NexusSec.A year after end of support, many offices still have Windows 10 machines: the accounts PC running an old package, the reception desktop, a computer attached to lab or factory equipment. Here is how to deal with them.
What end of support means
- No more security updates or fixes from Microsoft, except for devices enrolled in ESU.
- The machines keep working, but each newly discovered vulnerability stays open on them.
- Software vendors and device makers gradually stop supporting Windows 10 too.
- Auditors, customers and cyber insurers increasingly ask about unsupported operating systems.
Antivirus or EDR on the machine helps, but it cannot fix vulnerabilities in Windows itself. Long-Term Servicing Channel (LTSC) editions have their own, later support dates, so check which edition each machine runs.
Extended Security Updates for businesses
ESU is a paid, per-device subscription that delivers security updates only, with no new features or general support. For businesses it runs for at most three years in annual terms: year one ended on 13 October 2026, year two runs to 12 October 2027 and year three to 10 October 2028. Microsoft's published price for year one was US$61 per device and doubles each year, and joining late means paying for the years already passed. Confirm current pricing and terms with your Microsoft licensing partner.
Step 1: find every Windows 10 machine
Use your device management or remote monitoring tool if you have one, your directory, or a walk round the office. For each machine, note who uses it, what it is for, the software it depends on, and whether it meets Windows 11 hardware requirements, including TPM 2.0, a supported processor and UEFI with Secure Boot.
Step 2: upgrade what can be upgraded
For eligible devices with a valid licence, the upgrade to Windows 11 is offered at no extra cost. Test the applications that matter first, such as accounting and ERP software and printer and scanner drivers, then upgrade in batches.
Step 3: replace what cannot
Budget for replacements, and start with the machines most exposed: finance, management and anyone who handles email and browsing all day.
Step 4: isolate what has to stay
Some machines cannot be replaced yet, typically those running software for production, lab or CCTV equipment. Reduce their exposure:
- Put them on their own network segment, as covered in network segmentation.
- Block internet access, email and general browsing from them.
- Allow firewall rules only for the connections they need.
- Do not sign in to them with domain administrator accounts, and control USB use.
The same approach works for other devices that cannot be patched; see isolating guest and IoT devices.
Step 5: record your decisions
Keep a short list of the remaining Windows 10 machines, the plan and date for each, and the controls around those that stay. It is what an auditor or insurer will ask for, and it keeps the plan moving. A patch management routine keeps the rest of the estate current.
