Windows 10 ESU Year 2: $122 Costs, Late Enrollment Fees and MSP Migration Risks

Below are the figures, the parts we could check against Microsoft's own documentation, and the parts that need more caution than the original article gives them.

The dates that matter​

Microsoft ended Windows 10 support on October 14, 2025. Business customers could buy up to three years of Extended Security Updates (ESU). Microsoft's lifecycle schedule runs commercial Windows 10 ESU through Oct. 13, 2026 for Year 1, Oct. 12, 2027 for Year 2, and Oct. 10, 2028 for Year 3.

That means Year 1 has already expired. TechTimes reported that commercial machines that have not renewed for Year 2 ESU ($122 per device) are no longer receiving Microsoft security patches as of October 13, 2026.

What ESU includes is limited. Microsoft's ESU documentation says the program delivers Critical and Important security updates only, and only to devices running Windows 10 version 22H2. It does not include new features, non-security fixes requested by customers, or general technical support. Microsoft's support covers only ESU activation, installation and regressions caused by ESU itself. Microsoft's lifecycle FAQ describes ESU as a temporary bridge, not a long-term solution.

Section summary: Year 1 of commercial ESU ended on October 13, 2026. Year 2 now applies, and a device that wasn't renewed has been unpatched since that date.

How much Windows 10 is left?​

MSP Business uses two very different data sources, and they measure different things.

Web traffic (Statcounter). MSP Business cites Statcounter figures for September 2026: Windows 10 produced 21.1% of Dutch Windows desktop traffic and 27.8% worldwide. The Dutch share went up slightly between May and June, from 23.4% to 24.9%, which the publication attributes partly to consumers covered by free ESU. These numbers show web activity, not installed devices, and they mix home and business users. MSP Business makes the same point.

Device inventory (Lansweeper). For business fleets, Lansweeper's asset data is more useful. Its July 2026 analysis drew on millions of assets across tens of thousands of customer sites. It found:

• 78.8% of Windows clients on Windows 11 and 16.9% on Windows 10, about one machine in six
• 18.7% of Windows devices on an end-of-life OS once Windows 7, 8.1 and XP are included
• Windows 10 falling from about 50% of Windows machines in mid-2025 to the low-to-mid 40s at the support cutoff, then to roughly 18.6% by June 2026

Lansweeper says the decline has now slowed to a crawl. The machines that were easy to migrate have moved. The remaining ones either can't move or haven't been made to.

Where Windows 10 is concentrated​

Lansweeper's breakdown shows why MSPs serving small businesses see more Windows 10 than the averages suggest:

These are the sectors where a PC often runs a till, a production line or a lab instrument. In those cases the equipment vendor's certification decides when the PC can be upgraded, not the IT department.

Hardware is rarely the blocker​

The most useful number for MSPs is this one. Lansweeper estimates that only 2.8% of Windows 10 devices fail Windows 11's hardware requirements. The rate is higher in consumer and retail (7.8%) and transport and logistics (6.1%).

Healthcare goes the other way. It has one of the largest Windows 10 shares, but only about 1.1% of those machines can't move. Lansweeper says healthcare's problem is migration that hasn't happened, not hardware that can't support Windows 11.

MSP Business concludes that the other 97% "can technically upgrade without issue." That goes too far. Meeting Windows 11's hardware requirements says nothing about whether line-of-business apps have been tested, whether a peripheral vendor will certify Windows 11, or whether anyone has budgeted for the project. Lansweeper's own summary is more accurate: a movable Windows 10 device is a project, and an immovable one is a purchase.

MSP Business also says that by mid-2026 only about 14% of Windows 10 devices had received ESU patches, and it attributes that figure to Lansweeper. We could not find that statistic in Lansweeper's published analysis. Treat it as unconfirmed. If it is roughly right, most of the remaining Windows 10 machines have been unpatched for months.

What ESU costs now​

Microsoft has published the dollar prices, and several outlets have repeated them: commercial ESU costs $61 per device for Year 1 and the price doubles every consecutive year: $122 for Year 2 (to October 12, 2027) and $244 for Year 3 (to October 10, 2028).

MSP Business gives European equivalents excluding VAT: €65, €130 and €260, or about €455 for all three years. Those are the publication's own conversions. Microsoft's ESU page lists only the US dollar price.

You can't skip a year. Microsoft's ESU FAQ says a customer who enrolls in Year 2 must also pay for Year 1, because ESUs are cumulative. As a result, if you enroll devices on or after October 14, the total amount you will pay this year will be $61 + $122, resulting in a total of $183 per device. MSP Business puts the euro equivalent at €195.

Exceptions that apply to some devices​

• Cloud and virtual machines: Microsoft lists ESU at no extra cost for Windows 10 VMs in Windows 365, Azure Virtual Desktop and several other Azure services. Windows 10 endpoints connecting to Windows 365 Cloud PCs are also covered for up to three years with an active Windows 365 subscription.
• Intune/Autopatch discount: MSP Business says devices managed through Intune or Windows Autopatch got 25% off Year 1 and that the discount continues into later years. Microsoft's current ESU FAQ page doesn't mention this discount. Check with your licensing channel before putting it in a quote.
• LTSC: Microsoft's lifecycle page lists Windows 10 IoT Enterprise LTSC 2021 with extended support ending in January 2032. That date does not apply to every LTSC edition. TechTimes notes that Windows 10 Enterprise Long-Term Servicing Channel (LTSC) editions operate on different lifecycle schedules, with end-of-support dates ranging from October 2026 to January 2029. Check the exact edition, version and licence before relying on an LTSC date.

Consumer ESU confuses SME clients​

MSP Business makes a practical point here. A small business owner who got free ESU on a home PC may expect the same at the office. Microsoft's consumer ESU page rules that out. The consumer program can't be used commercially. It isn't offered to kiosk-mode devices, to devices joined to Active Directory or Microsoft Entra, or to devices enrolled in MDM. Entra registered devices are an exception and can use it.

Consumer coverage runs to October 12, 2027. Microsoft says the enrollment options differ by region, including in the EEA. TechTimes reported that Microsoft extended the consumer ESU program through October 12, 2027, in a quiet update on June 25, 2026. MSP Business describes a specific EEA rule: a Microsoft account signed in within the past six months. Microsoft's English-language page doesn't spell that out, so confirm it against your regional Microsoft page.

Section summary: For commercial devices, Year 2 costs $122, or $183 if you are joining late, and Year 3 costs $244. Virtual and Cloud PC scenarios are covered at no extra cost. Consumer ESU does not apply to domain-joined, Entra-joined or MDM-managed business PCs.

Costs that don't appear on the ESU invoice​

Vulnerabilities​

Lansweeper counts an average of 1,903 active CVEs on Windows 10 devices, compared with 652 on Windows 11, about 2.9 times as many. Of the Windows 10 CVEs, 66.6% are rated high or critical and 2.4% are known to be exploited in the wild.

MSP Business adds that ESU does not fix this, because it patches only the OS. Old drivers, old Office builds and third-party apps are outside its scope. That reasoning holds up. Note, though, that a CVE count is an exposure indicator, not a prediction of how likely a breach is. Lansweeper also points out that LTSC installs still under support make the averages less precise.

Microsoft 365 Apps​

MSP Business says Copilot features won't come to Microsoft 365 Apps on Windows 10. Microsoft's current guidance is more specific. Devices running Microsoft 365 Apps on Windows 10 get feature updates and Copilot support (where eligible) until Version 2608 is released. After that they stay on Version 2608 and receive security updates only, through October 10, 2028.

There is also a support limit. If an Office problem happens only on Windows 10, Microsoft support will ask the customer to move to Windows 11. With or without ESU, these cases don't allow filing a bug or requesting a product fix.

Insurance and regulation​

Lansweeper says cyber insurers now routinely ask about unsupported operating systems, and that a growing share of policies exclude end-of-life systems. A claim connected to a Windows 10 CVE could be denied on that basis alone. MSP Business adds that the Netherlands' NIS2 implementation, the Cyberbeveiligingswet, allows unsupported systems if the risk is documented and kept limited. In its view, that documentation is the MSP's job. The legal reading comes from MSP Business. Check your own policy wording and regulatory obligations.

Running two operating systems​

MSP Business argues that a mixed fleet means duplicate patch rings, baselines, security-tool exceptions and test tracks. An MSP that resells ESU without charging for that extra work is paying for the client's delay out of its own margin. This is an argument from industry practice rather than measured data, but most people who have managed a mixed fleet will agree with it.

Checking the €14,000 example​

MSP Business models an SME with 100 workstations, 25 of them on Windows 10, which waits until 2028 to replace them:

1. ESU Years 2 and 3: 25 × (€130 + €260) = €9,750
2. Hardware: 25 PCs at €1,000 = €25,000. With an 18% price rise, that becomes €29,500, a difference of €4,500
3. Total: €14,250, before management time, insurance effects or any incident

The arithmetic is correct. The hardware assumption is weaker. MSP Business bases its price rise on IDC's forecast that average PC selling prices will rise 18.3% in 2026 because of DRAM and SSD costs. If prices have already risen this year, a client buying now also pays the higher price, so the €4,500 gap only appears if prices rise another 18% by 2028. That could happen, since MSP Business says IDC expects memory pressure to last well into 2027, but it is a forecast. The €9,750 in ESU fees is the dependable part of the calculation.

The publication's suggested alternative: replace the 25 PCs in stages over 12 months and buy Year 2 ESU only for the three most critical machines (3 × €130 = €390). That €390 is the ESU cost alone. The new hardware and the project labour come on top.

What to do with machines that really can't upgrade​

MSP Business lists four options. Choose per device, not for the whole fleet:

1. ESU: a temporary bridge with a fixed end date and a price that doubles each year.
2. LTSC: often the cleanest fix for tills and lab PCs, but only if the equipment vendor supports it and the edition's lifecycle date actually covers your timeline.
3. Isolation: put the device on its own network segment with no internet access, and keep documentation that will satisfy insurers and auditors.
4. Virtualisation: run the legacy app in Windows 365 or a virtual desktop and use the local device as a thin client. Linux is an option for devices that only need a browser.

The main mistake MSP Business identifies is applying these exception routes to every remaining Windows 10 machine. Devices that meet Windows 11's hardware requirements belong in a migration project with a fixed date.

A practical checklist for MSPs​

• Inventory edition and build, not just "Windows 10." Separate 22H2 Pro/Enterprise from each LTSC and IoT edition, because their deadlines differ.
• Confirm ESU status on every device. If a client skipped Year 1, the bill for this year is $183 per device, not $122.
• Separate eligible from ineligible hardware, then check app and vendor certification for the eligible machines.
• Give each exception an owner, compensating controls and a retirement date.
• Tell SME clients early that consumer ESU does not cover their business PCs.
• Check cyber insurance questionnaires before renewal, not after an incident.

One year on, the main problem is no longer Windows 11's hardware requirements. It is unfinished projects and postponed budgets, and with Year 3 priced at $244 per device, waiting gets more expensive each year.