Windows 10 ESU Year 2 began on October 14, 2026, and the price per device doubled overnight. If your organization still runs Windows 10, the Year 1 coverage you paid for ended on October 13, 2026. Now you face a clear choice: pay more to keep receiving security updates, or migrate to Windows 11.
Windows 10 reached end of support on October 14, 2025. Since then, the Windows 10 Extended Security Updates (ESU) program has been the safety net for organizations that weren’t ready to move. Microsoft has always described ESU as a temporary bridge, not a long-term plan, and the rising price makes that point for them.
This guide explains what Windows 10 ESU Year 2 costs, when paying for it makes sense, and how to build a phased migration plan that gets your devices onto Windows 11 before Year 3 doubles the price again.
What Windows 10 ESU Year 2 Covers and Costs
Commercial ESU is an annual per-device subscription sold through the Microsoft Volume Licensing Program and Microsoft Cloud Solution Providers (CSPs), and it covers Windows 10 Pro, the Pro for Workstations edition, Enterprise, and Education. It delivers critical and important security updates only. There are no new features, no customer-requested nonsecurity updates, no design change requests, and no general support. Microsoft support for ESU only covers installation, activation, and possible regressions of the ESU itself, and it requires an active support plan.
| ESU year | Coverage period | Price per device (USD) |
| Windows 10 ESU Year 1 | October 15, 2025 to October 13, 2026 | $61 |
| Windows 10 ESU Year 2 | October 14, 2026 to October 12, 2027 | $122.00 |
| Windows 10 ESU Year 3 | October 13, 2027 to October 10, 2028 | $244 |
On a phone, scroll the table sideways to see every column.
Windows 10 ESU Year 2 costs $122.00 USD per device, double the Year 1 price, and ESU is cumulative. If you skipped Year 1, you must buy the Year 1 license along with Year 2, so your first year of coverage costs $183 per device. Keep records of your Windows 10 ESU licenses, since Year 2 is checked against Year 1. An organization that stays enrolled for all three years pays $427 per device.
A few other rules matter for planning:
Devices must run Windows 10, version 22H2 to receive ESU updates.
Licenses are bought one full year at a time, with no partial-year purchases.
Install the Windows 10 ESU Licensing Preparation Package and the latest Windows update first. Activation uses ESU Multiple Activation Keys entered from an administrator account, so a coverage lapse can happen if keys aren’t deployed and verified on every device.
Windows 10 LTSB and LTSC editions have their own lifecycles and aren’t covered by this program.
In the United States, consumer ESU options (such as the one-time purchase of $30 USD or redeeming Microsoft Rewards points) apply to personal devices only. Consumer enrollment needs a Microsoft account with administrator rights; a local account must switch to a Microsoft account first, and a child account can’t enroll. Business devices need commercial ESU.
Why Commercial ESU Is Only a Temporary Bridge
ESU keeps the lights on, but it doesn’t keep Windows 10 current. Microsoft Security Response Center decides which fixes qualify, and only vulnerabilities rated critical or important are patched. Everything else stays open.
That leaves real gaps for any organization running unsupported Windows 10:
Security risk grows over time. Attackers know Windows 10 is frozen, so malware and cybersecurity attacks increasingly target the gaps ESU doesn’t cover.
Software compatibility slips. Vendors are dropping Windows 10 support, which creates compatibility issues with new applications and services.
Compliance gaps appear. An IT audit may flag Windows 10 devices even when ESU is active, because the platform no longer receives new security features.
Costs keep climbing. Year 3 doubles again, and after October 10, 2028, there are no more updates at any price.
Every dollar spent on Windows 10 ESU Year 2 buys time, not progress. The real question is how to use that time.
When Paying for Windows 10 ESU Year 2 Makes Sense
Paying for Year 2 is the right call when a device can’t move yet and business continuity depends on keeping it running. Common cases include:
Line-of-business apps still in testing. Application testing on Windows 11 isn’t finished, and production uptime depends on that software.
Specialized hardware. Lab equipment, kiosk mode devices, or manufacturing systems tied to Windows 10 drivers.
Hardware refreshes already scheduled. Devices that fail Windows 11 hardware requirements are budgeted for replacement in the next few months.
Budget timing. Grant or donation constraints, common for an educational organization or nonprofit, delay new hardware purchases.
For most other devices, migrating is cheaper. Each device now costs $122 for Year 2 and $244 for Year 3, and that money goes toward a platform with an end date. The same budget can go toward the hardware and software costs, labor and downtime of a Windows 11 upgrade that’s supported for years.
A simple rule: buy ESU only for the devices on a written upgrade schedule, and only for as long as that schedule needs.
Don’t pay Year 2 prices for PCs that could upgrade today.
We can inventory your Windows 10 fleet, sort every device into upgrade now, replace, or cover with ESU, and tell you exactly how many licenses you really need.
How to Lower Your ESU Costs
If some devices truly need Windows 10 ESU Year 2, you don’t have to pay full price for all of them.
Use cloud-based update management. Microsoft offers a 25% discount when ESU is delivered through a cloud-based solution such as Microsoft Intune or Windows Autopatch. Microsoft 365 Business Premium already includes Intune, and other Microsoft 365 Business subscriptions can add it. Ask your licensing partner about the discounted rate.
Connect to Windows 365 Cloud PCs. Windows 10 devices that connect to Windows 365 Cloud PCs receive ESU at no extra cost with an active Windows 365 license. Users work in Windows 11 in the cloud while the old device acts as a thin client until its replacement arrives.
Move workloads to Azure. Windows 10 virtual machines also receive ESU free in Azure Virtual Desktop, Azure virtual machines, Azure Dedicated Host, Azure VMware Solution, Nutanix Cloud Clusters on Azure, Azure Local, Azure Stack Hub, and Azure Stack Edge. That can be a quick fix for legacy apps that must stay on Windows 10. If you deliver desktops through Citrix or Omnissa Horizon, confirm with your vendor whether your hosting platform qualifies.
License only what you need. Start with an inventory and assess devices, licensing, and compatibility before you buy, so you don’t pay Year 2 prices for PCs that could upgrade today.
How to Migrate to Windows 11: A Phased Plan
The best way to migrate to Windows 11 is a phased migration that moves low-risk devices first and leaves the hardest cases for last. That approach lets you maintain compliance and security throughout the process. Windows 11 also adds protections Windows 10 will never get, such as Smart App Control.
Check Windows 11 hardware requirements
Start by finding out which devices can upgrade to Windows 11 at all. The key Windows 11 hardware requirements are:
TPM 2.0 and Secure Boot enabled in the BIOS or UEFI settings
Compatible processors from Microsoft’s supported CPU list
For Windows 11 24H2, modern CPUs that support the POPCNT instruction and SSE4.2
For a few machines, the PC Health Check application works fine. For a fleet, use Microsoft Intune or Configuration Manager reports to check compatibility at scale.
Build a phased migration plan
Inventory and assess. List every Windows 10 device, its hardware status, its apps, and who uses it. Then set a triage hierarchy so business-critical devices get the most testing and the least disruption.
Test applications. Run application testing with a pilot group and fix compatibility issues before wider rollout.
Upgrade compatible devices. Use an in-place upgrade for healthy machines, or a clean installation when you want a fresh start.
Replace what can’t upgrade. Plan hardware refreshes for devices that fail compatibility checks. Windows Autopilot can ship a new Windows 11 PC straight to the user, ready to sign in with Microsoft Entra. Personal or BYOD devices can be Microsoft Entra registered instead of fully joined.
Cover the stragglers. Buy Windows 10 ESU Year 2 only for devices still waiting, and track each one against its upgrade schedule.
Train and support users. Short employee training sessions on what’s changed in Windows 11 cut help-desk tickets after go-live.
A typical Windows 11 Pro migration timeline for a mid-sized organization runs a few months, depending on how many devices need new hardware. If devices are still joined to an on-premises Active Directory domain, the migration is also a good time to plan your move to Microsoft Entra ID.
What Regulated Organizations Should Know
Regulated organizations face higher stakes. Healthcare providers under HIPAA need secure EHR access, and financial firms answer to FINRA, the SEC, and GLBA rules on protecting client data and client confidentiality.
ESU can help you pass an IT audit in the short term, because devices still receive critical and important security updates. But auditors increasingly ask for a documented upgrade schedule, not just proof of patching. A clear migration plan, with ESU as the temporary bridge for named devices, is far easier to defend than an open-ended Windows 10 footprint.
For these teams, two habits make a big difference: track ESU license activation on every device so there’s no coverage lapse, and keep evidence of each device’s migration date for your compliance records. If you work with a managed IT and cybersecurity provider, make sure its critical admin SLAs cover your ESU devices too.
Pay Double or Migrate? The Bottom Line
Windows 10 ESU Year 2 is worth buying for a short list of devices that truly can’t move yet. For everything else, the smarter move is to upgrade to Windows 11 now, before Year 3 doubles the price to $244 per device.
The organizations that come out ahead treat ESU as a bridge with a clear end date. They inventory their devices, test their apps, replace what can’t upgrade, and finish the move on their own schedule rather than Microsoft’s.
Need help planning your move? Windows Management Experts helps organizations assess their Windows 10 fleet, right-size ESU licensing, and run Windows 11 migrations with Microsoft Intune, Windows Autopilot, and Configuration Manager. Contact our team to build your migration plan today.
Treat ESU as a bridge with a clear end date.
We’ll assess your Windows 10 fleet, right-size ESU licensing, and run your Windows 11 migration before Year 3 doubles the price again.
