When Should Businesses Replace Windows 10 PCs? Check TPM, ESU Costs and Fleet Health

The Windows 10 deadline: what has changed​

Windows 10 left standard support on October 14, 2025. Microsoft's support page is clear that PCs still run after that date. What disappears is technical assistance, software updates and security fixes. Microsoft's own wording is that such machines face a greater risk of viruses and malware.

It's now November 2026, so the picture has moved on from "end of support is coming." Commercial Extended Security Updates (ESU) are the bridge for organizations that can't migrate yet. eWeek's ESU cheat sheet reports that Microsoft lists commercial ESU at $61 per device for Year 1, with the price doubling in each consecutive year for a maximum of three years. The same piece says the commercial schedule runs through October 13, 2026 for Year 1, October 12, 2027 for Year 2 and October 10, 2028 for Year 3.

That means Year 1 coverage has just expired. A business that wants to keep Windows 10 machines patched is now buying into the more expensive years. One reseller guide puts the Year 2 price at $122 a device, plus Year 1 if you skipped it. That is a reseller's figure, so confirm pricing with your licensing partner.

Microsoft's consumer ESU is a different program. Per Microsoft's support page, the consumer program covers Windows 10 devices until October 12, 2027. Domain-joined, centrally managed business fleets should not plan around it.

Microsoft also says Microsoft 365 Apps security updates on Windows 10 continue for three years after end of support, ending October 10, 2028. That helps with Office exposure, but it does not patch the operating system.

Takeaway: ESU gets pricier every year. Treat it as breathing room for migration, not a place to park the fleet.

Does an old PC need replacing? Check TPM first​

The WINMAG piece notes that Windows 11 needs TPM 2.0, UEFI and Secure Boot. That's correct as a platform requirement. Microsoft's TPM guidance adds a nuance that matters for budgets: a PC may have a TPM that is simply switched off.

Microsoft says TPM 2.0 is required for Windows 11. It underpins features such as Windows Hello and BitLocker. It also says some machines can run TPM 2.0 but aren't set up to do so. Before declaring a machine dead, here is Microsoft's own procedure:

1. Open Windows Security and go to Device Security. Look for a Security processor section.
2. If it is present, open Security processor details and confirm the specification version reads 2.0. Anything lower doesn't meet the Windows 11 requirement.
3. Alternatively, press Windows key + R, type tpm.msc and press OK. A message saying a compatible TPM cannot be found suggests the TPM may be disabled. Otherwise, check the specification version under TPM Manufacturer Information.
4. If the TPM is disabled, enable it in the UEFI firmware settings. Microsoft's route is Settings > Update & Security > Recovery > Restart now, then Troubleshoot > Advanced options > UEFI Firmware Settings.
5. Look for options labeled along the lines of Intel PTT, AMD fTPM, TPM State or Security Device Support. Names vary by manufacturer.

On managed fleets, Microsoft recommends consulting your IT administrator or the PC maker's support information. Don't flip firmware settings across hundreds of machines on a whim.

Microsoft's eligibility check is also simple. The free upgrade applies only to PCs running Windows 10 version 22H2 that meet the hardware specifications. You can check via Windows Update.

NIS2 does not mandate new laptops​

The WINMAG article says NIS2 prescribes no brand of laptop or TPM chip. Entities in scope must take appropriate risk measures covering cyber risk, continuity and incidents. That is a fair reading. The directive sets organizational, risk-based obligations. It does not set a hardware age limit.

The defensible link is indirect. If a device can't be patched, encrypted, inventoried or centrally managed, it becomes harder to defend in a risk assessment. That is an inference about practice, not a statutory test. Whether and how NIS2 applies to your company depends on your country's national law, your sector and your entity status. If you're unsure, ask your compliance team rather than a hardware vendor.

The 1,833-hour arithmetic, and its limits​

WINMAG's headline number is sound as arithmetic. Fifty employees losing ten minutes a day over 220 working days comes to 110,000 minutes, or about 1,833 hours a year.

But it is a scenario, not a measurement. It assumes every person loses the full ten minutes every day. It also says nothing about what those hours cost. To turn it into a business case you need:

• Real boot, login and application-launch times from your own fleet, not guesses.
• Loaded labor cost per hour, which differs by role and region.
• Help-desk ticket counts tied to specific device models.
• Warranty status and remaining support life on the hardware in question.

If those numbers say ten minutes a day is realistic, the case is strong. If they say two, it isn't.

Replacement thresholds: useful, but only rules of thumb​

The article suggests agreeing a threshold in advance. Its examples are repeated failures within twelve months, battery life under four hours, or a repair costing more than 30 to 40 percent of replacement value. These are the author's proposals. They are not an industry standard. Still, setting any written trigger beats arguing over each ticket.

Adapt them to your situation. A kiosk machine that never leaves its dock doesn't care about battery life. A traveling sales laptop cares a lot. The article also lists total cost of ownership items: installation, warranty, management hours, failures, energy use, downtime and residual value. That list is sensible. Note that no savings study backs it, so build your own model.

Sizing hardware by job​

WINMAG calls 16 GB of RAM a reasonable baseline for office work. It suggests 32 GB for large Excel files, Power BI, creative software, development tools or local AI. That is workload guidance, not a minimum requirement. Dataset size, multitasking habits and model size will move the line. A pilot group is the cheapest way to find out.

The sound principle here is to buy by work profile. It avoids both underpowered systems and overspecced ones.

Local AI: real, but narrower than the pitch​

The article proposes running some AI work on-device to cut cloud subscription costs and keep confidential data closer. It names HP AI Companion, Lenovo AI Now, Apple Intelligence, Copilot+ features and Ollama. Microsoft's documentation lets us check the Windows part of that claim.

Microsoft describes Copilot+ PCs as Windows 11 hardware with an NPU that can perform more than 40 trillion operations per second. Many of the newer Windows AI features require that level of NPU. So "AI PC" is not a loose label for Windows features. There is a concrete hardware bar.

Microsoft's AI FAQ spells out the differences between local options:

• Windows AI APIs need a Copilot+ PC with an NPU. Microsoft says they process data locally on the NPU and don't send input to Microsoft servers.
• Foundry Local runs on Windows devices with a DirectX 12-capable GPU, including some without an NPU. Microsoft says that once a model is downloaded and cached, inference runs on-device with no cloud dependency.
• Windows ML supports a broad range of CPUs, GPUs and NPUs, and lets developers bring their own ONNX models.

There are caveats. Microsoft says Foundry Local's native SDKs are in alpha or pre-release, and advises treating the API surface as subject to change. That is not a comfortable basis for a production rollout. Also, naming a product doesn't prove every operation is offline. Behavior depends on the device, software version and configuration, as WINMAG itself concedes.

Local models also aren't free. They need memory, sometimes a capable GPU, deployment effort and ongoing maintenance. Cloud services remain the better choice for heavy workloads. A hybrid approach is the realistic one, as the article says: local where privacy, speed and predictable cost matter, cloud when you need more capacity or a more capable model.

What to do this quarter​

1. Inventory first. List every Windows 10 device and its model, age, TPM status and Secure Boot state.
2. Separate "can upgrade" from "must replace." Check TPM 2.0 and eligibility before budgeting for hardware.
3. Decide your ESU position. If devices must stay on Windows 10 for now, price the remaining ESU years against replacement. Costs double each year.
4. Write the replacement triggers down. Use the article's thresholds as a starting point and tune them to your fleet.
5. Profile jobs, then buy. Match RAM and graphics to roles, and pilot any local AI workload before standardizing.
6. Treat vendor claims as claims. That includes this article's, and its source's commercial interest in selling hardware.

The verdict​

The WINMAG argument is directionally reasonable: a device that is slow, unmanageable and out of support costs money even if it was cheap to keep. But the evidence it offers is a vendor quote and a back-of-envelope calculation. The stronger case comes from Microsoft's own lifecycle facts and from your fleet's data. Replace what you can't secure or manage, upgrade what is merely misconfigured, and let measured downtime, not marketing, set the schedule.