Windows 10 ESU year two starts today and forces some practical decisions

Today, 13 October 2026, the first year of Windows 10 Extended Security Updates (ESU) ends and year two begins, at a higher price and with a new activation process. For many organisations that's a real turning point. If you still run Windows 10 Pro, Enterprise or Education, you need to act now. Year two is a separate purchase with new MAK keys, and each device needs the new key before it gets any more security patches. Consumers reach the end of the road here, with no further updates and no option to extend. From today, every Windows 10 device without a valid year two key is an immediate security liability.

ESU year two activation comes with new keys and a few traps

Activation in year two works much like it did in year one, except that you now have to deal with new licences and new keys. The ESU year two MAK key has to be distributed and activated on every covered device. Microsoft's guide to enabling Extended Security Updates walks through the steps. If the new key isn't applied promptly, Windows Update refuses to install further patches on those devices, usually with error 0x800F0831. I've seen plenty of devices drop out of compliance simply because someone missed the manual key update in a remote office or during a staff change.

Mixed environments tend to hold surprises. Devices licensed through different channels or running rarely used editions easily slip through the reporting. Keep a careful record of which device received which MAK key, particularly now that the final ESU year is getting closer.

An accurate inventory shows where Windows 10 still runs

In practice you need one accurate inventory of every remaining Windows 10 endpoint, and that's rarely as easy as it sounds. Intune makes it doable. Go to Devices → Windows and filter by OS version to see every machine still on Windows 10. If you use Windows Autopatch, its device reports go into more detail and help you spot machines that haven't upgraded for technical or business reasons.

A simple filter in Intune quickly gives you a clearer picture, for example:

# Intune portal → Devices → Create filter
# Condition: device OS version contains '10.'

I regularly come across unexpected stragglers hiding in some corner of the network, such as frontline devices, kiosks or specialist equipment. Cross-checking against asset lists and procurement systems is worth the effort if you want the full picture.

Every device needs a decision to replace, extend or migrate

Now that the ESU year two deadline has arrived, the pressure is real. Costs go up, and the end of ESU year three is clearly in sight. Each device needs a practical decision based on what the business actually requires:

flowchart TD
    Inventory["Windows 10 device found"] --> NeedsSupport["Needs support?"]
    NeedsSupport -->|"No"| Replace["Retire or replace"]
    NeedsSupport -->|"Yes"| Compatible["Win11 compatible?"]
    Compatible -->|"Yes"| Upgrade["Upgrade to Windows 11"]
    Compatible -->|"No"| ESU2["Activate ESU year two"]
    ESU2 --> CloudPC["Consider Cloud PC"]
    Replace --> CloudPC
    Upgrade --> Done["Done"]
    CloudPC --> Done

Figure: Decision tree for Windows 10 ESU year two – upgrade, extend or move to Cloud PC.

Real life is rarely that clear-cut. Some devices are business-critical or run legacy applications, while others could be replaced or moved to Windows 365 Cloud PC. For endpoints that can't be upgraded to Windows 11, a Cloud PC often lowers risk and cost compared with a second ESU year, especially for standard office work or niche workloads.

Windows Autopatch reports help you keep control of the ESU status

If you have Windows Autopatch, check its device reports once a month. They show exactly which endpoints are still on Windows 10 and whether ESU year two has been applied. In larger tenants, group devices by support state and use those lists to decide what to replace first and where ESU still needs activating. Even without Autopatch, you should make it a monthly routine to export device lists from Intune and reconcile them with your ESU purchases.

Many tenants underestimate the annual ESU key renewal. My advice is to track MAK keys per device and set reminders in your patch management tool, so no machine ends up unprotected because a renewal slipped through.

For the longer-term challenges, my earlier post Windows 10 end of support: One year left – what’s the plan? covers how to plan for the end of the ESU era.

Organisations should plan now or they will be forced to later

With ESU year two now here, there's no more room for comfortable procrastination. In my experience, many organisations buy the second year out of habit and never look at replacement options again, even when Windows 365 Cloud PC or a hardware refresh would now save money and future effort. Inventory every device, work through the decision tree above and make a deliberate call for each endpoint. If you need ESU, activate it promptly. For everything else, set a clear timeline for retiring Windows 10. The end of support is coming fast.

Microsoft's ESU documentation has the official details. My post Microsoft 365 Apps on Windows 10 after October 2025 explains what happens next with Office on unsupported platforms.