Windows 10 is out of support: what businesses still on Windows 10 must do

Windows 10 reached end of support on 14 October 2025. Microsoft's product lifecycle page is unambiguous: no more security updates, no more fixes, no more support for Home and Pro editions. Nearly a year on, many businesses still have Windows 10 machines in daily use, sometimes because they were not aware, more often because replacing them was deferred. This guide sets out what the end of support means, what Extended Security Updates do and do not cover, which PCs can move to Windows 11, what it means for Cyber Essentials and how to plan the refresh without disruption.

What end of support means in practice

Windows 10 PCs did not stop working in October 2025, and that is the problem. They look the same, run the same applications and give no sign that anything has changed. What has changed is that every security vulnerability found in Windows since then stays open on those machines. Microsoft publishes fixes for Windows 11 every month, attackers read those fixes to see what was vulnerable, and Windows 10 machines without ESU are left with the holes.

Over time the practical consequences widen. Browsers, security agents, Microsoft 365 apps and line-of-business software drop Windows 10 support. Cyber insurers ask about unsupported systems on renewal. Client security questionnaires ask the same. A machine that was fine last year gradually becomes both a security exposure and a compliance problem.

Extended Security Updates: a bridge, not a destination

Microsoft offers Extended Security Updates for Windows 10, described at learn.microsoft.com. For businesses, ESU provides security-only updates for up to three years after end of support, purchased per device, per year, with the price roughly doubling each year. It includes no new features, no non-security fixes and no general support.

ESU is worth using in two situations: to keep specific machines supported while replacements are ordered and deployed, and to cover a device that runs a legacy application that cannot yet move to Windows 11. It is not a sensible way to keep an estate on Windows 10 for three years. By the third year the ESU cost per device approaches a meaningful share of a replacement laptop, and the machine is by then seven or eight years old.

If you use ESU, enrol every Windows 10 device immediately rather than leaving some uncovered, and set a date by which the last one is gone.

Windows 11 hardware requirements

The full list is on Microsoft Learn. The requirements that matter for business PCs:

• TPM 2.0. A Trusted Platform Module chip, used for disk encryption keys and hardware-backed security. Most business PCs from around 2016 onwards have one, but it is often disabled in the firmware and needs switching on.
• UEFI firmware with Secure Boot enabled.
• A supported processor. Broadly Intel 8th generation (2017 and later) or newer, and AMD Ryzen 2000 series or newer. This is the requirement that rules out most older machines, regardless of how well they run.
• 4GB memory and 64GB storage as minimums. In practice 8GB and an SSD are needed for a usable business machine, and 16GB is the sensible standard for new purchases.

A PC that passes these can be upgraded in place with its applications and data intact. A PC that fails on the processor cannot, and firmware tweaks will not change that.

Cyber Essentials and unsupported software

The NCSC's Cyber Essentials scheme requires that all software within scope is licensed, supported and receiving security updates, and that unsupported software is removed or isolated. A Windows 10 device without ESU is unsupported software. The self-assessment asks directly, and a Cyber Essentials Plus assessor will check devices.

This matters beyond the certificate. Many clients, particularly in professional services and the public sector supply chain, require Cyber Essentials from their suppliers. An unsupported operating system anywhere on the network can cost a contract. If you hold or are working towards certification, the Windows 10 estate is a blocking issue. Dig IT's Cyber Essentials support starts with exactly this kind of gap.

Plan the refresh

A structured approach for a business of up to 250 people:

1. Inventory. List every Windows device, its age, processor, TPM status and whether it passes the Windows 11 check. Your provider's monitoring platform can produce this in minutes. Without one, the PC Health Check app does it per machine.

2. Sort into three groups.

3. Standardise the replacements. One laptop family from a business range (Dig IT supplies HP and Dell), 16GB memory, SSD, TPM 2.0, on a rolling refresh so the estate does not all age out together. The hardware lifecycle strategy explains the cycle.

4. Check applications first. Test any line-of-business software, printer drivers, scanners and specialist hardware on Windows 11 before rolling out. Most works. The exceptions are usually old accounting or industry packages, and those are the ESU candidates while the vendor catches up or a replacement is found.

5. Deploy with a standard build. New machines imaged with the business's security baseline: BitLocker enabled, EDR installed, Intune or RMM enrolled, MFA enforced, local admin removed. This is the moment to fix inconsistencies that have accumulated for years. See IT procurement.

6. Schedule and communicate. In-place upgrades take an hour or two per machine and can run overnight. Replacements are a desk swap with data migrated from OneDrive. Tell staff what is happening and when, and keep a spare machine or two for the inevitable exception.

7. Keep Windows 11 current. Each annual Windows 11 version has its own support window, so feature updates need managing through Intune or the RMM platform rather than left to chance. A machine upgraded once and then ignored will be unsupported again within a couple of years.

8. Dispose properly. Wipe or destroy drives with a record kept, remove devices from Microsoft 365 and the asset register, and recycle through a WEEE-compliant partner.

Budget and timing

For a business with 30 PCs of which half fail the Windows 11 check, the refresh is 15 new machines plus a day or two of engineering time for the upgrades and deployment. Spread across two budget quarters with ESU bridging the gap, it is a manageable project. Left until an incident or a failed client audit forces it, the same work happens in a hurry at higher cost.

Businesses on managed IT support should already have had this conversation, with the inventory and a dated plan. If your provider has not raised Windows 10 end of support with you, that is a signal about how proactively your IT is being managed.

What to do next

If you are not certain how many Windows 10 machines you still have, or which of them can be upgraded, start there. Dig IT's IT health check includes a Windows 11 readiness inventory for every device, a sorted upgrade-or-replace list and a costed plan, for businesses across Hertfordshire, west Essex and London.