Windows 10 ESU Year 2: The October 13 Decision for Texas SMBs (2026)

Windows 10 reached end of support in October 2025. Since then, the only way a business PC could keep receiving security updates was the commercial ESU program, sold per device, per year. Year one of that program expires on October 13, 2026. Several things land on the same date:

• Commercial ESU year one expires. Devices not enrolled in year two receive no further Windows 10 security updates.
• Office 2021 and Office LTSC 2021 reach end of support. Many SMBs bought these perpetual licenses with new PCs in 2021 and 2022 and have not revisited them.
• The consumer extension does not help you. Microsoft extended its consumer ESU program for personal devices, but any PC joined to Active Directory, joined to Microsoft Entra ID, or enrolled in mobile device management is excluded. If your staff signs in with a company account, you are on the commercial track.

If you have not confirmed how many Windows 10 devices are still in service, start there. Most Houston-area offices we assess find a few they forgot: the shipping-desk PC, the machine running the label printer, or the conference-room spare. Our IT asset lifecycle management guide explains how to keep that inventory current so this never becomes a surprise again.

Microsoft's published commercial pricing is deliberately escalating: $61 per device for year one, $122 for year two, and $244 for year three. Two details catch business owners off guard:

1. ESU is cumulative. You cannot skip year one. A company enrolling a device for the first time in October 2026 must pay for year one retroactively plus year two — $183 per device before the first year-two patch arrives.
2. ESU buys patches, not a better PC. It delivers critical and important security updates only. No new features, no non-security bug fixes, no technical support.

A PC that cannot run Windows 11 was almost always built before 2018. Spending $183 this year — and potentially $427 across all three years — to keep an eight-year-old machine limping along rarely beats the cost of a new business-class PC with a warranty. For a 25-seat office with ten non-upgradable machines, that is roughly $1,830 spent on delay, with the replacement bill still waiting. Our earlier guide on Windows 10 end of support and migration covers the broader transition plan.

ESU is a bridge, not a strategy. It earns its cost in a small number of situations:

• Line-of-business software or equipment that only runs on Windows 10 — a CNC controller, dental imaging station, lab instrument, or an older accounting or ERP client the vendor has not certified on Windows 11.
• Validated or regulated systems where changing the operating system triggers formal revalidation, common in healthcare, energy, and manufacturing environments around Houston.
• A phased hardware refresh where the last handful of machines cannot be replaced before October without disrupting operations.

In every case, attach a written end date. If nobody can say what happens to that PC in October 2027, you bought a delay, not a bridge.

For nearly every Texas SMB device, one of three options is the better answer than a second year of ESU:

1. Upgrade in place. PCs that meet Windows 11 requirements (TPM 2.0, supported CPU, Secure Boot) should be upgraded now. Use our Windows 11 hardware compatibility checklist to sort the fleet in an afternoon.
2. Replace. Machines that fail the hardware check get replaced with business-class devices, ideally provisioned through Intune device management and Autopilot so they arrive configured, compliant, and ready to hand to the user.
3. Virtualize the stubborn workloads. Windows 10 virtual machines running in Azure Virtual Desktop or Windows 365 receive ESU at no additional cost. For a legacy app that must stay on Windows 10, moving it to a managed cloud desktop can cost less than paying ESU on physical hardware — and removes the old OS from your office network.

An unpatched Windows 10 PC keeps working, which is exactly why this deadline slides. What changes is exposure. Every vulnerability Microsoft fixes in Windows 11 after October 13 becomes a roadmap for attackers targeting the unpatched Windows 10 codebase. That is the same exploit pattern we describe in our guide to EPSS vulnerability prioritization — known, weaponized flaws are what actually get used against small businesses.

The business impact shows up on paper first. Cyber insurance applications now ask whether every device runs a supported operating system, and a false answer can jeopardize a claim. Our Texas cyber insurance renewal playbook walks through the controls underwriters check. Regulated firms face the same issue in audits: an unsupported OS is a finding under HIPAA, PCI DSS 4.0, and CMMC, not a gray area.

This week, pull a device report from your RMM or Intune console and sort every Windows 10 machine into three buckets: upgrade, replace, or justify ESU. Check Office versions at the same time so Office 2021 installs are handled in the same pass. Any device in the ESU bucket needs a named business reason and a retirement date before you buy a single license.

LayerLogix handles this end to end through our managed IT services: inventory, Windows 11 upgrades, replacement provisioning, and cloud desktops for legacy apps. If you are weighing hardware spend against the rest of your 2027 budget, our vCIO and IT strategy service builds the refresh plan so the next end-of-life date is on the calendar years ahead. For benchmarks on how peers are handling patching and device standards, see the Texas SMB IT & Cybersecurity Benchmark 2026, and review our managed help desk best practices for keeping user disruption low during a migration.

• Managed IT services in Houston
• Managed IT services in Sugar Land
• Managed IT services in The Woodlands