Windows 10 ESU Review: Paying to Delay the Windows 11 Migration

Fix it now

Windows 10 support ended on 14 October 2025 and ESU sells security updates only: no features, no non-security fixes, and Microsoft states plainly that technical support is not included. For a household it is usually free. For an organisation it is priced to be temporary, because the per-device price doubles every consecutive year for a maximum of three years.

1. Buy commercial ESU if you have a migration date and a population of machines that will not make it. The doubling price and three-year ceiling only make sense against a calendar.
2. Buy it if an application you depend on is certified on Windows 10 and its vendor has named a Windows 11 date you can plan around.
3. Skip buying anything on a home PC until you have tried the free routes. Microsoft enrols consumer devices at no additional cost if you are syncing your PC settings, or for 1,000 Microsoft Rewards points.
4. Skip it for Windows 10 machines in Windows 365 or on Azure infrastructure, and for Windows 10 endpoints connecting to a Cloud PC. Microsoft includes ESU in those at no extra cost.
5. Skip it on any device that already meets the Windows 11 requirements. Check TPM and Secure Boot in firmware first, because a machine that reports as unsupported is often only switched off.
6. Do not buy it estate-wide by default. The saving is in triaging the estate, and a blanket purchase gets worse every year the price doubles.

Consumer and commercial ESU are separate programmes. Consumer enrolment runs until the programme ends on 12 October 2027, one licence covers up to 10 devices, and it needs Windows 10 version 22H2 Home, Professional, Pro Education or Workstations. Commercial ESU is bought per device per year through volume licensing.

If one of those settles it, you have your answer. Below are the dates that actually govern the decision, what ESU does and does not deliver, and how to split an estate before spending anything.

Why it happens

ESU is a subscription to keep receiving security fixes for an operating system that is out of support. Microsoft describes the programme as enabling PCs to continue receiving critical and important security updates, and that is the whole of it. No feature updates, no quality fixes for non-security bugs, and no help desk entitlement – Microsoft’s own answer to whether technical support is included is no, beyond help with problems caused by ESU itself.

The eligibility rule is narrow enough to catch people out. Devices have to be running Windows 10 version 22H2, and for the consumer programme Microsoft names the editions as well: Home, Professional, Pro Education or Workstations. A machine sitting on an older feature update is not enrolled, it is simply out of scope until you update it.

The two programmes have diverged more than most comparisons admit. The commercial programme runs a maximum of three years from end of support, is bought per device per year through volume licensing, and the price doubles every consecutive year. The consumer programme is a different shape entirely: Microsoft publishes three enrolment routes, two of which cost nothing, one licence covers up to 10 devices, and you can enrol at any time until the programme ends on 12 October 2027.

What ESU does not do is buy you time with everything else. Microsoft has committed to security updates for Microsoft 365 Apps on Windows 10 until 10 October 2028, but those devices stop receiving feature updates once Version 2608 ships, and Microsoft states that ESU does not change that timeline in either direction. Third-party vendors will make their own decisions on the same schedule, and none of them are bound by your ESU subscription.

Full reference

The dates that govern the decision

Read those four rows together and the shape of the decision appears. A home user has a long, cheap runway. A business has a shorter and steeply rising one. And an organisation still running Microsoft 365 Apps on Windows 10 in 2028 has a second cliff behind the first that no amount of ESU spending moves.

The two programmes side by side

Microsoft says consumer enrolment options and timing may vary by region, including in the European Economic Area, while the updates themselves are applied consistently. If you are enrolling outside the US or UK, read the enrolment screen rather than an article about it.

Where the ESU entitlement comes free

• Windows 10 virtual machines on Windows 365, Azure Virtual Desktop, Azure virtual machines, Azure Dedicated Host, Azure VMware Solution, Nutanix Cloud Clusters on Azure, Azure Local, Azure Stack Hub and Azure Stack Edge.
• Windows 10 endpoints connecting to a Windows 365 Cloud PC, entitled for up to three years with an active Windows 365 subscription licence.
• If a chunk of your estate is candidates for becoming thin clients, price that path before pricing ESU. It is the one option that solves the hardware refresh and the operating system deadline together.

Splitting the estate, which is where the money is

The most expensive way to buy ESU is to buy it for everything because sorting the estate looked like work. Three groups come out of an afternoon with an inventory: machines that already meet the Windows 11 requirements and need only the upgrade run; machines whose TPM or Secure Boot is present but disabled in firmware, which join the first group after a settings change; and machines whose processor generation is unsupported, which are a hardware decision. Only the third group is an ESU question, and it is usually smaller than the first pass suggests.

Get-Tpm
Confirm-SecureBootUEFI
systeminfo | Select-String "System Model","BIOS Version"

Run that on a sample before you run it on everything. If the sample says most of the estate is capable, you are looking at a rollout project rather than a licensing purchase, and the ESU conversation shrinks to a handful of machines and a single year.

What you are actually getting for the money

Questions people ask about this