Consumer Windows 10 ESU ends 12 October 2027: the SMB and BYOD PC refresh plan

Summary. Consumer Extended Security Updates (ESU) for Windows 10 now end on 12 October 2027. The programme was due to close on 13 October 2026 until Microsoft added a year on 25 June 2026; enrolled devices carry on automatically. It covers Windows 10 version 22H2 Home, Pro, Pro Education and Workstations, and enrolment is free with settings sync, costs 1,000 Microsoft Rewards points, or is a one-time $30 covering up to 10 devices. It has never covered company-managed PCs: Microsoft does not offer it on domain-joined, Entra-joined, MDM-enrolled or kiosk devices. Managed PCs need commercial ESU at $61 per device for Year One, doubling each year until 10 October 2028, so a device joining now pays $183 to reach 12 October 2027. For a small business that means three groups: company PCs that can run Windows 11 (upgrade now), company PCs that cannot (replace them or move the user to a Cloud PC before paying for more ESU), and staff-owned laptops (set an access cut-off for 12 October 2027). From 7 November 2026, 339 days remain.

About this article. This guide is for owners and IT leads at small businesses running Windows 10 on company PCs or on staff-owned laptops used for work. On 7 November 2026 we checked dates, prices and eligibility against Microsoft's consumer ESU pages, Microsoft Learn lifecycle, ESU, Intune and Autopilot documentation, Microsoft price pages, NIST guidance and the gazette texts of India's E-Waste (Management) Rules, 2022 (G.S.R. 801(E) of 2 November 2022, with the January 2023 amendment) and DPDP Rules, 2025 (G.S.R. 846(E) of 13 November 2025). This is general information, not legal or licensing advice; Microsoft changes these pages often, and no vendor paid for inclusion. Researched with AI assistance and reviewed by our editorial team.

Still choosing what replaces Windows 10? Our comparison of Windows 11, Windows 365 and Linux costs each route.

What ends on 12 October 2027, and what keeps going

Windows 10 left support on 14 October 2025, and version 22H2 was the final release. Since then, patches arrive only through ESU, which delivers Critical and Important security updates and nothing else: no new features, no non-security fixes and no general technical support. Sources: Microsoft's consumer page, Microsoft Learn and the ESU lifecycle FAQ.

Microsoft Learn gives $61 for Year One, doubling each year for at most three years, sold in whole years with a one-licence minimum. It is cumulative: joining in Year Two means paying for Year One too. Each year has its own activation ID, so buying Year Three means activating that year's key on every device, and devices need KB5066791 or later plus the licensing preparation package KB5072653.

Two other deadlines fall on the same day: Windows 11 25H2 Home and Pro, and 24H2 Enterprise and Education, leave servicing on 12 October 2027. Our guide to 24H2 and 25H2 end of servicing covers that fleet. Microsoft Intune also now classes Windows 10 as an allowed version rather than a supported one: devices can still enrol, but features are no longer guaranteed to work.

The June 2026 extension and the EEA rules

Consumer ESU was designed as a one-year bridge. On 25 June 2026 Microsoft added an editor's note to a Windows Experience Blog post moving the end to 12 October 2027 and updated its ESU pages, without a separate announcement, as Help Net Security reported.

The consumer prerequisites are the latest cumulative update, the ESU Licensing Preparation Package KB5126256, and a Microsoft account with administrator rights that is not a child account. The enrolment link appears in Windows Update only on devices that meet them.

The European Economic Area page differs: free enrolment depends on staying signed in to Windows with the enrolling Microsoft account; if the user stops, updates can end within up to 60 days and the device must be enrolled again. Local-account users pay the one-time $30, and no Rewards option is listed. The UK page keeps the standard three options. Put the sign-in rule in BYOD guidance for EEA staff, because a lapsed enrolment is invisible to IT.

Step 1: Build the inventory by ownership, join state and hardware

Every later decision depends on four facts per device: owner, join state, Windows 11 eligibility and the personal data it holds. Many small businesses find a forgotten group: office PCs joined to nothing. The eligibility column follows Microsoft's consumer ESU rules.

For managed devices, Intune's device inventory gives OS version and edition. For anything outside management, run this from an elevated PowerShell window on each PC and paste the output into your asset sheet. Windows 10 version 22H2 is OS build 19045.

            # Windows 10 22H2 reports build 19045
Get-ComputerInfo -Property OsName, OsVersion, OsBuildNumber, CsManufacturer, CsModel
Get-CimInstance Win32_Processor | Select-Object Name
Get-Tpm | Select-Object TpmPresent, TpmReady
Confirm-SecureBootUEFI
# Join state: look for AzureAdJoined, DomainJoined and WorkplaceJoined
dsregcmd /status | Select-String "AzureAdJoined|DomainJoined|WorkplaceJoined"
          

Add by hand the owner, the user's business apps, and whether personal data is stored locally; that last column drives disposal.

Step 2: Check Windows 11 eligibility

Microsoft Learn lists the minimum hardware for installing or upgrading to Windows 11, and the Windows 10 starting point for a direct upgrade:

On Windows 10 Home, Pro and Pro for Workstations, Microsoft points users to the PC Health Check app; for organisations it points to Endpoint analytics. Check firmware settings before writing a PC off: TPM and Secure Boot are sometimes present but switched off, whereas an unsupported processor cannot be fixed. Treat 4 GB as a floor, not a target. For new hardware, Microsoft's Copilot+ PC floor is a 40+ TOPS NPU, 16 GB of RAM and 256 GB of storage; our AI PC refresh guide compares what ships now with the 2027 chips.

Application compatibility is usually the smaller risk: Microsoft says App Assure data shows Windows 10 compatibility above 99.7% for enterprise organisations, and App Assure fixes Windows 11 app issues at no cost for eligible customers with more than 150 devices. That is Microsoft's own figure, so still test accounting and GST tools, scanner drivers and any software tied to a USB dongle.

Step 3: Decide device by device

Each device gets one of five outcomes; the dates are our suggested deadlines, not Microsoft's.

The Cloud PC row works because Microsoft Learn says Windows 10 endpoints connecting to Windows 365 Cloud PCs are entitled to ESU for up to three years with an active Windows 365 subscription. Windows 365 Business starts at $25.60 per user per month in the US (2 vCPU, 4 GB RAM, 64 GB) and ₹2,300 plus GST in India. The old PC must still work reliably.

Budget commercial ESU only for replacements that will slip past a renewal date. A managed PC joining now pays $61 + $122 = $183 to reach 12 October 2027, and $183 + $244 = $427 to reach 10 October 2028, with no hardware to show for it.

Step 4: Set BYOD rules before 12 October 2027

Staff-owned laptops carry the most hidden risk, because IT cannot upgrade them and often cannot see them.

Register, do not enrol. Microsoft says Entra registered devices can use consumer ESU, MDM-enrolled devices cannot, and a device that later becomes a commercial device has its consumer enrolment suspended. Pushing personal Windows 10 laptops into full Intune enrolment removes the owner's only patch route. Protect data at the app and session level instead.

Publish a cut-off date. State that personal Windows 10 devices lose access to company email, files and apps on 12 October 2027, remind staff in April and September 2027, and enforce it with Conditional Access, for example by allowing only browser sessions with download limits from unmanaged devices.

Decide who pays. Consumer ESU is free with settings sync outside the EEA. If an employee insists on a local account, the $30 fee is small enough to reimburse.

The policy should also cover company data on a personal device when someone leaves. From 13 May 2027 the security safeguard and breach intimation duties in India's DPDP Rules apply; our DPDP Rules checklist covers them.

Step 5: Deploy replacements with Intune and Autopilot

For new company PCs, buy Windows 11 Pro or higher. Microsoft's Autopilot requirements list Windows 11 Pro, Pro Education, Pro for Workstations, Enterprise, Education and Enterprise LTSC; Home is not on the list. Autopilot also needs Microsoft Entra ID P1 or P2 and an MDM service such as Intune, or a bundle with both, such as Microsoft 365 Business Premium.

Business Premium suits firms with up to 300 users. An archived copy of Microsoft's US page from 24 October 2026 lists it at $22.00 per user per month paid yearly, or $26.40 monthly, with Intune Plan 1, Defender for Business and Azure Virtual Desktop access. Ask your reseller or OEM to register new hardware to your tenant at purchase, so a laptop shipped to an employee's home sets itself up at first sign-in.

A minimal rollout: an Entra-join profile with standard user rights; BitLocker, Defender, Windows Hello for Business, update rings and Known Folder Move policies; five or six core apps including VPN and accounting; a one-week pilot on three machines, one remote; then batches of five to ten, oldest hardware first.

Step 6: Move the data before you wipe anything

Company devices. Turn on OneDrive Known Folder Move, which moves Desktop, Documents, Pictures, Screenshots and Camera Roll into OneDrive, through Group Policy, Intune administrative templates or the registry. If Windows Folder Redirection points to a file share, Microsoft's order is: copy the share into each user's OneDrive with Migration Manager, disable the redirection policy, then enable Known Folder Move. The replacement PC picks the folders up at first sign-in.

Personal devices. Windows Backup saves files, settings and apps from Windows 10 and restores them on Windows 11 version 22H2 or later. The restore needs the same Microsoft account during setup, only 5 GB of Microsoft storage is included, and apps are not copied: some reinstall when first opened, others must be reinstalled by hand.

What neither tool moves. Local Outlook data files, unsynced browser profiles, desktop licence keys, VPN certificates and printer set-ups. Put these on each user's hand-over checklist and keep the old PC untouched for 14 days after the swap.

Step 7: Wipe, dispose and recycle under India's rules

Wipe to a standard. NIST SP 800-88 Revision 2, published in September 2025, is the common reference for media sanitisation. Unlike Revision 1, it no longer prescribes a technique per media type: it sets out a programme built on three methods (clear, purge and destroy) with documented evidence, and points to standards such as IEEE 2883 for media-specific techniques. Record serial number, method, date and operator for every drive, and destroy any drive whose wipe you cannot verify.

Use registered recyclers. India's E-Waste (Management) Rules, 2022 were notified on 2 November 2022 and have applied since 1 April 2023. Rule 3(1)(b) defines a bulk consumer as any entity that has used at least 1,000 units of Schedule I equipment in a financial year, including e-retailers; laptops and desktop PCs are on that schedule. Rule 8 requires bulk consumers to hand e-waste only to a producer, refurbisher or recycler registered on the Central Pollution Control Board's portal, and micro enterprises under the MSMED Act, 2006 are outside the rules. The 2016 bulk-consumer duty to keep records and file annual returns was dropped, as Shardul Amarchand Mangaldas notes. Whatever your size, use a registered recycler and keep its registration details and a receipt.

Ask the OEM first. Laptop makers are producers under the rules, with extended producer responsibility targets, so their take-back schemes are often the simplest legal route.

Do not resell unwiped drives. A laptop sold with recoverable customer data is a personal data breach waiting to be found, and from 13 May 2027 the DPDP Rules require breach intimation to each affected person and to the Data Protection Board.

Timeline: November 2026 to October 2027

Microsoft dates come from its ESU and lifecycle pages; the rest are suggested milestones.

Worked example: a 40-person office

Assume 22 Intune-enrolled company PCs and 18 staff-owned laptops. Fifteen company PCs pass the Windows 11 checks and seven fail; six personal laptops run Windows 10 and cannot upgrade. Prices are from Microsoft Learn and the Windows 365 Business price pages on 7 November 2026; the Cloud PC line uses the 2 vCPU, 4 GB, 128 GB plan at $28.00 or ₹2,515 per user per month.

ESU is the cheapest line for the next 11 months, but it buys nothing that lasts: carrying the seven failed PCs to 10 October 2028 costs 7 × $427 = $2,989 for patches alone. Compare an OEM quote for seven Windows 11 Pro laptops with two years of Windows 365 before committing.

India, EU and US notes

India. Consumer ESU costs $30 or the local-currency equivalent plus tax. The e-waste and DPDP Rules are the two compliance hooks, so plan disposal before ordering replacements.

EU, UK and US. Only the EEA ties free ESU to staying signed in. Microsoft Learn quotes commercial ESU in US dollars only, so ask your licensing partner for local pricing, and apply GDPR to personal data on returned devices.

How eCorpIT can help

eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. We run Windows 10 exit projects end to end, from device inventory and Windows 11 checks to Intune and Autopilot set-up, OneDrive migration and BYOD access policy, as part of our cloud computing services. Talk to us at /contact-us/.

Last updated: 7 November 2026.

References

1. Windows 10 Consumer Extended Security Updates (ESU), US page — Microsoft

1. Stay secure with Windows 11, Copilot+ PCs and Windows 365 before support ends for Windows 10 (editor's note of 25 June 2026) — Microsoft Windows Experience Blog

1. Extended Security Updates (ESU) program for Windows 10 — Microsoft Learn

1. Lifecycle FAQ, Extended Security Updates — Microsoft Learn

1. Windows 10 Home and Pro lifecycle — Microsoft Learn

1. Enable Windows 10 Extended Security Updates (ESU) for physical machines — Microsoft Learn

1. Windows 11 Home and Pro lifecycle — Microsoft Learn

1. Windows 11 Enterprise and Education lifecycle — Microsoft Learn

1. Supported operating systems and browsers in Intune — Microsoft Learn

1. Microsoft gives Windows 10 users an unexpected extra year of free security updates, 26 June 2026 — Help Net Security

1. Windows 10 Consumer Extended Security Updates (ESU), Ireland page with EEA terms — Microsoft

1. Windows 10 Consumer Extended Security Updates (ESU), UK page — Microsoft

1. Windows 10 release information — Microsoft Learn

1. Windows 11 requirements — Microsoft Learn

1. Plan for Windows 11 — Microsoft Learn

1. Windows 11 specifications and system requirements, Copilot+ PC section — Microsoft

1. Windows 365 Business plans and pricing, US — Microsoft

1. Windows 365 Business plans and pricing, India — Microsoft

1. Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), 13 November 2025 — Ministry of Electronics and Information Technology

1. Windows Autopilot requirements — Microsoft Learn

1. Microsoft 365 Business Premium, US page archived 24 October 2026 — Microsoft, via Internet Archive

1. Redirect and move Windows known folders to OneDrive — Microsoft Learn

1. Transfer your data with Windows Backup — Microsoft

1. SP 800-88 Rev. 2, Guidelines for Media Sanitization, September 2025 — NIST

1. Frequently Asked Questions for NIST SP 800-88r2, 16 July 2026 — NIST

1. E-Waste (Management) Rules, 2022, G.S.R. 801(E), Gazette of India, 2 November 2022 — Ministry of Environment, Forest and Climate Change, copy hosted by FAOLEX

1. E-Waste (Management) Amendment Rules, 2023, notification of 30 January 2023 — Ministry of Environment, Forest and Climate Change, copy hosted by Tamil Nadu Pollution Control Board

1. E-Waste Management Rules, 2022: An Overview, 12 April 2023 — Shardul Amarchand Mangaldas, via Legal 500

1. Windows 10 Consumer Extended Security Updates (ESU), India page — Microsoft