Windows 10 Support Has Ended: Business Checklist for 2026

Most articles offering a Windows 10 end of support business checklist were written before the deadline, when the advice could still be "plan your migration." That deadline was October 14, 2025, and Microsoft has now spent ten months shipping no technical support, no feature updates and no quality or security updates for the versions that reached end of support that day. If machines in your office are still running it, you are not planning a migration any more. You are doing triage, and the sequence matters.

RANGO Technologies supports small and mid-size businesses across Miami-Dade and Broward County from Miami Lakes, and the Windows 10 devices we still find are rarely there through neglect. They are there because a scanner driver does not exist for Windows 11, because a practice-management application was certified against Windows 10 and never recertified, or because the machine controls a piece of equipment that costs more than the server rack. This checklist works through the triage in four steps, including the Extended Security Updates arithmetic, which is more expensive than most owners expect.

Table of Contents

• Where You Actually Stand Ten Months In
• Step One: Inventory Before You Buy Anything
• Step Two: The Real Cost of Extended Security Updates
• Step Three: The Applications Are the Actual Blocker
• Step Four: Contain What You Cannot Move Yet
• A Realistic Sequence for the Rest of 2026

Where You Actually Stand Ten Months In

What ended, and what did not

Nothing switched off. A Windows 10 machine still boots, still runs Office, still prints. That is precisely why this problem is easy to defer: there is no failure event to force the decision, only a slowly widening gap between the vulnerabilities being discovered and the patches being written for your operating system.

What ended is the supply of fixes. Every Patch Tuesday since October 2025 has closed flaws in Windows that are, in many cases, present in the Windows 10 code your machines are running. Those advisories are public. They function as a specification for anyone who wants to attack an unpatched estate, and the unpatched estate is now easy to find.

The security arithmetic, with a number attached

Verizon's 2026 Data Breach Investigations Report found that 31% of breaches begin with exploitation of a software vulnerability, making it the leading initial access vector in the dataset. That is the exact category an unsupported operating system moves you into, and it moves further into it every month rather than staying where it was in October.

CISA's #StopRansomware Guide puts the countermeasure plainly: regularly patch and update software and operating systems to the latest available versions, and conduct regular vulnerability scanning, especially of internet-facing devices. An operating system with no patches available cannot satisfy that control by any amount of effort. It can only be replaced, covered by a paid update program, or contained.

Step One: Inventory Before You Buy Anything

What the inventory has to record

Do not start by pricing new computers. Start by producing a list, because in most offices the number of genuinely blocked machines is far smaller than the number of Windows 10 machines, and the difference is the budget.

For each device record five fields: the Windows 10 build (ESU requires version 22H2, so anything older needs updating before it is even eligible), Windows 11 hardware eligibility, the applications and peripherals that only run on this machine, who uses it and for what, and whether it touches sensitive data or the internet directly. Five columns, one afternoon. Everything downstream is decided from this sheet.

Windows 11 eligibility, honestly

Sort the list into three groups. Group one is eligible for Windows 11 and can be upgraded in place, which is most of the fleet and costs licensing time rather than capital. Group two is ineligible on hardware and needs replacing on a schedule you choose. Group three is eligible or ineligible but blocked by an application or a device, which is the group that actually needs thought.

Resist two temptations here. The first is bypassing the Windows 11 hardware requirements on unsupported machines, which produces a device Microsoft is not obliged to update — trading a known unsupported state for an ambiguous one. The second is replacing everything at once because it is administratively simpler. Group two can be staggered across quarters if group three is contained, and the containment work in step four is what buys you that room.

Step Two: The Real Cost of Extended Security Updates

What Microsoft charges, and how it escalates

Extended Security Updates are the official route to keep receiving security patches on Windows 10. Microsoft's ESU program documentation states that commercial ESU is available through Volume Licensing at $61 USD per device for Year One, and that the price doubles every consecutive year, for a maximum of three years. Year One started in November 2025. Licences are bought by the year, with no partial periods, and the minimum purchase is a single licence.

The detail that changes the maths is that ESU is cumulative: buying Year Two requires paying for Year One as well. Applying Microsoft's published price and its published doubling rule gives the following per-device totals. The Year One figure is Microsoft's; the later rows are that rule applied.

Multiply the right-hand column by the number of machines you are tempted to defer, and compare it against what your hardware vendor quotes to replace them. For a small number of genuinely blocked devices, ESU is a reasonable price for the extra time. For twenty desktops that could have been upgraded in place, it is a very expensive way to postpone a Saturday of work.

What ESU does not include

Read this list before you budget for it. ESU delivers critical and important security updates only. There are no new features, no non-security fixes, and no technical support. A Windows 10 machine covered by ESU that develops a fault is a machine you are on your own with, and any bug that is not classified as a security issue stays where it is.

Two further constraints. Devices must be running Windows 10, version 22H2 to be eligible at all. And commercial organizations can receive updates for a maximum of three years past end of support, so ESU is a bridge with a visible end, not a plan. One useful exception: Microsoft includes ESU at no additional cost for Windows 10 virtual machines in Windows 365, Azure Virtual Desktop and Azure VMs, which occasionally makes hosting a stubborn application cheaper than licensing the physical desktop under it.

When ESU is the right call

Buy it for group three, the machines with a real blocker and a known resolution date. Buy it for the imaging workstation whose vendor has committed to a Windows 11 release next quarter. Do not buy it as a fleet-wide decision, and do not let a provider sell it to you as one before the inventory exists. If you want that inventory and the licensing handled together, that is what our Microsoft 365 consulting work covers alongside the tenant side.

Step Three: The Applications Are the Actual Blocker

Get the vendor statement in writing

The blocker is almost never Windows. It is the application on top of it, and the fix is a support statement from the vendor, in writing, naming Windows 11 and a version number. Ask three questions: is the current release supported on Windows 11, what is the version and date, and if not, what is the committed timeline.

Two answers should change your plan. "It works but we do not support it" means you are running production on an unsupported configuration, and the day you have a problem the vendor's first request will be to reproduce it on a supported platform. "We have no timeline" means the product is being wound down and you are now shopping for a replacement application, which is a six-month project rather than a hardware refresh. Better to learn that in August than in a hurry.

The peripherals and equipment nobody counts

The other blocker is hardware attached to the machine. Label printers, signature pads, check scanners, dental sensors and imaging heads, laboratory instruments, older multifunction copiers, and any device whose driver was last published years ago. These do not appear on a software inventory and they are the reason a scheduled upgrade gets rolled back at 8:00 AM on a Monday.

Test each one on a single Windows 11 machine before the fleet moves. Where a driver genuinely does not exist, the usual answers are a manufacturer interface upgrade, a network-attached replacement for a directly connected device, or isolating one machine as the last Windows 10 device with the containment controls below. Buy that machine ESU and move on. Repeating this exercise every few years is normal, and building it into a hardware lifecycle plan is one of the quieter benefits of managed IT services.

Step Four: Contain What You Cannot Move Yet

Segmentation and least privilege

Any Windows 10 machine that survives this process should be treated as a device that will eventually have an unpatched flaw, because that is what it is. Put it on its own network segment with rules that permit only the traffic it needs — the application server, the print queue, the specific instrument — and nothing else. Remove local administrator rights from the user who operates it. Remove its access to file shares it does not require.

Do not let it reach the internet unless the application demands it, and if the application does, restrict that to the destinations involved. The point of segmentation is not to protect the old machine. It is to make sure that when the old machine is compromised, the attacker cannot use it to reach the rest of the business.

Monitoring, backup, and knowing it is still there

Keep endpoint detection and response on the device. CISA recommends using application allowlisting and endpoint detection and response on all assets, and the assets with no patches available are the ones where detection has to compensate. On a fixed-purpose machine running the same three programs every day, allowlisting is unusually practical.

Back it up with the same discipline as everything else, and confirm the backup target is not reachable as a mapped drive from the machine itself. Then put a review date in the calendar. The failure mode is not that businesses fail to contain these devices; it is that they contain one, forget it, and rediscover it during an incident three years later. Our cybersecurity reviews look specifically for exactly this class of forgotten endpoint, and the wider context is covered in the top cyber threats targeting small businesses in 2026.

A Realistic Sequence for the Rest of 2026

Work in this order. Build the five-column inventory this month, because every other decision depends on it and it costs nothing but time. Upgrade group one in place next, in batches, starting with the least disruptive department, since that is the largest reduction in exposure for the least money. Get vendor support statements for group three in parallel, as they take weeks to arrive and determine whether you are buying hardware or shopping for software. Then schedule group two replacements across the remaining quarters, and buy ESU only for the specific devices that still have no other answer.

One caution on sequencing. Do not wait until the whole plan is funded before starting, and do not let the hardest machine set the pace for the easy ones. The eight desktops that can be upgraded on a Saturday should not sit unpatched for another two quarters because the imaging workstation is unresolved. While you are auditing endpoints, the tenant side deserves the same pass — our Microsoft 365 security checklist for small businesses covers the controls that are still off by default there.

If you would like a device-by-device inventory with the eligibility, blocker and recommendation already filled in, a free IT assessment produces exactly that, including an honest count of how few machines probably need to be bought. Request a free IT assessment. Every engineer who would look at your systems is based in South Florida. Call (305) 901-8990, Monday through Friday, 8:00 AM to 5:00 PM ET.