Windows 10 End of Support 2025: Upgrade to Windows 11 or ESU Now

If your PC is still running Windows 10, the calendar is no longer a distant concern — it's a deadline with real security consequences: Microsoft will stop delivering routine security updates, feature fixes, and standard technical support for Windows 10 on October 14, 2025, and that shift raises the immediate practical choice every Windows 10 user faces today. The local WCPO marketplace piece and wider community guidance make the point bluntly: upgrade an eligible PC to Windows 11 (often free), buy a new Windows 11 PC, or take a temporary paid or opt‑in Extended Security Updates (ESU) path — because doing nothing leaves devices increasingly exposed to new viruses, malware, and phishing attacks as time goes on.

Background​

What “end of support” actually means​

When Microsoft declares an operating system has reached end of support, it is a concrete change in the product lifecycle: the company stops issuing security updates, feature and quality updates, and vendor-provided technical assistance for that product. A machine with Windows 10 will continue to boot and run after October 14, 2025, but it will no longer receive OS-level security patches that fix newly discovered vulnerabilities — and that gap is precisely what threat actors aim to exploit. Microsoft’s published lifecycle advisory and consumer-facing pages lay this out clearly: after the cutoff, Windows 10 receives no more security fixes unless the device is enrolled in an approved extended-support program.

Why this deadline matters now​

The practical security model for modern computing depends on an upstream vendor supplying timely patches for kernel issues, drivers, networking stacks, and other core components. Without monthly OS patches, defenses — even good endpoint protection — can be circumvented more easily as new exploits appear. This is not abstract: historical sunsets (Windows 7, for example) saw a measurable increase in attackers targeting unsupported systems. The choice ahead of October 14, 2025 is therefore risk management in plain sight: upgrade, bridge with ESU, replace, or migrate off the platform entirely.

---

Overview of the official options​

Microsoft and consumer guidance point to three realistic paths for most users:

• Upgrade your existing, eligible PC to Windows 11 (free when the machine meets Microsoft’s requirements).
• Enroll the machine in Windows 10 Consumer Extended Security Updates (ESU) for a limited bridge period.
• Replace the device with a new Windows 11 PC or move to an alternative OS.

Each option has trade-offs in cost, effort, and long-term security posture. Microsoft’s support pages and the consumer ESU FAQ summarize these choices and contain the instructions and eligibility checks needed to act.

---

Windows 11: what you get, and what you need​

Key security and platform advantages in Windows 11​

Windows 11 is designed around a modern hardware baseline that enables additional protections by default. Notable built-in security features include stronger reliance on hardware-backed isolation and attestation:

• TPM 2.0–based key storage for device identity and measured boot.
• UEFI Secure Boot to prevent unsigned boot components from loading.
• Virtualization-based security (VBS) and hypervisor-protected code integrity (HVCI) that harden kernel components.
• More aggressive sandboxing and modern driver models (WDDM / DirectX 12).

These features reduce the attack surface for many exploit chains and make some classes of attacks substantially harder compared with an unpatched Windows 10 system. Official Microsoft guidance highlights these changes as a motivating reason to move to Windows 11 where possible.

Minimum system requirements (what to check)​

Windows 11 has stricter minimums than Windows 10. The basic requirements you should verify are:

• 64‑bit CPU, 1 GHz or faster, 2+ cores (the CPU must be on Microsoft’s supported hardware lists in many cases).
• 4 GB of RAM minimum and 64 GB of storage.
• UEFI firmware with Secure Boot capability.
• Trusted Platform Module (TPM) 2.0 (discrete TPM or firmware fTPM).
• Graphics compatible with DirectX 12 / WDDM 2.x.

Because the CPU compatibility lists and firmware features (like TPM and Secure Boot) are often the actual blockers, Microsoft recommends using the PC Health Check tool or checking Settings > Update & Security > Windows Update to confirm upgrade eligibility.

The reality of device compatibility​

Estimates from analysts and community observers have suggested hundreds of millions of devices could be affected by Windows 11 hardware rules — some machines built before about 2018 lack TPM 2.0 or UEFI Secure Boot, and some CPU models are outside Microsoft’s supported list. Those numbers are estimates and should be treated cautiously; exact device counts depend on OEM firmware updates, user BIOS settings, and how broadly you count older workstations. Where a device is eligible, the upgrade is free; where it isn’t, the realistic choices become ESU, hardware upgrades, or replacement. Flag: numbers like “400 million” are approximations drawn from market analyses and device inventories and not a precise Microsoft disclosure; treat them as estimates.

---

Step-by-step: check compatibility and upgrade safely​

1. Inventory and backup — do this first​

Before any major OS change, make a complete backup. Use built-in tools or your preferred backup software:

1. Create a full system image or at minimum backup your Documents, Pictures, and other essential folders.
2. Use Windows Backup/OneDrive settings to sync user settings if you plan to use the consumer ESU free enrollment method that relies on Microsoft account sync.
3. Export browser favorites and collect license keys for key applications.

Backups reduce migration stress and give you a reversion path if an upgrade triggers unexpected driver compatibility issues. Microsoft’s guidance stresses backup and file transfer tooling for a smooth move.

2. Run the PC Health Check and Windows Update eligibility check​

Open Settings > Privacy & Security > Windows Update or download and run Microsoft’s PC Health Check app to test for TPM, Secure Boot, and CPU support. The tool will tell you what specific requirement an eligible machine is failing, which is useful before you consider firmware toggles or hardware changes. If PC Health Check reports your device eligible, you should be able to obtain the upgrade via Windows Update.

3. If your machine is eligible: upgrade path​

If your PC meets the requirements:

• Ensure Windows 10 is fully updated (latest cumulative updates).
• Free up space (Windows 11 needs at least 64 GB total storage, more during the process).
• Plug the device into power and download the upgrade through Settings > Update & Security > Windows Update when the offer appears.
• Follow the installer prompts; the in-place upgrade keeps your files and most apps, but drivers may require vendor updates afterward.

Perform a clean install only if you want a fresh start — it requires additional preparation and reinstallation of apps. Microsoft’s pages and mainstream upgrade guides walk through both paths.

4. If your machine fails a single toggle check (TPM/Secure Boot)​

Some systems have capable firmware but the settings are disabled by default. If PC Health Check flags TPM or Secure Boot as missing, check your motherboard/BIOS settings — many modern consumer boards support firmware TPM (fTPM) and Secure Boot toggles. If the CPU is unsupported or the board lacks a TPM option, upgrading the motherboard or CPU may be costlier than replacing the PC. Vendor documentation and OEM support pages are the authoritative source on whether your specific model supports enabling these features.

---

The ESU consumer bridge: what it is and how much it costs​

What ESU covers​

Microsoft designed a consumer Windows 10 ESU as a limited bridge: it supplies security-only updates for eligible Windows 10 devices for one additional year after end of support (covering Oct 15, 2025 through Oct 13, 2026 for consumer enrollment paths). ESU does not include feature updates, broader technical support, or indefinite coverage — it buys time to plan and execute a migration.

Enrollment options and pricing (consumer)​

Microsoft’s published consumer ESU enrollment routes give three ways to enroll:

• No-cost option if you enable and sync Windows Backup settings to a Microsoft account (this uses the device’s Microsoft Account and OneDrive sync for profile transfer).
• Redeem 1,000 Microsoft Rewards points to enroll for one year.
• A one-time purchase of roughly $30 (USD) per device for a one-year ESU license, plus any applicable local tax.

Enterprises have separate ESU channels and pricing (multi-year options exist for commercial customers), but the consumer program is intentionally short (one year) to encourage migration to Windows 11 or replacement. Note: regulatory or regional changes may affect enrollment mechanics (see special note below about Europe).

Regional nuance and recent changes​

Regulators and advocacy groups have actively reviewed Microsoft’s consumer ESU mechanics. Recent reporting indicates Microsoft adjusted terms for certain regions (for example, removing the requirement to enable Windows Backup for automatic free ESU enrollment in some territories) after consumer-rights scrutiny. These adjustments can affect how easy it is to enroll without paying; check the Microsoft ESU FAQ for your region when you act. Where regulatory changes have occurred, articles in mainstream outlets have covered them. Flag: regional policy and regulatory actions may change enrollment mechanics quickly; verify the exact steps for your country when enrolling.

---

Practical caveats, risks, and common pitfalls​

Unsupported upgrade workarounds — why they’re risky​

Community-created workarounds to bypass Windows 11 hardware checks exist (bootloader patches, registry tweaks, third-party installers). Microsoft has signaled that such methods carry risk: they can produce a system that boots but does not receive the full set of supported updates or creates stability problems. In addition, some workaround tools are flagged by Microsoft Defender as potentially unwanted software. For most users, the supported route — enable firmware features or move to ESU/new hardware — is the safer long-term choice.

Application and driver compatibility​

Some legacy devices or software may not be fully compatible with Windows 11. Peripheral drivers (printers, specialized capture cards, older VPN clients) sometimes lag behind; verify critical software and hardware compatibility before rushing into an in-place upgrade. Maintain a rollback plan (system image or full backup) in case a critical application fails post-upgrade.

The e‑waste and cost question​

For organizations and households with many older PCs, forced refresh cycles can be expensive and create environmental waste. ESU exists in part to give more time for staged replacement programs, and some vendors offer trade-in, buyback, or certified refurbishment programs to reduce cost and environmental impact. Plan inventory and budget decisions with an eye toward bulk purchasing, staged rollouts, and responsible recycling. Microsoft and OEM trade-in programs are options to evaluate.

Compliance and business risk​

For regulated industries (healthcare, finance, government), running an unsupported OS can have compliance implications. Contracts, audit requirements, insurance conditions, or regulatory obligations may prohibit the continued use of unsupported software for processing regulated data. Businesses should treat the end-of-support date as a compliance milestone and plan migrations accordingly.

---

Buying new hardware: how to prioritize purchases​

When replacing PCs, prioritize devices that deliver the security baseline and performance improvements Windows 11 is built around:

• CPUs that support virtualization features and modern security extensions (Intel 10th+ Gen / newer and AMD Zen2+ are common safe bets, but check the compatibility list for the exact model).
• Firmware with clear support for TPM 2.0 and UEFI Secure Boot.
• Sufficient RAM (8 GB+ for general use; 16 GB recommended for power users).
• NVMe SSDs for responsiveness and improved battery life for laptops.

New Windows 11 PCs also arrive with driver support and manufacturer firmware updates that reduce migration friction. If budget is a constraint, prioritized replacement of devices that handle sensitive data or network-facing roles is a pragmatic approach. Mainstream buying guides and vendor pages list recommended models and configuration trade-offs if you want to shop smart.

---

Enterprise and IT pros: staged migration checklist​

1. Inventory all devices (hardware, software, drivers) and tag by business criticality.
2. Use Microsoft Endpoint tools (or third‑party management suites) to run compatibility scans and pilot Windows 11 imaging on representative hardware.
3. Identify devices that require replacement or hardware refresh and schedule replacements by risk tier.
4. Consider ESU or cloud-hosted Windows 365 options for legacy workloads that cannot be moved quickly.
5. Test business-critical applications and third‑party integrations thoroughly before broad rollout.

Larger organizations have access to multi-year ESU and volume licensing channels, while smaller teams and consumers rely on the consumer ESU program or device replacement strategies. Microsoft’s enterprise lifecycle guidance and migration docs provide the policy-level details for IT planning.

---

Practical, prioritized recommendations (for home users and small businesses)​

• If your device is eligible for Windows 11 via PC Health Check, upgrade now after a full backup. The in-place upgrade is free and keeps apps and files in place.
• If your device is not eligible but still performs well, enroll in the consumer ESU if you need time to plan replacement — follow the Microsoft Settings flow to enroll or use the other consumer enrollment options.
• If your device is old, battery-poor, or critical for work, prefer replacement with a Windows 11‑capable machine to regain performance and long-term security.
• Never rely on unofficial workarounds as a permanent solution; they can create instability and may prevent future updates.
• Back up before you act, test peripherals after upgrade, and confirm your key apps (banking, VPN, productivity suites) run correctly on Windows 11.

These recommendations balance immediacy and cost while prioritizing security and continuity.

---

What to expect after October 14, 2025​

• Windows 10 consumer devices not enrolled in ESU will no longer receive security fixes; over time, the risk of compromise increases as new vulnerabilities are found and weaponized.
• Microsoft 365 app security updates for Windows 10 will continue for a limited period (Microsoft has committed to three more years of certain protections for Microsoft 365 Apps), but these do not replace OS patches.
• Some vendors may cease testing or supporting drivers and software on Windows 10 as their own roadmaps move to Windows 11.
• Public policy or regional legal developments (consumer-rights interventions, regulator action) could change enrollment mechanics or offer additional concessions in some jurisdictions; check Microsoft’s support pages for updates in your region.

---

Final analysis: benefits versus risks​

Strengths of acting now​

• Upgrading eligible devices to Windows 11 restores vendor-backed patching and modern hardware-based protections that materially reduce exposure to many exploitation techniques.
• ESU provides a short-term safety valve that avoids rushed, error-prone migrations and reduces the chance of downtime or data loss.
• Replacing aging hardware improves performance, battery life, and compatibility, and can be combined with trade-in or recycling programs to lower net cost.

Risks and uncertainties​

• Hardware compatibility remains the main impediment: some relatively recent machines still require BIOS/firmware changes or are simply not supported.
• Opting for unofficial workarounds risks future updates being blocked or introduces instability and security concerns.
• Regional policy shifts or vendor-side changes (pricing, enrollment mechanics) can alter the cost-benefit of ESU. Where such claims are based on third-party estimates (device counts, uptake percentages), treat them as indicative rather than precise.

---

Quick checklists to act today​

If you plan to upgrade (fast checklist)​

• Back up everything (system image + user files).
• Run PC Health Check and Windows Update eligibility check.
• If eligible, install via Settings > Update & Security > Windows Update.
• Post-upgrade: update drivers from the OEM, test peripherals, and confirm antivirus and Office apps work.

If you cannot upgrade but need time​

• Enroll in Consumer ESU via Settings > Update & Security > Windows Update (or use Microsoft Rewards / one-time purchase options).
• Prioritize replacement of machines handling sensitive data.
• Schedule a migration plan with timelines and backups.

If replacing devices​

1. Inventory and prioritize devices to replace.
2. Select new Windows 11 configurations that meet security and performance needs.
3. Use trade-in/recycle programs to reduce cost and environmental impact.

---

Conclusion​

October 14, 2025 is a firm inflection point: Windows 10 will no longer receive the operating system security updates that form the baseline defense against modern threats. The responsible path for most users is straightforward — verify device eligibility and upgrade eligible machines to Windows 11, use consumer ESU as a controlled bridge when needed, or replace out-of-support hardware on a prioritized schedule. Each choice should be driven by risk, cost, and practical needs: backing up before action, testing essential apps, and avoiding unapproved workarounds are universal precautions. Local reporting and community guides echo the same urgency: acting now reduces the chance of being caught in a last-minute scramble that often leads to mistakes, outages, and avoidable exposure to cyber threats.

---

Source: WCPO 9 Cincinnati Upgrade to Windows 11: Protect your devices from new threats