Windows 10 ESU Year 2 Doubles to $122: 4 Ways to Respond

Windows 10 Extended Security Updates Year 1 ends on October 13. Year 2 kicks in the same day at $122 per device, exactly double the $61 you paid this year. If you skipped Year 1, you can’t just buy Year 2 on its own. Microsoft requires retroactive payment for both years, bringing your entry cost to $183 per device. For a 100-person company, that’s $12,200 to $18,300 just to keep receiving security patches on an operating system that Microsoft stopped supporting a year ago.

You have two weeks to make a decision. Here are your options and what each one actually costs.

Why the Price Keeps Doubling

Microsoft designed ESU pricing to push businesses off Windows 10, not to make staying comfortable. The escalation is intentional:

• Year 1 (October 2025 to October 2026): $61 per device
• Year 2 (October 2026 to October 2027): $122 per device
• Year 3 (October 2027 to October 2028): $244 per device

Each year doubles the previous year’s cost. A business that pays for all three years of ESU will spend $427 per device for patches alone, with no feature updates, no technical support, and no long-term viability. That $427 buys you time, not a solution.

There is one discount worth knowing about. Devices managed through Microsoft Intune qualified for reduced ESU pricing in Year 1 ($45 instead of $61). Microsoft offers a similar Intune-managed discount for Year 2 as well. If your fleet is enrolled in Intune, check your Microsoft admin center for your eligible rate before purchasing Year 2 at the full $122 price.

The retroactive requirement is the detail that catches businesses off guard. If you didn’t enroll in ESU Year 1 last October, you can’t start with Year 2. You pay for both years simultaneously, which means the window where ESU was the cheap option has closed.

Four Paths Forward

Every Windows 10 device in your environment falls into one of four scenarios. The right answer depends on the hardware, the budget, and how long you need the transition to take.

Option 1: Pay for ESU Year 2 ($122 per device)

This is the simplest path and the most expensive per year. It buys 12 more months of monthly security patches while you plan a migration. ESU makes sense for machines that can’t be upgraded or replaced before October 13 and need to stay in production while you execute a longer rollout. It does not make sense as a permanent strategy. Year 3 doubles again to $244 per device, and there is no Year 4.

Best for: Machines that need to stay online while you migrate the rest of the fleet. Treat this as a bridge, not a destination.

Option 2: Upgrade to Windows 11 ($0 license cost)

Windows 11 is a free upgrade for devices running a licensed copy of Windows 10. The license cost is zero. The catch is hardware requirements. Windows 11 requires TPM 2.0, a supported CPU, and UEFI Secure Boot. Many machines purchased before 2022 fail the CPU compatibility check even if they run Windows 10 without issues.

Run Microsoft’s PC Health Check tool across your fleet to find out which devices qualify. For machines that pass, the upgrade is an in-place installation that preserves applications and data. Budget 30 to 60 minutes per device plus testing time for line-of-business applications.

Best for: Devices manufactured after 2021 that meet hardware requirements. Lowest cost option when the hardware qualifies.

Option 3: Replace the Hardware ($800 to $1,500 per device)

For machines that can’t run Windows 11, replacement is the clean path. A business-class laptop runs $800 to $1,500 depending on specifications. Factor in imaging, enrollment in your endpoint management platform, data migration, and decommissioning of the old device. Total cost of transition typically adds $100 to $200 per machine in IT labor.

If you’re replacing 30% or more of your fleet, get purchase orders in immediately. Q4 procurement timelines stretch as every business hitting the same deadline competes for inventory.

Best for: Machines older than four years that fail Windows 11 compatibility and need replacement regardless.

Option 4: Move to Windows 365 Cloud PCs ($28 per user per month)

Windows 365 Cloud PCs run Windows 11 in Microsoft’s data center. Users connect from any device, including the aging hardware that can’t run Windows 11 locally. At $28 per user per month for the entry-level plan, Cloud PCs eliminate the ESU question entirely because the desktop runs a fully supported OS in the cloud. The physical device becomes a thin client.

Cloud PCs require reliable internet with latency under 150ms. They don’t work for employees who need offline access or GPU-intensive applications. But for knowledge workers in an office with solid connectivity, Cloud PCs convert an unpredictable hardware refresh into a fixed monthly cost.

Best for: Knowledge workers on aging hardware where replacement budgets are tight and internet connectivity is reliable.

Putting the Numbers Side by Side

Compliance Makes “Wait and See” Risky

Running an unsupported operating system is not just a technical decision. It creates documented compliance exposure that regulators, auditors, and insurers can see.

HIPAA’s Security Rule requires covered entities to maintain reasonable safeguards for electronic protected health information. Running an OS with known, unpatched vulnerabilities fails that standard. If your Dallas-Fort Worth healthcare practice handles patient data on Windows 10 machines after ESU coverage lapses, your risk assessment needs to document that gap and explain your mitigation plan.

PCI DSS Requirement 6.3.3 mandates that critical security patches be applied within 30 days of release. Without ESU, there are no patches to apply. The requirement becomes impossible to meet by definition.

CISA lists running end-of-life software in its Known Dangerous Practices catalog. While the catalog targets critical infrastructure, it reflects the baseline that auditors and insurers are moving toward across industries.

Cyber insurance carriers are paying attention too. Many renewal applications now ask specifically whether your environment runs unsupported operating systems. A “yes” answer can trigger higher premiums, additional requirements, or exclusions for claims involving those devices. If your policy comes up for renewal this quarter, resolve Windows 10 before the application goes in.

Your 90-Day Plan

October 13 is the decision deadline, not the migration deadline. If you choose ESU Year 2 for some or all of your fleet, you have 12 months to execute. If you choose to skip ESU and migrate directly, you should be finished within 90 days to limit your exposure window.

Weeks 1 through 2 (October 1 to 14): Inventory and decide.

• Pull a full device inventory from your endpoint management tool. Flag every machine still running Windows 10 by model, CPU, RAM, and TPM version.
• Run the PC Health Check tool on each device to determine Windows 11 eligibility.
• Sort devices into four buckets: upgradeable to Windows 11, needs replacement, candidate for Cloud PC, or bridge with ESU Year 2.
• Purchase ESU Year 2 licenses for any devices that will remain on Windows 10 past October 13.

Weeks 3 through 6 (mid-October to mid-November): Pilot and procure.

• Upgrade a pilot group of 10 to 15 devices to Windows 11. Test every line-of-business application, VPN client, printer driver, and security agent against the new OS.
• Submit purchase orders for replacement hardware. October orders typically ship in two to three weeks for business-class models.
• Set up Windows 365 trials for any users you’re evaluating for Cloud PCs.

Weeks 7 through 12 (mid-November through December): Deploy in waves.

• Roll out Windows 11 upgrades to eligible devices in groups of 20 to 30, waiting 48 hours between waves.
• Image and deploy replacement hardware as it arrives.
• Migrate Cloud PC users and validate their workflows.
• Run a final inventory scan to confirm no unpatched Windows 10 devices remain without ESU coverage.

If you have a managed IT provider, they should own this timeline and report progress weekly. If you manage IT internally, assign a single owner for the project and protect their calendar. Migration projects stall when they compete with daily help desk work.