Lansweeper’s latest asset data suggests that roughly 21% of Windows devices remain on Windows 10 eight months after the operating system reached end of support on October 14, 2025. That leaves a sizeable installed base running an OS that no longer receives normal monthly fixes, even as Windows 11 accounts for 78.8% of the Windows endpoints observed by the company.
The figures, first reported by Computer Weekly and drawn from millions of assets across tens of thousands of active Lansweeper customer sites, are a useful reminder that the Windows 10 deadline did not produce a clean-cut migration. It moved the majority, certainly. But it also exposed the hard cases: PCs that cannot meet Windows 11 requirements, devices attached to certified equipment, and smaller organizations where the replacement budget remains less urgent than the next payroll, inventory order, or facility repair.
For Windows administrators, the immediate takeaway is not that one-fifth is a universal measure of the global Windows base. Lansweeper’s data reflects the environments its customers inventory, rather than a statistically neutral census of every PC. The more consequential finding is that the remaining Windows 10 estate appears concentrated in exactly the places where a simple in-place upgrade was never likely to be the answer.
Lansweeper says healthcare accounts for 23% of organizations in its Windows 10 holdout group, while manufacturing represents 18%. Those are industries with unusually long device lives, specialized peripherals, industrial control workstations, and certification requirements that can turn an OS change into a project involving vendors, regulators, and downtime windows.
A hospital workstation tied to a validated medical application is not interchangeable with a generic office desktop. Likewise, a manufacturing PC connected to machinery may be old, isolated, and operationally critical, with an OEM that supports only a particular Windows release. Installing Windows 11 can require recertification, replacement hardware, application testing, and a maintenance outage — costs and risks that go far beyond a Windows license.
Retail has a related problem. Point-of-sale terminals, kiosks, scanners, and store back-office devices often sit under restrictive support or warranty agreements. In those cases, an IT department may know exactly which endpoints are obsolete while still lacking a viable migration path until a broader hardware or application contract changes.
That distinction matters because “still on Windows 10” can describe very different risks. An unmanaged home PC that missed an upgrade prompt is one problem. A medically certified endpoint, a production-line station, or an old POS terminal is another. Both need a plan, but the latter frequently needs compensating controls before it can be retired.
The Windows 11 transition made hardware eligibility part of the security discussion. TPM 2.0, supported processors, Secure Boot, memory, storage, and driver compatibility collectively pushed many otherwise functional Windows 10 systems into replacement territory. For a large enterprise, that may become a formal lifecycle program. For a 40-person business, it can mean choosing between an unplanned fleet refresh and accepting a period of technical debt.
That is why the final 20% is likely to move more slowly than the first 80%. The easiest systems were upgraded or replaced before October 2025. What remains is disproportionately older, more specialized, or more expensive to move. Omdia expects SMB migration activity to continue into 2027, while commercial buyers refreshing PCs increasingly favor higher-priced hardware designed for longer service life, security, and management.
The result is a two-speed Windows market. Newer endpoints move to Windows 11, often alongside Microsoft Intune, Windows Autopatch, or other cloud-management tooling. Older systems are either isolated, virtualized, carried under extended coverage, or left as a growing exception list.
But ESU is deliberately limited. It does not bring new features, ordinary non-security fixes, design changes, or a return to full Windows 10 technical support. Microsoft describes it as a temporary migration bridge, and IT teams should treat it that way — as a controlled risk-reduction measure attached to a retirement date, not a way to normalize Windows 10 indefinitely.
Commercial Windows 10 ESU starts at $61 per device for the first year, according to Microsoft’s current documentation, and doubles in each subsequent year. The cumulative licensing structure also means an organization cannot simply skip the first year and later buy only year two. For a large legacy fleet, those costs can rapidly approach the economics of replacement hardware, particularly when desktop support, vulnerability management, and application compatibility labor are included.
Consumers have a separate program, and this is where the published discussion needs an important correction. Consumer ESU coverage does not run until October 2027. Microsoft says eligible personal Windows 10 22H2 PCs can receive critical and important security updates through October 13, 2026. Enrollment can be free for users who sync PC settings, or available through Microsoft Rewards or a one-time payment, but it remains a one-year extension rather than a two-year reprieve.
That difference will matter to small businesses that have blurred lines between personal and business-managed PCs. Consumer ESU is not available for devices joined to Active Directory or Microsoft Entra, enrolled in MDM, operating in kiosk mode, or otherwise used in commercial scenarios. An owner-operated company cannot safely assume that signing in with a Microsoft account converts managed business endpoints into eligible consumer devices.
The practical response is to separate every Windows 10 device into a category with an owner and a deadline:
With commercial ESU prices rising each year and consumer coverage ending in October 2026, the Windows 10 holdout population is now on a clock.
The figures, first reported by Computer Weekly and drawn from millions of assets across tens of thousands of active Lansweeper customer sites, are a useful reminder that the Windows 10 deadline did not produce a clean-cut migration. It moved the majority, certainly. But it also exposed the hard cases: PCs that cannot meet Windows 11 requirements, devices attached to certified equipment, and smaller organizations where the replacement budget remains less urgent than the next payroll, inventory order, or facility repair.
For Windows administrators, the immediate takeaway is not that one-fifth is a universal measure of the global Windows base. Lansweeper’s data reflects the environments its customers inventory, rather than a statistically neutral census of every PC. The more consequential finding is that the remaining Windows 10 estate appears concentrated in exactly the places where a simple in-place upgrade was never likely to be the answer.
The remaining fleet is not evenly distributed
Lansweeper says healthcare accounts for 23% of organizations in its Windows 10 holdout group, while manufacturing represents 18%. Those are industries with unusually long device lives, specialized peripherals, industrial control workstations, and certification requirements that can turn an OS change into a project involving vendors, regulators, and downtime windows.A hospital workstation tied to a validated medical application is not interchangeable with a generic office desktop. Likewise, a manufacturing PC connected to machinery may be old, isolated, and operationally critical, with an OEM that supports only a particular Windows release. Installing Windows 11 can require recertification, replacement hardware, application testing, and a maintenance outage — costs and risks that go far beyond a Windows license.
Retail has a related problem. Point-of-sale terminals, kiosks, scanners, and store back-office devices often sit under restrictive support or warranty agreements. In those cases, an IT department may know exactly which endpoints are obsolete while still lacking a viable migration path until a broader hardware or application contract changes.
That distinction matters because “still on Windows 10” can describe very different risks. An unmanaged home PC that missed an upgrade prompt is one problem. A medically certified endpoint, a production-line station, or an old POS terminal is another. Both need a plan, but the latter frequently needs compensating controls before it can be retired.
SMBs have reached the expensive part of migration
The other major finding is economic. Lansweeper says small and medium-sized businesses make up most organizations that have retained Windows 10 devices. That tracks with the assessment from Omdia analysts Greg Davis and Kieren Jessop, cited by Computer Weekly: SMB refresh cycles are shaped primarily by cost, with security and manageability often framed around reliability and simplicity rather than enterprise-grade control.The Windows 11 transition made hardware eligibility part of the security discussion. TPM 2.0, supported processors, Secure Boot, memory, storage, and driver compatibility collectively pushed many otherwise functional Windows 10 systems into replacement territory. For a large enterprise, that may become a formal lifecycle program. For a 40-person business, it can mean choosing between an unplanned fleet refresh and accepting a period of technical debt.
That is why the final 20% is likely to move more slowly than the first 80%. The easiest systems were upgraded or replaced before October 2025. What remains is disproportionately older, more specialized, or more expensive to move. Omdia expects SMB migration activity to continue into 2027, while commercial buyers refreshing PCs increasingly favor higher-priced hardware designed for longer service life, security, and management.
The result is a two-speed Windows market. Newer endpoints move to Windows 11, often alongside Microsoft Intune, Windows Autopatch, or other cloud-management tooling. Older systems are either isolated, virtualized, carried under extended coverage, or left as a growing exception list.
Extended Security Updates buy time, not normal support
Microsoft’s Extended Security Updates program is the most obvious bridge for organizations that cannot complete migration on schedule. It provides critical and important security updates for eligible Windows 10 22H2 commercial devices for up to three years after end of support, through October 10, 2028.But ESU is deliberately limited. It does not bring new features, ordinary non-security fixes, design changes, or a return to full Windows 10 technical support. Microsoft describes it as a temporary migration bridge, and IT teams should treat it that way — as a controlled risk-reduction measure attached to a retirement date, not a way to normalize Windows 10 indefinitely.
Commercial Windows 10 ESU starts at $61 per device for the first year, according to Microsoft’s current documentation, and doubles in each subsequent year. The cumulative licensing structure also means an organization cannot simply skip the first year and later buy only year two. For a large legacy fleet, those costs can rapidly approach the economics of replacement hardware, particularly when desktop support, vulnerability management, and application compatibility labor are included.
Consumers have a separate program, and this is where the published discussion needs an important correction. Consumer ESU coverage does not run until October 2027. Microsoft says eligible personal Windows 10 22H2 PCs can receive critical and important security updates through October 13, 2026. Enrollment can be free for users who sync PC settings, or available through Microsoft Rewards or a one-time payment, but it remains a one-year extension rather than a two-year reprieve.
That difference will matter to small businesses that have blurred lines between personal and business-managed PCs. Consumer ESU is not available for devices joined to Active Directory or Microsoft Entra, enrolled in MDM, operating in kiosk mode, or otherwise used in commercial scenarios. An owner-operated company cannot safely assume that signing in with a Microsoft account converts managed business endpoints into eligible consumer devices.
Inventory is now the deciding control
Lansweeper also argues that Windows 10 holdouts carry materially more active vulnerabilities than their Windows 11 counterparts. The exact risk level will vary by patching, exposure, applications, and network architecture, but the direction is not surprising: unsupported endpoints accumulate exceptions faster because they stop receiving the routine fixes that security baselines assume.The practical response is to separate every Windows 10 device into a category with an owner and a deadline:
- Devices that can run Windows 11 should be upgraded or replaced on a defined schedule.
- Devices that must remain on Windows 10 should receive ESU where eligible and be documented as time-limited exceptions.
- Devices tied to medical, manufacturing, retail, or laboratory systems should be assessed with the application vendor and isolated with network segmentation, least privilege, and strict remote-access controls.
- Devices that cannot be secured or supported should be removed from sensitive networks, virtualized where feasible, or retired.
With commercial ESU prices rising each year and consumer coverage ending in October 2026, the Windows 10 holdout population is now on a clock.
References
- Primary source: Computer Weekly
Published: 2026-07-16T06:45:00+00:00
A fifth of PC devices still on Windows 10 | Computer Weekly
While support ended in October 2025, community-driven insights from Lansweeper has found that smaller businesses are still using Windows 10.www.computerweekly.com
