Managed IT
Windows 10 Extended Security Updates: What Keeping It Costs
Windows 10 is out of support. See what Extended Security Updates cost per PC, what stops working safely, and how to choose between ESU, upgrading and replacing.
Keeping Windows 10 running means one of two things: pay Microsoft for Extended Security Updates (ESU), or accept that newly found security flaws go unpatched by Microsoft on those PCs. Through Volume Licensing, commercial ESU costs $61 per device for Year One, and the price doubles each year for up to three years.
Your PCs won’t stop working either way. The question is how long you want to run them without a plan, and what that plan costs. The Microsoft facts below come from Microsoft’s own documentation. Where we do the math or give our own view, we say so.
Is it safe to keep using Windows 10?
It depends on the PC. That’s a less satisfying answer than “no,” but it’s the accurate one.
Microsoft has ended support for Windows 10 Home, Pro, Enterprise and Education. It no longer provides technical support, feature updates or quality updates for it. Quality updates are the monthly security and reliability fixes. A PC not enrolled in ESU stops getting them, so any flaw found from here on stays open on that machine.
Does that make every Windows 10 PC an emergency? No. Does it make the PC that handles client files, payroll or your bank login a bad place to stop patching? Yes.
Three questions sort most PCs quickly:
- What does it store? A shared PC that opens email and a browser is different from the one holding client records.
- What can it reach? A PC on the same network as your file server or accounting data can be a way in to everything else.
- How is it used? Browsing the web and opening attachments carries more exposure than running one old program in a corner.
An unpatched PC that does little and reaches nothing is a low risk you can plan around. An unpatched PC that does everything is the one to deal with first. Nobody can answer this for the whole office at once, which is why the next step is a PC-by-PC list.
What does Windows 10 extended support cost?
Here is what Microsoft publishes. Through its Volume Licensing program, commercial ESU is $61 per device for Year One. Microsoft’s rule is that the price doubles every consecutive year, for a maximum of three years.
Microsoft doesn’t list the Year Two and Year Three prices as numbers. The table below is our arithmetic from its rule.
| Year of ESU | Price that year (our arithmetic) | Running total per device |
|---|---|---|
| Year One | $61 | $61 |
| Year Two | $122 | $183 |
| Year Three | $244 | $427 |
ESU is also cumulative. The FAQ on Microsoft’s Windows 10 ESU page says that if you buy in Year Two, you pay for Year One too. So starting late doesn’t save you the first year’s fee. It only shortens the runway.
For a feel of the scale, take Year One plus Year Two at $183 per device:
| PCs on ESU | Microsoft fees through Year Two |
|---|---|
| 10 | $1,830 |
| 25 | $4,575 |
| 50 | $9,150 |
That’s multiplication at Microsoft’s Volume Licensing price, not a quote. Prices through other channels may differ, so check what your reseller charges.
What the number leaves out matters just as much:
- ESU doesn’t include general technical support. If something breaks, you’re still on your own or paying someone.
- A PC has to be running Windows 10, version 22H2 to get ESU.
- Someone has to enroll each PC and confirm it’s actually receiving the updates. A license nobody applied protects nothing.
- It ends. After three years at most, you still need a supported version of Windows on every PC that stays in service.
Microsoft describes its ESU program as “a temporary bridge to stay secure while one migrates to a newer, supported platform,” and says it is “not intended as a long-term solution.” We agree with that framing. ESU buys time. It doesn’t change where you end up.
One more detail from Microsoft: Windows 10 virtual machines in Windows 365 and Azure Virtual Desktop get ESU at no additional cost. That only helps if you already run desktops that way.
What happens to apps and security tools?
Short answer: it’s mostly your software vendors’ call, not Microsoft’s, and their policies differ.
Your accounting package, practice management system, line-of-business software and security tools each decide how long they support Windows 10. Some will keep supporting it for a while. Some won’t. We can’t tell you which is which for your stack, and a general article can’t either.
Here’s what we’d check, in order:
- List the programs your team can’t work without, such as the ones tied to billing, scheduling, imaging or client records.
- Look up each vendor’s published Windows 10 and Windows 11 support statement. Most post one.
- Test the important ones on Windows 11 before you move a whole office. A program that runs fine on one PC can still fail on another because of a driver or a plug-in.
Security tools deserve a separate line. Antivirus or endpoint protection watches for bad software. It doesn’t patch the operating system underneath it. A protected PC with an unfixed Windows flaw is better off than an unprotected one, but it isn’t the same as a patched PC. Ask your security vendor how it treats Windows 10 now that Microsoft’s support has ended.
Old hardware attached to old PCs is the quiet one. Label printers, scanners, imaging sensors and card readers sometimes need drivers that exist for Windows 10 and not for Windows 11. Find those before the swap, not during it.
Should we upgrade, replace, or buy ESU?
You don’t have to choose one route for the whole office. Each PC gets its own answer.
| Option | Fits | Watch for |
|---|---|---|
| Upgrade in place to Windows 11 | PCs that already meet Windows 11’s requirements | Only works if the PC qualifies. Still needs backup, app checks and a check afterward |
| Replace the PC | PCs that fail the requirements, or ones you planned to retire anyway | Money up front, plus setup and data move per person |
| ESU as a bridge | PCs you can’t upgrade or replace yet, with a replacement already planned | Per-device fee that doubles yearly, no support, and it ends |
Our read: upgrade what qualifies, replace what doesn’t, and use ESU only where a PC has to stay on Windows 10 for a defined reason and for a defined stretch. Paying ESU on a PC with no replacement plan is paying rent on a problem. By the end of Year Three, one PC has cost $427 in Microsoft’s Volume Licensing fees alone (our arithmetic), and it still needs a new home.
Microsoft’s lifecycle table lists October 10, 2028 as the last day of Windows 10 ESU coverage. That is the outer edge of the bridge. Nobody needs to plan around that date to make a sound decision today. The point is only that the bridge is finite.
Cost per PC also changes the math. A PC that qualifies for Windows 11 costs you labor but no hardware. A PC that doesn’t qualify costs hardware plus setup, and you were probably going to buy it eventually. ESU on that second PC doesn’t remove the purchase. It postpones it and adds a fee.
If you want more on how this fits into running your office’s IT in general, see how managed IT services handle device updates, and our Windows 11 upgrade page for the full option breakdown.
How do I check if a PC can run Windows 11?
Age alone won’t tell you. A PC bought a few years ago can fail one check, and one failed check is enough.
Microsoft’s minimum requirements include:
- TPM 2.0, a security chip that stores encryption keys.
- A compatible 64-bit processor, 1 GHz or faster with two or more cores. The processor has to be on Microsoft’s supported list, not just fast.
- UEFI firmware that is Secure Boot capable, which checks that nothing tampered with the startup software.
- 4 GB of memory or more.
- 64 GB of storage or more.
Microsoft publishes the full Windows 11 system requirements and a page on how to determine eligibility. For one PC running Windows 10 Pro, its PC Health Check app gives a quick answer.
Checking one PC takes minutes. Checking forty and keeping track of the results is where it gets tedious, and where PCs get missed.
Where Helix Stax fits
Helix Stax is a managed IT provider for Hampton Roads businesses. Our free IT assessment includes a Windows 11 readiness check based on the PC details you share, so within a week your roadmap shows which ones look ready to upgrade and which likely need replacing. You get the list that every decision above depends on.
If you then want help, we handle Windows device management, hardware procurement and installs, and Intune enrollment so updates and settings are managed centrally afterward. That work is quoted per project after the assessment, and the assessment stays free either way. Intune needs a Microsoft license, and we list that cost in the quote.
We aren’t selling you ESU in this post, and we aren’t going to tell you every PC has to go. Some of yours can stay as they are for now.
Microsoft, Windows, Intune, Windows 365 and Azure Virtual Desktop are trademarks of the Microsoft group of companies. Helix Stax is an independent company. This post is not sponsored or endorsed by Microsoft. Microsoft prices and terms can change, so check Microsoft’s pages for current figures. Sources: Windows 10 Extended Security Updates and the Lifecycle FAQ for Extended Security Updates, Microsoft Learn.
Read more
Managed IT
Managed Services for Small Business: What You Actually Get
What managed IT services include for a small business, what they leave out, and how to judge a provider. A plain-English guide for Hampton Roads firms.
Managed IT
What Is an MSP? Managed Service Provider, Explained
MSP stands for managed service provider. Here's what that means in plain terms, what an MSP actually does, what it costs, and how it differs from an IT consulting firm.
Managed IT
IT Support for Dental Practices in Virginia Beach and Hampton Roads
Dental practices in Virginia Beach and Hampton Roads face HIPAA risk, ransomware, and dental software complexity that generic IT support misses. Here is what local IT actually covers.
Frequently asked questions about Helix Stax managed IT services
Extended Security Updates (ESU) is Microsoft's paid program that keeps delivering critical and important security updates to enrolled Windows 10 PCs after regular support ended. It brings no new features and no general technical support. Microsoft describes its ESU program as a temporary bridge while you move to a newer, supported platform, not a long-term solution.
Through Microsoft's Volume Licensing program, Microsoft lists $61 per device for Year One. The price doubles each consecutive year, for a maximum of three years. Our arithmetic from that rule gives $122 for Year Two and $244 for Year Three, or $427 per device for all three. Prices through other channels may differ.
No. Microsoft says Windows 10 PCs continue to work after support ends. What stops is technical support, feature updates and quality updates, which include security and reliability fixes, unless the PC is enrolled in ESU.
A Windows 10 PC that isn't enrolled in ESU no longer gets Microsoft's security fixes, so newly found flaws stay open on it. How much risk that carries depends on what the PC does, what is stored on it and what it can reach on your network. A PC that never touches the internet or sensitive data is a different case from a front desk PC that does.
Not on Microsoft's fee. Microsoft says ESU is cumulative, so if you start in Year Two you pay for Year One too. Waiting doesn't lower what you owe for the years you cover, and it doesn't remove the need for a plan, because ESU runs three years at most.
It depends on the PC, not just its age. Microsoft's requirements include TPM 2.0, a compatible 64-bit processor on its supported list, UEFI firmware that is Secure Boot capable, 4 GB of memory and 64 GB of storage. Microsoft's PC Health Check app tests a single PC against those requirements.