Windows 10 support ends on 14 October 2025, and Windows 10 ESU comes up in almost every customer environment I work in right now. Some organisations have legacy line-of-business apps, some have hardware that doesn't meet the Windows 11 requirements, and some simply have budget cycles that don't line up with Microsoft's support timeline. Very few will get through this without at least considering ESU. One thing is certain. Without Extended Security Updates, Windows 10 gets no more security patches after that date. If you need to keep devices online and compliant, you have to work through the technical and financial options now, and be honest with yourself about when ESU is a sensible bridge and when it isn't worth the money.
Windows 10 ESU extends security updates for up to three years
Windows 10 ESU gives you up to three more years of critical security updates. It is a paid add-on, though, and the price doubles every year. Microsoft has published the commercial price for year one as USD 61 per device, and years two and three each double that figure. You buy ESU through volume licensing or from your CSP. On the technical side, ESU is enabled with Multiple Activation Keys (MAK), either by hand on each device with slmgr or, far more practical at scale, through Intune scripts. Microsoft's official guide to enabling ESU is clear and easy to follow. There is one important exception. Windows 10 devices that are only used to access Windows 365 Cloud PCs or Azure Virtual Desktop get ESU at no cost, and so do VMs running in Azure. In some mixed environments that saves real money, particularly with remote workers or where legacy VMs are still running in the cloud.
ESU only pays off for a small number of devices
The decision is rarely about price alone, but the numbers do matter. Because the price climbs every year, ESU ends up as a short-term fix rather than a long-term plan. Where I've seen it work well is with a handful of specialist devices that can't be replaced or upgraded in time, such as lab equipment or manufacturing PCs running software tied to a specific vendor. Once you're talking about large numbers of desktops, though, the annual bill soon outweighs whatever you gain by keeping old hardware running. My rule of thumb is simple. If you need Windows 10 for more than a year, replacing or migrating the devices is almost always the better investment.
Practical tip: Treat this as a chance to audit your device inventory and application dependencies. I regularly find unsupported machines or forgotten applications that nobody noticed until ESU became a topic.
Activation is simple but has a few traps
Turning on ESU isn't difficult, but people trip over the same things again and again. Every device needs a valid Windows 10 Enterprise or Education licence (Home doesn't qualify). You activate with a MAK key by running slmgr /ipk <ESU-MAK> followed by slmgr /ato on each device, or you push it out through Microsoft Intune with a PowerShell script. This is a minimal script for Intune Device Configuration (for Intune-managed Windows 10 Enterprise/Education devices):
# Sample Intune device configuration script
slmgr /ipk <ESU-MAK>
slmgr /ato
Check the official lifecycle documentation to confirm eligibility and dates. Also remember that devices need outbound access to Microsoft's activation servers. More than once I've watched firewall rules hold up an ESU rollout.
The flow diagram below shows the different device scenarios and how ESU gets activated in each. You can see at a glance which Windows 10 instances receive ESU automatically and which ones need manual activation:
flowchart TD
A["Windows 10 device"] --> B["ESU needed?"]
B -- "No" --> G["No action required"]
B -- "Yes" --> C["Cloud PC / AVD / Azure VM?"]
C -- "Yes" --> E["ESU auto-enabled"]
C -- "No" --> D["Activate ESU MAK (slmgr/Intune)"]
D --> F["Receive ESU updates"]
E --> F
Figure: Activating Windows 10 ESU in manual and automatic scenarios.
Microsoft 365 Apps keep getting security updates until 2028
I often hear that ESU keeps all Office apps updated as well. That isn't quite how it works. Microsoft 365 Apps on Windows 10 will keep receiving security updates until October 2028, even if the operating system itself depends on ESU. That gives organisations running Microsoft 365 Apps some welcome breathing room, provided they stay on supported channels. Office 2016 and 2019 are a different story, as their support ends in October 2025, so that upgrade belongs on your plan too. I've gone into more detail in Office 2016 and 2019 end of support: Act before 2025.
Windows 11 migration is usually the better deal
Plenty of organisations have put off moving to Windows 11 for good reasons, whether that's incompatible apps, old hardware or a plain lack of time. With ESU prices and the operational overhead both going up, though, it gets hard to justify running large Windows 10 fleets for much longer. These days hardware readiness is the main obstacle. I've described how to check your estate's Windows 11 readiness with Endpoint Analytics or third-party tools in Four Months to Go: Windows 11 Migration Readiness in Intune. It's a practical way to see which devices are ready and which ones need replacing.
I see ESU as a bridge and not a permanent home
Windows 10 ESU is a useful safety net for special cases, but at scale it is neither cheap nor simple. For a few devices you genuinely can't replace, in medical, manufacturing or other highly specialised settings, it's a pragmatic answer. Beyond that, the costs and the operational effort pile up quickly. The earlier you work out which devices you really have to keep, the smoother both your ESU rollout and your Windows 11 migration will go. Start now instead of waiting until the ESU price curve starts to hurt. Once you're on the other side, you get new features and better security, and you'll spend less time on support issues.
