How to Secure an Old Laptop: Windows 10 ESU, App Updates and Encryption

For Windows users, the first priority requires particular care. Windows 10’s standard support ended on October 14, 2025. Microsoft’s consumer Extended Security Updates program currently runs through October 12, 2027, but that protection depends on eligibility and enrollment. Saying simply that Windows 10 remains supported until 2027 misses the distinction that matters most.

Here is how to turn those three priorities into a practical maintenance plan, without confusing a computer that still boots with one that still receives protection.

1. Keep the operating system within support​

Start with eligibility, not the laptop’s age​

PCWorld’s advice favors moving older computers to an alternative operating system when newer Windows versions are not an option. However, an older laptop is not automatically disqualified from Windows 11. Microsoft says eligible Windows 10 users can check for the upgrade through Start > Settings > Update & Security > Windows Update > Check for updates. Check the actual machine before deciding that replacement or migration is necessary.

If the computer cannot upgrade, distinguish between ordinary Windows 10 operation and extended security coverage. Microsoft says Windows 10 computers continue to function after support ends; functioning is not evidence that they are receiving operating-system security fixes. Treat support status as a separate maintenance check, rather than something you can infer from a working browser.

Check Windows 10 ESU enrollment​

Microsoft’s consumer ESU program covers Windows 10 version 22H2 Home, Professional, Pro Education, and Workstations. It provides critical and important security updates, not feature improvements, general fixes, or technical support. Existing enrollment continues automatically through October 12, 2027.

For an eligible personal laptop:

1. Install the latest Windows updates.
2. Use an administrator Microsoft account; child accounts cannot enroll.
3. Open Settings > Update & Security > Windows Update.
4. Select Enroll now when offered and complete the prompts.
5. Check enrollment status in the same Windows Update area.

Microsoft lists three enrollment routes: syncing PC settings at no additional cost, redeeming 1,000 Microsoft Rewards points, or paying US$30 plus applicable tax. Regional terms vary. One license can cover up to ten eligible devices, but additional computers must also be enrolled.

Consumer ESU is not the route for commercially managed computers. Kiosk devices, Active Directory- or Microsoft Entra-joined devices, and MDM-enrolled devices are excluded; Microsoft Entra registration alone is permitted. If this is a work laptop, involve its administrator rather than changing management settings to obtain consumer enrollment.

Do not mistake the preparation update for enrollment​

There is an easily missed prerequisite: KB5126256, Microsoft’s Windows 10 ESU Licensing Preparation Package, originally published on September 8, 2026. It updates licensing and enrollment components for Windows 10 version 22H2. Microsoft explicitly says installing it does not enroll the computer or install Windows 10 security updates.

Microsoft documents this order:

• Install a Windows 10 security update released on or after October 14, 2025, such as KB5066791.
• Install the ESU preparation package afterward.
• Complete ESU enrollment separately.

The preparation package is delivered automatically through Windows Update when the prerequisite is present, and Microsoft says installation restarts the device automatically. Save your work first. The package applies to devices not already enrolled; seeing its name in update history is not a substitute for checking enrollment status.

That distinction is the practical troubleshooting point: a preparation update is exactly that—preparation. It is not the finished security arrangement.

Consider ChromeOS Flex carefully​

For an old Windows laptop, the relevant Google alternative is ChromeOS Flex, rather than an assumption that ordinary Chromebook software can be installed on anything. Google recommends currently certified models and says certification applies to the exact model name and number. A similar-looking model or a variant can behave differently.

Before committing, check:

• Whether the exact model is certified.
• Its “Certified until” date.
• Model-specific installation notes and limitations.
• Whether the supported features match how you use the laptop.

Google guarantees a core set of functions on certified models, but features such as Bluetooth, touchscreens, SD card slots, and some keyboard shortcuts are not universally guaranteed. Non-certified computers may work, but functionality and performance across updates are not assured.

Certification also expires. Google says a model past that date is no longer covered by ongoing testing or support and might not receive fixes. Some such devices may continue receiving updates, but those updates are not guaranteed. In other words, switching operating systems should solve a support problem—not merely give it a different logo.

Linux deserves a trial, not a leap of faith​

PCWorld also identifies Linux as an option, particularly where a supported Google alternative is unsuitable. Its useful caveat is the investment of time: choosing and maintaining a different operating system can involve learning new tools and workflows. That trade-off should be part of the decision, not an unpleasant discovery afterward.

Ubuntu’s official documentation describes a Try Ubuntu option before installation. For anyone considering that distribution, a trial is a sensible decision point before committing to a migration. Use it to assess whether the environment fits your work; do not treat merely reaching a desktop as proof that every requirement has been satisfied.

The objective: choose an operating system and hardware combination with an identifiable support path. “It installed successfully” is only the beginning.

2. Update applications—and remove what you no longer use​

A supported operating system does not finish the job. PCWorld’s second recommendation is to maintain installed applications and remove unused software and browser extensions. This is best approached as an inventory exercise: what is installed, what still matters, and how does each remaining application receive updates?

Separate Store updates from publisher-managed updates​

One qualification to PCWorld’s discussion is important: Windows applications do not all require manual downloads. Microsoft says the Microsoft Store updates apps and games automatically, while some publishers manage updates through their own applications. There is no single assumption that safely covers every program on a laptop.

Start with the Store:

1. Open Microsoft Store.
2. Select your profile picture, then Store Settings.
3. Review App updates and make sure updates have not been left paused.
4. Review the available update history or update-checking controls.

Microsoft’s current documentation says the permanent Off option has been replaced by a pause lasting up to five weeks, after which updates resume automatically. Another Microsoft support page describes an App updates On toggle; if that is the interface your installation presents, leave it enabled. On managed computers, administrators may control the settings.

For software that uses its publisher’s updater, check that mechanism separately. The practical lesson is not “download everything manually,” but know which update channel maintains each application. A Store setting cannot establish the status of software maintained elsewhere.

Remove software deliberately​

Microsoft documents these removal paths:

• Windows 11: Open Settings > Apps > Installed apps, find the application, and choose More > Uninstall.
• Windows 10: Open Settings > Apps > Apps & features, select the application, and choose Uninstall.

Follow the removal prompts rather than assuming that deleting a desktop shortcut removes the program.

Be selective. The aim is to remove applications you recognize and no longer need, not to conduct a speed-running competition through unfamiliar entries. For browser extensions, apply the same inventory principle: keep those you actively need and remove abandoned extras, as PCWorld recommends.

If an application will not uninstall, Microsoft identifies corrupted registry entries and incomplete uninstall information as possible Windows 10 failure points. Its Program Install and Uninstall troubleshooter is intended to address those problems. An uninstall error is a reason to troubleshoot the removal process, not to start deleting arbitrary system files.

The objective: a smaller, understood software collection with functioning update mechanisms—not merely an uncluttered desktop.

3. Protect stored data and require secure sign-in​

The third priority addresses a different problem. Microsoft describes BitLocker as protection against data theft or exposure from lost, stolen, or improperly decommissioned devices. Encryption therefore complements updates; it is not an alternative way to patch an operating system.

Check encryption instead of assuming it is enabled​

Microsoft distinguishes Device Encryption from the manual BitLocker Drive Encryption management available in Pro, Enterprise, and Education editions. Device Encryption can also be available on Windows Home, depending on the device. Importantly, Device Encryption itself uses BitLocker technology—it is not a completely unrelated encryption system.

Microsoft says eligible devices can enable encryption automatically when set up with a Microsoft, work, or school account. A local account does not automatically enable it. On Windows 11:

1. Sign in as an administrator.
2. Open Settings > Privacy & security > Device encryption.
3. Turn Device Encryption On if it is available and disabled.

If the option is missing, investigate before assuming the laptop cannot encrypt. Microsoft says it may be unavailable or you may be using a standard account. Open System Information as administrator and inspect Automatic Device Encryption Support or Device Encryption Support. Reported obstacles can include an unusable TPM, an unconfigured Windows Recovery Environment, or unsupported PCR7 binding associated with Secure Boot or connected peripherals. Use the reported reason to guide troubleshooting rather than changing firmware settings blindly.

Use manual BitLocker management where available​

On Windows 10 or Windows 11 Pro, Enterprise, or Education:

1. Sign in with an administrator account.
2. Search Start for BitLocker and select Manage BitLocker.
3. Beside the intended drive, select Turn on BitLocker.
4. Choose the offered unlock option and back up the recovery key.
5. Allow encryption to complete. Microsoft says you can continue using the computer while it progresses.

The management applet distinguishes the operating-system drive, fixed data drives, and removable drives. Check the drive you actually intend to protect. If Manage BitLocker is absent on Windows Home, that is an edition limitation, not proof that a Windows component has broken; Device Encryption has separate availability requirements. Organization-managed encryption should remain under the administrator’s control.

Make recovery part of the setup​

A recovery key is not optional paperwork to think about later. Microsoft warns that its support staff cannot retrieve, provide, or recreate a lost BitLocker recovery key. Its backup guidance identifies Back up your recovery key beside the relevant drive in the BitLocker app.

PCWorld recommends keeping a recovery-key copy outside the Microsoft account as well. The practical goal is to avoid depending on a single access route when something goes wrong. Keep that recovery information protected and separate from the everyday laptop workflow.

Secure everyday access​

Finally, review Settings > Accounts > Sign-in options. Microsoft documents Windows Hello choices including a PIN, fingerprint recognition, and facial recognition. Configure an available method rather than leaving everyday access unprotected.

Biometric sign-in requires compatible hardware. Microsoft specifies Windows Hello requirements for fingerprint readers and facial-recognition cameras; an arbitrary webcam is not automatically suitable. Treat accessories as an optional convenience, not a prerequisite for establishing a secure sign-in method.

Keep the laptop—but keep a maintenance plan​

The sensible conclusion is not “old laptops are unsafe” or “three settings make everything safe.” It is that keeping older hardware requires explicit decisions: a supported operating-system route, maintained applications, and protected local data.

Start with support status because it determines the rest of the plan. Then work through applications, encryption, recovery information, and sign-in. That approach turns a vague intention to “be more secure” into a set of checks you can actually complete—and repeat when support dates or software requirements change.