Windows 10 ESU Year 2: What Michigan SMBs Should Do Now
How many Windows 10 PCs are still running in your office right now? If you do not know the exact number, you are not alone, and you have about one week to find out.
Windows 10 ESU Year 2 begins on October 14, 2026. Year 1 of Microsoft's paid Extended Security Updates program ends on October 13. For commercial customers, the price per device doubles from $61 to $122. And if you skipped Year 1 entirely, you cannot jump in at the Year 2 price. You pay for both years, which puts the entry cost at $183 per PC.
For a 40-person firm in Grand Rapids with 15 aging machines, that is $1,830 to $2,745 spent to keep old hardware patched for 12 more months. Sometimes that is the right call. Often it is not. Here is how to decide.
What Windows 10 ESU Year 2 Actually Covers
Windows 10 Extended Security Updates deliver critical and important security patches only. Nothing else.
Mainstream support for Windows 10 ended on October 14, 2025. Since then, PCs without ESU have received no security fixes at all. ESU closes that gap for one year at a time, for up to three years total. It does not include new features, bug fixes, or Microsoft technical support.
Here is the commercial pricing schedule, per device:
| ESU Year | Coverage Window | Price Per Device | Cumulative If You Join Late | |---|---|---|---| | Year 1 | Oct 14, 2025 to Oct 13, 2026 | $61 | $61 | | Year 2 | Oct 14, 2026 to Oct 12, 2027 | $122 | $183 | | Year 3 | Oct 13, 2027 to Oct 10, 2028 | $244 | $427 |
Two details catch businesses off guard. First, ESU years are cumulative. Microsoft requires you to buy every prior year before you can activate the current one. Second, the free consumer ESU option, which some very small offices used on personal-style Microsoft accounts, also ends with Year 1. It does not extend into Year 2.
Microsoft's Windows 10 ESU documentation lists the full licensing rules and activation steps.
Why an Unpatched Windows 10 PC Is a Business Risk
An unpatched PC is the easiest way into your network. It is that simple.
Attackers track Microsoft's monthly patch releases closely. When a fix ships for supported systems, they reverse-engineer it and test the same flaw against machines that did not get the patch. Every month without ESU widens that gap.
The CISA Known Exploited Vulnerabilities catalog adds Windows flaws regularly. Once an end-of-life system is on your network, those entries become your open doors.
The business fallout goes beyond the breach itself:
- Cyber insurance. Most carriers now ask whether you run unsupported operating systems. Answering "yes," or answering "no" when it is not true, can raise premiums or void a claim.
- Compliance. Law firms bound by ABA Model Rule 1.6, CPA firms under the FTC Safeguards Rule, and healthcare practices under HIPAA all have a duty to maintain reasonable safeguards. Running unpatched software is hard to defend in any of those reviews.
- Michigan breach notification. Under Michigan's Identity Theft Protection Act, a breach of personal data triggers notification duties. A known, unpatched system makes that conversation with clients far worse.
If your firm works in one of those regulated spaces, our guides for law firms, accounting firms, and healthcare practices cover the specific requirements.
Should You Pay for ESU or Upgrade to Windows 11?
For most PCs, upgrading or replacing beats paying for ESU Year 2. ESU makes sense only as a short, planned bridge.
Use this simple test for every Windows 10 machine in your office.
Upgrade in place if the PC meets Windows 11 requirements. That means TPM 2.0, Secure Boot, and a supported processor (generally Intel 8th generation or AMD Ryzen 2000 series and newer). An in-place upgrade costs labor, not licensing. Most business PCs bought after 2019 qualify.
Replace the PC if it fails the hardware check and is more than four years old. A $183 ESU entry fee on a five-year-old laptop buys one year of patches on hardware that is already slow, already out of warranty, and already near failure. That money is better spent as a down payment on a new device.
Pay for ESU Year 2 only for a specific reason. Good reasons include:
- A line-of-business application that has not been certified on Windows 11, such as older CAD, CNC, lab, or practice-management software
- Shop-floor or medical equipment tied to a Windows 10 controller PC
- A hardware refresh that is already budgeted for Q1 or Q2 2027 and needs a few months of cover
If you buy ESU, write down the exit date. A bridge without an end date turns into a $244-per-device Year 3 bill.
There is also a third path. Windows 365 Cloud PCs and Azure Virtual Desktop include Windows 10 ESU at no extra cost for virtualized machines. For a small number of legacy apps, moving that one workload to a cloud desktop can be cheaper than keeping physical Windows 10 PCs alive.
A 7-Day Windows 10 ESU Action Plan for West Michigan Offices
You do not need a six-month project to handle this. You need an accurate inventory and a decision for each device.
Day 1: Inventory every Windows 10 device. Pull a report from your endpoint management or RMM tool. Include the make, model, age, processor, TPM status, and the user. Do not forget conference room PCs, reception desks, and the machine in the warehouse that runs the label printer.
Day 2: Sort into three buckets. Upgrade, replace, or bridge with ESU. In most offices, the bridge bucket should be the smallest of the three. If it is not, look harder at whether those apps truly cannot move.
Day 3: Check your applications. Confirm Windows 11 support with every software vendor that matters. Ask in writing and save the reply.
Day 4: Buy ESU for the bridge bucket only. Purchase ESU through your volume licensing or Cloud Solution Provider channel this week, so coverage does not lapse on October 14. Then confirm activation on each device.
Day 5: Schedule upgrades. In-place upgrades take one to two hours per PC including testing. Batch them after hours to avoid disrupting staff.
Day 6: Order replacements. Lead times on business-class laptops can run two to four weeks. Order now so you are not paying for ESU on machines waiting for a replacement that is already on the way.
Day 7: Update your records. Tell your cyber insurance carrier your remediation plan. Update your IT asset register. Put the ESU exit dates on the calendar.
This is the kind of planning a virtual CIO handles as part of an annual technology roadmap. If your 2027 budget does not have a line for device replacements yet, now is the time to add one.
The Bigger Lesson: Plan Lifecycles, Not Emergencies
The Windows 10 deadline was announced years in advance. Businesses that ended up scrambling usually had no device lifecycle policy, so every PC aged until it broke.
A simple policy fixes this for good. Replace laptops every four years and desktops every five. Budget 20 to 25 percent of your fleet each year. Track warranty end dates in one place. Review the plan quarterly with whoever owns IT.
Do that, and the next end-of-support date becomes a calendar item instead of a crisis. Windows 11 version 23H2 support for Enterprise and Education editions, for example, ends in November 2026. Plenty of offices will hit that one too.
Frequently Asked Questions
When does Windows 10 ESU Year 2 start?
Windows 10 ESU Year 2 starts on October 14, 2026, and runs through October 12, 2027. Year 1 coverage ends on October 13, 2026. Evolv Technology Solutions recommends that Michigan businesses finish their device inventory before that date so they buy ESU only for the PCs that truly need it.
How much does Windows 10 ESU Year 2 cost for a business?
Windows 10 ESU Year 2 costs $122 per device for commercial customers. Because ESU is cumulative, a business that skipped Year 1 pays $61 plus $122, or $183 per device, to activate Year 2. Year 3 costs $244 per device on top of that.
Can I skip Windows 10 ESU Year 1 and just buy Year 2?
No. Microsoft requires you to purchase every prior ESU year before activating the current one. Evolv advises clients that a late start almost always costs more than replacing an older PC, so ESU should be limited to devices with a specific business reason to stay on Windows 10.
Is it safe to keep using Windows 10 without ESU?
No. A Windows 10 PC without ESU has received no security patches since October 2025 and is exposed to every new Windows vulnerability published since then. Evolv Technology Solutions treats unpatched Windows 10 devices as a top-priority risk for Grand Rapids and West Michigan clients, especially those in regulated industries like legal, accounting, and healthcare.
Should a small business pay for ESU or buy new computers?
For most small businesses, upgrading eligible PCs to Windows 11 and replacing older ones is the better investment. ESU makes sense only as a short bridge for legacy software or equipment, with a firm exit date. Evolv's vCIO service builds that decision into a multi-year device lifecycle plan so the cost is predictable.
Get a Free Windows 10 Exposure Check
Not sure how many Windows 10 PCs are still on your network, or which ones need ESU? Evolv Technology Solutions offers a free Windows 10 exposure check for Grand Rapids and West Michigan businesses. We will inventory your devices, sort them into upgrade, replace, or bridge, and give you a clear cost comparison.
Book your free consultation at evolvtechsolutions.com. If you also need ongoing security leadership to keep this from happening again, see our vCISO services and Cybersecurity as a Service.