Microsoft has ended mainstream support for Windows 10 — and if your PC can’t run Windows 11, you must pick a secure, practical path now: upgrade where possible, enroll in the one‑year consumer Extended Security Updates (ESU) program as a controlled short‑term bridge, or replace/repurpose the device with a supported OS such as ChromeOS Flex or a mainstream Linux distribution.
Microsoft fixed October 14, 2025 as the end‑of‑support date for Windows 10. After that date, Home and Pro editions (and the usual Enterprise/Education SKUs) no longer receive routine security patches, feature updates, or standard technical support unless you take one of the supported mitigation steps. That does not mean Windows 10 will stop booting, but it does mean unpatched systems become progressively riskier to use online.
For consumers with machines that are incompatible with Windows 11 — most commonly because they lack TPM 2.0, UEFI/Secure Boot, or a supported CPU — Microsoft published a consumer ESU program to deliver security‑only updates for one additional year (coverage through October 13, 2026). Separately, the Windows 11 minimum hardware baseline (including TPM 2.0 and UEFI Secure Boot) remains enforced; that requirement is the key blocker for many older PCs.
This article walks through the three practical choices for a Windows 10 PC that cannot run Windows 11, explains what each option covers and omits, verifies the technical specifics against primary vendor documentation, and offers a step‑by‑step playbook you can use immediately.
For businesses the calculus is sharper: compliance frameworks, cyber‑insurance policies, and contractual obligations often require supported software stacks. Organizations generally must either purchase enterprise ESU through volume licensing or migrate endpoints quickly. For home users, ESU and migration alternatives provide controlled choices.
Key facts:
Conclusion
A sensible, secure outcome requires three immediate acts: back up, check, and choose. Back up your data now. Run PC Health Check and confirm whether your machine meets Windows 11 requirements. If it does, upgrade; if it doesn’t, enroll in ESU to buy time or move the device to ChromeOS Flex or a mainstream Linux distribution after a test. Leaving an internet‑connected, unsupported Windows 10 device running unpatched is not a viable long‑term option — act deliberately, verify against the vendor guidance, and preserve both your security and your data.
Source: KTAR News 92.3 FM What should I do with my older PC that can’t run Windows 11?
Background / Overview
Microsoft fixed October 14, 2025 as the end‑of‑support date for Windows 10. After that date, Home and Pro editions (and the usual Enterprise/Education SKUs) no longer receive routine security patches, feature updates, or standard technical support unless you take one of the supported mitigation steps. That does not mean Windows 10 will stop booting, but it does mean unpatched systems become progressively riskier to use online. For consumers with machines that are incompatible with Windows 11 — most commonly because they lack TPM 2.0, UEFI/Secure Boot, or a supported CPU — Microsoft published a consumer ESU program to deliver security‑only updates for one additional year (coverage through October 13, 2026). Separately, the Windows 11 minimum hardware baseline (including TPM 2.0 and UEFI Secure Boot) remains enforced; that requirement is the key blocker for many older PCs.
This article walks through the three practical choices for a Windows 10 PC that cannot run Windows 11, explains what each option covers and omits, verifies the technical specifics against primary vendor documentation, and offers a step‑by‑step playbook you can use immediately.
Why this matters: the security and compliance picture
Every month Microsoft shipped security updates that patched new critical vulnerabilities. When that stream stops for a platform you use daily, your device becomes an increasingly attractive target for attackers. Antivirus, browser updates, and Defender signature feeds help, but they do not replace the kernel‑level and platform fixes that Microsoft delivered in cumulative updates. Running an unsupported Windows 10 installation connected to the internet is a rising, measurable risk.For businesses the calculus is sharper: compliance frameworks, cyber‑insurance policies, and contractual obligations often require supported software stacks. Organizations generally must either purchase enterprise ESU through volume licensing or migrate endpoints quickly. For home users, ESU and migration alternatives provide controlled choices.
Option 1 — The temporary safety net: Windows 10 Consumer Extended Security Updates (ESU)
What ESU is — and what it is not
- What it gives you: Security‑only updates rated Critical and Important by Microsoft’s security team, delivered for a one‑year window that ends October 13, 2026 for consumer devices. It does not include feature updates, broad technical support, or bug‑fix servicing beyond security patches.
- Who it’s for: Users who cannot immediately upgrade or replace hardware but need a secure path while they plan migration. Treat ESU as a migration buffer, not a long‑term support plan.
Enrollment — three consumer paths (verified)
Microsoft published three consumer enrollment options for ESU. These flows and the enrollment UI appear via Settings → Update & Security → Windows Update when the device meets prerequisites (notably Windows 10 version 22H2 and the latest cumulative updates):- Free option: Sign in with a Microsoft account and enable Windows Backup settings sync to OneDrive. This ties membership to the Microsoft account and uses the backup/sync flow to qualify the device.
- Rewards option: Redeem 1,000 Microsoft Rewards points to apply ESU to your Microsoft account. This offers a no‑cash route if you have Rewards balance.
- Paid option: A one‑time consumer purchase (roughly US$30, price varies by region) applied to your Microsoft account and usable across eligible devices tied to that account (Microsoft’s guidance caps consumer coverage at up to 10 devices under the same account).
Limitations and gotchas
- Time‑boxed: Consumer ESU ends October 13, 2026. Plan migration or replacement within that window.
- Eligibility constraints: ESU for consumers covers Home, Pro, Pro Education, and Pro for Workstations running Windows 10 version 22H2 and fully patched. Domain‑joined or MDM‑managed devices use enterprise channels.
- Account & privacy tradeoffs: Enrollment requires a Microsoft account. The “free via sync” method stores settings metadata in OneDrive; users concerned about cloud sync should consider the paid or Rewards path or choose an alternative OS.
How to enroll (practical steps)
- Update Windows 10 to the latest cumulative updates (ensure you have version 22H2 installed).
- Sign in with a Microsoft account on the device (or create one).
- Open Settings → Update & Security → Windows Update. Look for the “Enroll now (ESU)” option and follow the wizard to select Backup/Rewards/Purchase.
- Repeat the enrollment on additional devices tied to the same Microsoft account (up to the device limit).
Option 2 — The long‑term, zero‑cost alternative: install ChromeOS Flex (or Linux)
If you want to keep an old PC in service without paying for ESU or buying new hardware, consider replacing Windows 10 with a modern, lightweight, and supported operating system.ChromeOS Flex — what it is and when it fits
ChromeOS Flex is Google’s browser‑centric OS built to run on legacy Windows and Mac hardware. It is designed to be fast, simple, and low maintenance — ideal for web‑centric users, students, and anyone who primarily uses email, streaming, and web‑based productivity suites. Google documents the product, provides a certified models list, and clearly warns that a full installation will erase all existing data on the drive.Key facts:
- Minimum practical requirements: 4 GB RAM, 16 GB storage, 64‑bit Intel/AMD CPU, and the ability to boot from USB. Google publishes a certified‑models list and notes which hardware features are guaranteed on those models.
- Installation: Create a USB installer (Chromebook Recovery Utility) from a separate machine, boot the target PC from the USB, and either try ChromeOS Flex from the USB or perform a full install. Full install permanently erases the device’s existing OS and data. Back up everything first.
- Limitations compared to full ChromeOS: ChromeOS Flex does not guarantee Android (Play Store) support, lacks some hardware‑backed security features that factory Chromebooks have, and may not support every peripheral on non‑certified models. Google’s support pages list these differences explicitly.
Linux distributions — broader compatibility and flexibility
For users comfortable with switching platforms, mainstream Linux distributions (Ubuntu, Linux Mint, Fedora, Zorin OS) provide full, continuously maintained desktops that run well on older hardware. They support a wide range of apps, and increasing compatibility layers (like Proton for gaming) make Linux a practical everyday choice for many users. Migration requires testing for Windows‑only app compatibility and a brief learning curve, but it’s free and sustainable.Practical guidance before migrating to ChromeOS Flex or Linux
- Back up everything: Create a full image and copy irreplaceable files to cloud or external storage.
- Test in live mode: ChromeOS Flex and many Linux distros offer live USB sessions so you can test hardware and workflows without committing.
- Confirm peripherals and needed apps: Printers, scanners, and special‑purpose drivers may not work the same way — test them. For any essential Windows‑only apps, verify web alternatives or plan to use virtualization or cloud‑hosted Windows.
Option 3 — Replace, retire, or repurpose the hardware
If a machine is pre‑2010, badly degraded, or you prefer a fresh start, replacing or responsibly retiring it may be the most pragmatic option.Replace (buy new or refurbished)
Buying a Windows 11–compatible PC restores full vendor support and modern hardware security features (TPM 2.0, virtualization‑backed protections). Certified refurbished business devices often hit the compatibility checklist at a lower price point. Many OEMs and retailers offer trade‑in or recycling programs to offset cost and reduce e‑waste.Repurpose (offline tasks / local services)
If you keep the old machine offline, it still has many uses: as a home media server (Plex, Kodi), local retro gaming box, or a disconnected NAS. Do not use an unpatched Windows 10 machine for internet‑facing tasks such as banking.Donate or recycle — securely
Before donating or recycling:- Secure erasure: Use Windows 10’s Reset → “Remove everything” option or a secure wiping tool to sanitize drives.
- Confirm acceptance policies: Local charities and schools may only accept machines with certain specs. Ask how the recipient handles data and refurbishment. Some local repair shops partner with reuse programs to securely wipe and repurpose devices.
The most important technical checks (verify these now)
- Run Microsoft’s PC Health Check to confirm Windows 11 eligibility. If it reports TPM or Secure Boot issues, check firmware (UEFI) and enable TPM/Platform Trust Technology where available. Microsoft documents how to verify and enable TPM 2.0 in UEFI.
- Confirm your installed Windows 10 build is version 22H2 and that all cumulative updates are applied — required for ESU enrollment eligibility.
- Create a full disk image and copy critical files to a second location before any firmware toggles, in‑place upgrades, or OS installs. Backups are the single most important mitigation.
Unsupported workarounds — a caution
There are community tools and registry hacks that bypass Windows 11’s hardware checks (allowing installation on unsupported CPUs or with TPM disabled). These are fundamentally unsupported by Microsoft and expose you to long‑term maintenance and security uncertainty: updates may be withheld, drivers may break, and warranties may be void. For most users and all production devices, these hacks are poor risk management. Use them only on secondary machines you control and can reimage.Quick decision checklist — what to do this week
- Immediate (0–48 hours): Back up irreplaceable files (image + file copy). Verify backups.
- Check compatibility (same day): Run PC Health Check and open Settings → Update & Security → Windows Update to see if a Windows 11 upgrade or ESU enrollment option appears.
- If eligible: plan and perform the in‑place Windows 11 upgrade using Windows Update or the official Installation Assistant — backup first.
- If ineligible and you need time: enroll in consumer ESU using one of the three methods (MSA + Backup, Rewards, or paid purchase) — enroll now rather than waiting.
- If you do not want to stay on Windows: test ChromeOS Flex or a Linux live USB. Confirm peripheral and app compatibility. When ready, install after a final backup.
Strengths, trade‑offs and risks — a critical assessment
Strengths of Microsoft’s approach
- Microsoft provided a consumer ESU pathway for the first time, giving households a documented migration buffer rather than forcing an immediate replacement. Multiple independent outlets confirmed the mechanics and options. That reduces panic and creates breathing room for budget planning.
Trade‑offs and risks
- Short ESU window. One year buys time but not a permanent fix. Users relying on ESU face another decision by October 2026.
- Account and privacy friction. Enrollment ties the device to a Microsoft account for most free paths. Some consumers will find this unacceptable and will need to either pay or migrate to a different OS.
- Potential e‑waste and cost pressure. The hardware floor for Windows 11 (TPM 2.0, UEFI, supported CPUs) means many otherwise usable PCs cannot upgrade — this raises environmental and affordability concerns. Independent estimates of how many machines are affected vary; treat large “millions” figures as high‑level estimates rather than precise counts.
Strengths of alternatives
- ChromeOS Flex and Linux extend usable life. Both options are free (or near‑free), produce a secure, maintained OS, and reduce the need for immediate hardware churn. Google documents Flex’s certified models and explicitly warns that installation erases the disk — a necessary clarity for safe migration.
Real‑world scenarios and recommended paths
- Single‑user laptop used for web, email, streaming: If it meets Windows 11 requirements — upgrade. If not, install ChromeOS Flex or Ubuntu after backing up. ESU only if you must delay migration.
- A business fleet with legacy line‑of‑business apps: Audit applications and devices; apply enterprise ESU where necessary, while prioritizing replacement or Windows 365 Cloud PCs for mission‑critical endpoints. ESU in enterprise channels is a more structured but costlier multi‑year purchase.
- Very old hardware (pre‑2010) or devices with proprietary drivers: Replace or retire. The cost and instability of shoehorning modern OS support onto decade‑old components rarely justifies the effort. Securely wipe and donate or recycle.
Practical how‑tos (short, action‑oriented)
- Create a full disk image (Macrium Reflect, built‑in Windows Backup, or another image tool). Verify the image by mounting or test‑restoring a few files.
- Run PC Health Check and document the specific blockers (TPM, Secure Boot, CPU). If TPM is present but disabled, follow manufacturer‑specific UEFI instructions to enable it. Microsoft documents how to check and enable TPM.
- If you’ll enroll ESU: Install all updates, sign in with a Microsoft account, open Windows Update and follow “Enroll now.” Choose your enrollment path (Backup/Rewards/Purchase).
- If migrating to ChromeOS Flex: Use the Chromebook Recovery Utility from a Chrome browser to create the USB installer, test from USB, then perform the full install only after a verified backup. Google explicitly warns the full install erases all existing data.
Final verdict — an evidence‑based roadmap
- If your PC is eligible for Windows 11, upgrading is the cleanest long‑term security outcome. Back up first and upgrade via supported channels.
- If your PC cannot be upgraded immediately but you need time, enroll in the consumer ESU program now — it provides a one‑year security bridge. Do not treat ESU as a permanent fix.
- If you want to keep older hardware online economically, install ChromeOS Flex or a supported Linux distribution after testing hardware and backing up data. ChromeOS Flex especially suits browser‑first tasks, and Google’s documentation is explicit about data erasure and certified models.
Conclusion
A sensible, secure outcome requires three immediate acts: back up, check, and choose. Back up your data now. Run PC Health Check and confirm whether your machine meets Windows 11 requirements. If it does, upgrade; if it doesn’t, enroll in ESU to buy time or move the device to ChromeOS Flex or a mainstream Linux distribution after a test. Leaving an internet‑connected, unsupported Windows 10 device running unpatched is not a viable long‑term option — act deliberately, verify against the vendor guidance, and preserve both your security and your data.
Source: KTAR News 92.3 FM What should I do with my older PC that can’t run Windows 11?