Windows 10 Extended Security Updates Year 2: Costs and Options

Windows 10 one year on

Microsoft ended support for Windows 10 on 14 October 2025. Since then, Windows 10 PCs have stopped receiving free security fixes, feature updates and technical support. The only way to keep security patches flowing to those PCs is Microsoft's Extended Security Updates (ESU) program, a paid annual subscription. One year on, organisations that bought ESU are into their second year of cover, and anyone weighing up Windows 10 extended security updates year 2 needs to decide now.

Plenty of organisations are in this position. A practice that upgraded most of its PCs last year often still has a few machines left: the reception PC running an old scanner driver, a spare laptop in a drawer, a workstation attached to a piece of equipment. Those stragglers are exactly where attackers look.

Here is the short version of what ESU is, according to Microsoft:

• It delivers critical and important security updates only, as rated by the Microsoft Security Response Center.
• It does not include new features, non-security fixes or design changes.
• It does not include general technical support. Microsoft only supports problems with ESU itself: licence activation, installation and any regressions it causes.
• Devices must be running Windows 10, version 22H2. Long-term servicing editions (LTSB/LTSC) follow their own lifecycles and aren't covered by this program.

Your Windows 10 PCs will keep switching on and running without ESU. They just stop getting security fixes, and every month that goes by adds more known, unpatched weaknesses.

What does Windows 10 extended security updates year 2 cost?

Microsoft's ESU FAQ on Microsoft Learn sets out the commercial rules:

• Year One is US$61 per device, bought through the Microsoft Volume Licensing Program.
• The price doubles every consecutive year, for a maximum of three years.
• ESU is bought by the year. You can't buy part of a year.
• ESU is cumulative. If you start in Year Two, you have to pay for Year One as well.
• The minimum purchase is one licence.

Microsoft publishes these prices in US dollars. What you actually pay in Australian dollars depends on how you buy and on exchange rates, so get a local quote before you budget.

On Microsoft's figures, the doubling works out like this. Year Two is US$122 per device. A device that joins ESU now pays for Year One and Year Two together, US$183. Covering a device for all three years adds Year Three at US$244, a total of US$427. For a single machine that may be fine. Across 20 or 30 PCs it starts to look like a meaningful part of the cost of new hardware.

ESU buys you time, not safety. Every dollar spent on it should come with a date when that PC is retired.

Buying is only half the job

Paying for ESU doesn't switch it on. Microsoft's ESU activation instructions explain that each Windows 10 device has to have the ESU key (a Multiple Activation Key, or MAK, from the Microsoft 365 admin centre) installed and activated, and each ESU year has its own activation ID. Devices also need specific prerequisite updates installed first. If nobody has checked that Year 2 is active on each device, assume it isn't.

Why the free consumer ESU doesn't cover business PCs

This is where a lot of online advice goes wrong. Microsoft runs a separate consumer ESU program for home users, and it is much cheaper. On Microsoft's Australian page, home users can enrol at no extra cost if they sync their PC settings, by redeeming 1,000 Microsoft Rewards points, or with a one-time purchase of AU$44.95 including tax. One licence covers up to 10 devices. The consumer program now runs until 12 October 2027, later than the end date many older articles still show.

It is tempting to enrol work PCs the same way. Don't. Microsoft states that the consumer program can't be used in commercial scenarios, and it won't be offered for:

• devices joined to an Active Directory domain or to Microsoft Entra (Microsoft's cloud identity service, formerly Azure AD)
• devices enrolled in a mobile device management (MDM) tool such as Microsoft Intune
• devices in kiosk mode.

If your PCs are managed properly, they are almost certainly domain-joined, Entra-joined or enrolled in Intune, so the consumer offer won't appear. If a work PC isn't managed at all, that is a bigger problem than ESU.

The Windows 365 and Azure Virtual Desktop route

Microsoft includes ESU at no additional cost for Windows 10 virtual machines in several of its cloud services, including Windows 365 Cloud PCs, Azure Virtual Desktop and Azure virtual machines. In those environments, Microsoft says no extra keys or configuration are needed.

There is a second, less well-known benefit. According to Microsoft's guidance for clients accessing cloud and virtual machines, the physical Windows 10 PC a person uses to connect to a Windows 365 Enterprise Cloud PC (or a Windows 365 Flex Cloud PC in dedicated mode) is entitled to ESU for the duration of the offer, at no extra cost. The conditions matter:

• The user must have an active Windows 365 Enterprise licence assigned, or a Flex Cloud PC in dedicated mode provisioned.
• The local Windows 10 device must be Microsoft Entra joined or Microsoft Entra hybrid joined. Devices that are only Entra registered, or only joined to an on-premises Active Directory, don't qualify.
• The user must sign in to the physical device with the same Entra account they use for their Cloud PC at least once every 22 days.
• Your IT team must deploy a specific policy through Intune or another MDM tool to turn on the ESU subscription check.

For an organisation that was already considering Cloud PCs, this can change the maths: staff work in a Windows 11 Cloud PC, and the older Windows 10 device they connect from keeps getting security updates while it reaches the end of its life. For an organisation that wasn't, signing up to Windows 365 just to avoid ESU fees rarely makes sense on its own. Our cloud services team can help you compare the two.

Your options for the PCs still on Windows 10

Every remaining Windows 10 PC should end up in one of four groups.

1. Upgrade it to Windows 11

If the hardware meets Microsoft's Windows 11 requirements, upgrade it. The key requirements are a compatible 64-bit processor, at least 4 GB of memory and 64 GB of storage, UEFI firmware with Secure Boot capability, and a Trusted Platform Module (TPM) version 2.0, a security chip built into most business PCs from recent years. Many PCs that were held back last year were held back by a single application or peripheral, not the hardware. Test that application again; vendors have had a year to catch up.

2. Replace it

If the PC can't run Windows 11, replacement is usually the cleanest answer. Compare the cost of ESU over the time you intend to keep the device against the cost of a new one.

3. Move the user to a Cloud PC

For staff who work across sites or from home, or for a short-term contractor, a Windows 365 Cloud PC gives them a managed Windows 11 desktop without buying new hardware straight away.

4. Cover it with ESU, with a retirement date

Some machines genuinely can't move yet: a PC that runs a piece of clinical or manufacturing equipment, for example, where the equipment supplier hasn't certified Windows 11. ESU is the right tool here. Buy it, activate it, record why the device is an exception, and set the date it will be retired or replaced.

What ESU doesn't fix

ESU closes the most serious Windows security holes. It doesn't make Windows 10 a current platform again.

Your security framework still expects replacement. The Australian Signals Directorate's Essential Eight maturity model includes, at Maturity Level One, the requirement that "operating systems that are no longer supported by vendors are replaced". ESU-covered PCs are still receiving security patches, but if you are working towards the Essential Eight, or answering a cyber insurance or accreditation questionnaire, be ready to explain each remaining Windows 10 device and when it will be gone. Our cybersecurity team works to the Essential Eight and can help you document this.

Microsoft 365 Apps are on a separate timeline. Microsoft says it will keep providing security updates for Microsoft 365 Apps on Windows 10 until 10 October 2028. Feature updates, including Copilot features where eligible, stop at Version 2608, after which those devices receive security updates only. Support for problems that only occur on Windows 10 is limited to troubleshooting, and Microsoft's support team will ask you to move to Windows 11. If you are planning a Microsoft 365 rollout or new Copilot features, Windows 10 devices will fall behind.

Other software won't wait. Line-of-business applications, printers, scanners and security tools all have their own support policies for Windows 10. Check each one rather than assuming ESU keeps everything supported.

How CSG helps with Windows 10 end of life

We have been looking after organisations across the Gold Coast, Brisbane, Tweed Heads and South East Queensland since 1999. As a Microsoft Partner working to the ACSC Essential Eight, we treat Windows 10 retirement as a security job as much as a hardware one.

For clients on our managed IT services, that means:

• an audit of every remaining Windows 10 device and why it is still there
• a Windows 11 readiness check, including application and peripheral testing
• a costed recommendation for each device: upgrade, replace, Cloud PC or ESU
• ESU purchase and activation for genuine exceptions, with a recorded retirement date
• upgrades and replacements scheduled around your clinic or office hours, on site across South East Queensland.

Our 24/7 monitoring also means we can see which devices are still on Windows 10 and whether their updates are actually arriving. Planned upgrades, not surprise failures. If you are not sure how many Windows 10 PCs you still have, talk to our team or call us on (07) 5551 2333.