows 10 machine must keep running without updates, reduce the damage it could do:

• Remove internet access if the device does not need it, and do not use it for email or web browsing.
• Place it on a separate network segment or VLAN so it cannot reach the rest of the office.
• Keep endpoint protection running, and make sure it is backed up.
• Document why it exists and when it will be retired.

A simple plan for the next 90 days

1. Inventory every Windows 10 device this week.
2. Upgrade compatible machines, starting with the ones that handle email, finance and client data.
3. Budget and order replacements for machines that cannot upgrade.
4. Buy ESU only for the specific devices that need more time, and isolate anything left over.

Getting help

We help organizations across Los Angeles County, the Inland Empire and Ventura County plan and carry out Windows upgrades with minimal disruption, through our managed IT services and IT audits and assessments. When old computers are retired, our IT asset disposal service makes sure the data on them is properly destroyed.