Windows 10 End of Support: What Small Businesses and Practices Should Do Now

Windows 10 reached end of support on October 14, 2025. If some of your office or practice computers still run it, they're not broken — but they're no longer getting the security fixes that keep attackers out, unless you're paying for them.

A year on, most offices we talk to are somewhere in the middle: the majority of PCs are on Windows 11, but there's a handful left. The front desk PC nobody wants to touch. The computer attached to the panoramic X-ray. The bookkeeper's machine with a program from 2014. Those stragglers are exactly the ones that matter most, because they tend to hold the most sensitive data and get the least attention.

This guide explains what end of support actually means, what the paid Extended Security Updates (ESU) program costs and how to enroll, how to upgrade safely to Windows 11 (including testing your practice software first), how to choose replacement PCs, how to budget for a regular replacement cycle, and how to handle the machines that genuinely can't move because they're tied to equipment. It also covers what this means for HIPAA, the FTC Safeguards Rule and your cyber insurance.

What "end of support" means in practice

End of support means Microsoft stopped fixing Windows 10, including security holes, on October 14, 2025. The computer still works; it just gets more vulnerable every month.

When Microsoft ends support for a version of Windows, three things stop:

• Security updates. New vulnerabilities are still discovered every month. Supported versions get patched; Windows 10 doesn't.
• Technical help from Microsoft.
• Software and hardware vendor support, gradually. Practice management, imaging, accounting and line-of-business software vendors drop older operating systems from their supported lists, often within a year or two.

Your PC still boots, Word still opens, and nothing visibly changes. That's exactly why it's easy to put off.

Microsoft's own lifecycle documentation puts the long-term risk plainly: once an operating system reaches end of support, "the possibility increases that new programs and hardware will not be performant on an older OS," because manufacturers design for newer systems and "may decide to discontinue support of their products on older operating systems." In plain terms: the next version of your practice software, printer driver or scanner may simply not install.

What still gets updated on Windows 10?

A few things continue for a while, which is why some offices think the problem is smaller than it is:

• Microsoft 365 apps (Outlook, Word, Excel and so on): Microsoft says it will keep providing security updates for Microsoft 365 on Windows 10 until October 10, 2028.
• Microsoft Defender antivirus definitions continue for a period, but antivirus can't fix holes in Windows itself.
• Your browser may keep updating for a while, per its own vendor's schedule.

None of these patch the operating system. An attacker who exploits a Windows flaw doesn't care that Excel is up to date.

The Extended Security Updates (ESU) option

ESU is a paid subscription that keeps critical and important Windows 10 security fixes coming for a limited time. For businesses it costs $61 per device for the first year, doubles each year, and ends for good in October 2028.

Microsoft offers paid Extended Security Updates to buy time:

Two important details for businesses, from Microsoft's ESU documentation:

1. It's cumulative. "If you decide to purchase the program in Year Two, you have to pay for Year One too." Joining late doesn't save money.
2. It's bought by the year. "Customers can't buy partial periods, for instance, only six months." The minimum purchase is one license.

Commercial ESU timeline and cost per device

Based on Microsoft's published pricing ($61 for Year One, doubling each consecutive year) and its coverage periods:

As of this writing (October 2026), we're at the very end of Year 1. Any office that wants to keep Windows 10 PCs patched past October 13, 2026, needs Year 2 coverage, and if it never bought Year 1, it pays for both. Confirm current pricing with your licensing partner before you buy.

Put those numbers next to a new PC. Keeping one Windows 10 machine patched through 2028 costs over $400 in ESU alone, for an old computer that will need replacing anyway. For most machines, that money is better spent on the replacement.

Free ESU through cloud PCs

Microsoft includes ESU at no additional cost for Windows 10 virtual machines running in Windows 365 and Azure Virtual Desktop, among other Azure services. Microsoft also says that Windows 10 devices used to connect to Windows 365 Cloud PCs are entitled to ESU for up to three years with an active Windows 365 subscription. For a few offices, putting a legacy application in a cloud PC is a reasonable bridge. It's not free overall, since Windows 365 is a paid subscription, but it can make sense for an office that also wants staff to work securely from anywhere.

For a business, ESU is a reasonable bridge for a few machines you genuinely can't replace yet — for example, a PC attached to an older X-ray sensor or lab instrument whose software won't run on Windows 11. It's not a plan for the whole office.

How do you enroll business PCs in ESU?

Buy ESU licenses through Microsoft volume licensing (usually via a Microsoft partner), get the activation key from the Microsoft 365 admin center, and install and activate it on each PC. Your IT provider can do this remotely for managed devices.

Here's the process, simplified from Microsoft's enablement guide:

Before you start

• Each PC must run Windows 10, version 22H2 with a recent cumulative update installed (Microsoft lists KB5066791 or later) and the ESU Licensing Preparation Package (KB5072653) installed after it.
• You need administrator rights on each device.
• The PC must be able to reach Microsoft's activation servers over the internet, or you'll need to activate by phone.
• Long-Term Servicing Channel (LTSC) editions are not covered. Windows 10 LTSB/LTSC releases have their own lifecycles. This matters because many equipment-control PCs ship with LTSC; check the specific edition's end date on Microsoft's lifecycle site.

Step by step

1. Count the devices that genuinely need ESU (see "Isolate anything that must stay" below). Don't buy for machines you plan to replace in the next month or two.
2. Purchase commercial ESU licenses through volume licensing. Most small businesses do this through their IT provider or a Microsoft licensing partner.
3. Find the key. In the Microsoft 365 admin center, go to Billing > Your products > Volume licensing, open View contracts, find the ESU license, and select View product keys. Your account needs the Product Key Reader or VL Administrator role.
4. Install the key on each PC from an elevated command prompt using Microsoft's slmgr.vbs /ipk command with the multiple activation key (MAK).
5. Activate the right year using slmgr.vbs /ato and the activation ID Microsoft publishes for that ESU year. Year 1, Year 2 and Year 3 each have their own activation ID, so each new year needs activating.
6. Verify with slmgr.vbs /dlv; the ESU entry should show "Licensed."
7. Confirm updates are arriving after the next monthly security release, and that your patch management tool reports the device as current.
8. Record it in your asset inventory and risk assessment: which devices, why they're on ESU, and the date they'll be replaced.

If you're paying for ESU but never activated it, you're paying for nothing. We regularly find devices where the license was purchased and the key was never installed, or Year 1 was activated but Year 2 wasn't.

Who's most at risk

• Medical and dental practices. Any computer that stores or accesses patient data is in scope for the HIPAA Security Rule. An unpatched operating system is one of the first things an auditor, insurer or investigator will flag.
• Accounting and finance firms. The FTC Safeguards Rule and IRS guidance expect you to keep systems patched.
• Anyone with cyber insurance. Many applications ask whether you run unsupported operating systems. Answering incorrectly can put a claim at risk.

What does Windows 10 mean for HIPAA, the FTC Safeguards Rule and insurance?

No law names Windows 10, but every security framework you're subject to expects you to manage known risks, and an unpatched operating system is about as "known" as risks get. The safest position is to have none, and to document any exceptions carefully.

HIPAA

The HIPAA Security Rule requires covered entities and business associates to conduct an accurate and thorough risk analysis and to implement security measures that reduce risks to a "reasonable and appropriate level" (45 CFR 164.308(a)(1)). It also requires security awareness procedures that include protection from malicious software. A Windows 10 PC without ESU that opens patient charts is a vulnerability you know about and haven't addressed. If it's involved in a breach, that will be hard to defend.

What to do:

1. List every Windows 10 device in your HIPAA security risk assessment.
2. For each, record whether it's on ESU, what data it touches, and what other protections are in place.
3. Set a replacement or upgrade date and track it.
4. Re-check at least annually and whenever something changes.

Our HIPAA Security Rule checklist for small practices walks through the rest of the safeguards.

FTC Safeguards Rule (CPA and tax firms)

The FTC's Safeguards Rule applies to a wide range of non-bank financial institutions; the FTC's guidance specifically lists tax preparation firms. It requires a written information security program based on a risk assessment, with safeguards to control the risks you identify. Unsupported operating systems are an obvious risk to address in that program. Our IT security guide for CPA firms covers the written information security plan (WISP) in detail.

Cyber insurance

Insurance applications commonly ask whether you run end-of-life or unsupported software and how quickly you apply critical patches. Answer accurately. If you have a few ESU-covered machines, they're receiving security updates, but tell your broker about any device that isn't. A misstatement on an application can become a problem during a claim. See our cyber insurance requirements checklist.

A simple plan

1. Make a list

Write down every computer, who uses it, its approximate age, and whether it's on Windows 10 or 11. (Our free Computer Replacement Planner does this for you and builds a budget.)

For each machine, add:

• Make, model and serial number
• Processor and memory
• What it's used for (front desk, operatory, imaging capture, billing)
• Any special software or attached equipment
• Whether it can run Windows 11 (next step)

If your PCs are managed with Intune, much of this is already in a report. If not, it's a good reason to start; our Microsoft Intune guide for small businesses explains how.

2. Check which can upgrade for free

On each Windows 10 PC, go to Settings > Update & Security > Windows Update. If it says the PC can run Windows 11, it can upgrade at no cost. Most business-grade PCs bought from about 2019 onward qualify.

Microsoft's Windows 11 minimum requirements are:

A TPM (Trusted Platform Module) is a security chip that stores encryption keys and helps verify the computer hasn't been tampered with. It's what makes features like BitLocker encryption and Windows Hello sign-in secure. Some PCs have a TPM that's simply switched off in the firmware settings; an IT person can check this quickly.

The free PC Health Check app gives a clear yes or no and tells you which requirement fails.

3. Upgrade the ones that can

Before upgrading, confirm your key software — practice management, imaging, accounting, printers and scanners — supports Windows 11. Upgrade one machine first, test it for a day, then do the rest. Schedule upgrades after hours; each takes about an hour.

The detailed checklist below breaks this down.

4. Replace the ones that can't

PCs that can't run Windows 11 are usually 6+ years old and near the end of their useful life anyway. Prioritise:

1. Front desk and check-in computers
2. Anything that stores or opens patient or client records
3. Computers used for banking, payroll or payments

5. Isolate anything that must stay on Windows 10

If a device has to stay on Windows 10 (often because of attached equipment), enrol it in commercial ESU, keep it off email and web browsing, put it on a separate network segment if possible, make sure endpoint protection is running, and document it in your risk assessment.

We cover how to do that properly further down.

Windows 11 upgrade checklist

Upgrading a working PC to Windows 11 is usually smooth, but a little preparation avoids the "the X-ray software stopped working" morning. Use this checklist for each office.

Before the upgrade

1. Confirm compatibility with PC Health Check or Windows Update.
2. Check software support with every vendor whose software runs on the PC (see the next section).
3. Back up the PC or confirm its data is already in OneDrive or on a server. For PCs with local data, take a full image backup; our backup and disaster recovery guide explains how.
4. Update Windows 10 fully, plus drivers and firmware (BIOS/UEFI) from the PC manufacturer.
5. Check free disk space. The upgrade needs room; clear out old downloads and temporary files if the drive is nearly full.
6. Note special settings: mapped drives, printers, scanner profiles, shortcuts, browser bookmarks if not synced.
7. Confirm license keys and installers for any software that may need reactivation.
8. Make sure BitLocker recovery keys are saved (in Entra ID or Intune for managed devices) before touching firmware settings.
9. Pick a time after hours or on a day the PC isn't needed.

During the upgrade

1. Start with a pilot PC, ideally one that represents a common role (a front desk machine, an operatory PC).
2. Run the upgrade through Windows Update, Intune, or Microsoft's Installation Assistant.
3. Allow about an hour; it may restart several times.

After the upgrade

1. Sign in and check every critical application opens and works: practice management, imaging, e-prescribing, accounting, tax software.
2. Test attached devices: sensors, cameras, signature pads, card readers, label printers, scanners, check scanners.
3. Print and scan a test page.
4. Check security tools: antivirus or EDR reporting in, BitLocker enabled, Intune compliance green.
5. Have the regular user work on it for a day before you roll out further.
6. Upgrade the rest in batches, keeping a list of what's done.
7. Update your inventory and risk assessment.

Windows 11 also has its own version cycle. Each annual Windows 11 Pro release is supported for 24 months, and Enterprise and Education releases for 36 months, according to Microsoft's lifecycle FAQ. Moving to Windows 11 isn't "done forever"; you'll keep installing yearly feature updates, which managed update policies handle automatically.

How do you test compatibility for practice and line-of-business software?

Ask each vendor in writing whether your exact version supports Windows 11, upgrade one representative PC first, and test real workflows with real staff before upgrading the rest. Specialty software is where upgrades go wrong.

Questions to ask each vendor

1. Does our current version support Windows 11? Which Windows 11 versions?
2. If not, which version does, and is the update included in our support plan?
3. Are there known issues, required settings or driver updates?
4. For hardware like X-ray sensors, intraoral cameras, panoramic and CBCT units, lab instruments or signature pads: are Windows 11 drivers available? Do they require a newer acquisition software version?
5. Does the upgrade need a vendor technician, and how far ahead do we book?
6. What's your end-of-support date for our current version?

Software that commonly needs attention

Run a proper pilot

Pick one PC per role and have the person who normally uses it test their real day: check in a patient, take an X-ray, post a payment, print a statement, scan an insurance card, run a report. Write down anything that doesn't work. Fix those issues, then upgrade the rest.

If something fails and the vendor has no fix, you have three choices: update the software, replace the device, or keep that PC on Windows 10 with ESU and isolation as a time-limited exception. Our dental imaging network and computer guide covers imaging workstations in more detail.

Which Windows 11 security features should you turn on?

Moving to Windows 11 is a chance to switch on protections that many offices never enabled on Windows 10. Most of them are built into Windows 11 Pro and managed centrally with Intune, so they cost nothing extra.

• BitLocker drive encryption. Encrypts the whole drive so a lost or stolen laptop doesn't expose patient or client data. Store recovery keys in Entra ID or Intune, not on a sticky note. For HIPAA, encryption of portable devices is one of the most valuable safeguards you can have, because lost encrypted devices are treated very differently from unencrypted ones in breach analysis.
• Windows Hello for Business. Sign in with a PIN or fingerprint tied to that specific device, backed by the TPM. It's phishing-resistant in a way passwords aren't. See our multi-factor authentication guide.
• Microsoft Defender protections. Make sure Defender for Business or your chosen EDR tool is installed, reporting and set to block, not just alert.
• Automatic updates with managed rings. Use Intune or Windows Autopatch to approve monthly updates on a small pilot group first, then everyone else a few days later. Fast enough to be safe, slow enough to catch a bad update.
• Standard user accounts. Staff shouldn't be local administrators on their PCs. It's one of the simplest ways to limit what malware can do. This is least privilege in practice.
• Secure Boot and TPM stay enabled; don't turn them off to make an old peripheral work without talking to your IT provider.

These settings are also exactly what insurers, auditors and client security questionnaires ask about. Our accounting firm case study shows how a consistent, centrally enforced device baseline helped a small firm pass client security reviews.

How do you get staff ready for Windows 11?

Tell staff what's changing, when, and what they need to do; most will adjust within a day. Windows 11 looks different, but it works much the same as Windows 10.

What staff notice first:

1. The Start menu and taskbar are centered by default. They can be moved back to the left if people prefer.
2. Right-click menus are shorter; "Show more options" brings back the full menu.
3. Snap layouts make it easier to arrange windows side by side, which helps front desk and billing staff working across several programs.
4. Settings have moved around. Most people rarely need them.

A short plan:

• Send a two-paragraph email a week before: what's happening, when, and that their files and programs will still be there.
• Upgrade after hours and leave a one-page "what's different" sheet on the desk.
• Have someone available the first morning for quick questions.
• Remind staff that the IT provider's help desk is the place to report anything that doesn't work, rather than living with it.

What should you buy when replacing PCs?

Buy business-class PCs with Windows 11 Pro, at least 16 GB of memory, a solid-state drive, and a multi-year warranty, from a manufacturer's business line rather than a retail consumer model. The extra cost up front pays for itself in reliability and manageability.

Business vs. consumer PCs

Windows 11 Home can be upgraded to Pro for a fee, but you still get a consumer device with a shorter support life and a weaker warranty. For an office, buying business-class with Pro from the start is simpler.

Recommended specifications

These are practical recommendations for a small office in 2026, not Microsoft minimums:

Additional buying tips:

• TPM 2.0 is standard on current business PCs; confirm it's enabled.
• Avoid 8 GB of memory. It works on day one and feels slow by year two.
• Buy a 3-year warranty at minimum, on-site for desktops at critical stations like the front desk.
• Register devices for Windows Autopilot at purchase if you use Intune, so new PCs set themselves up when staff sign in. Our software startup case study shows zero-touch setup in practice.
• Standardize on a few models so drivers, spares and support are simpler.
• Securely wipe or destroy old drives when retiring PCs, and keep a record. For healthcare offices, an old PC's drive is still a container of patient data.

What it costs

A solid business laptop or desktop typically runs $900–$1,500 including Windows 11 Pro and a 3-year warranty. Spreading replacements over three to four years — rather than all at once when they fail — keeps costs predictable.

Imaging workstations and high-end laptops can cost more, especially if the imaging vendor specifies particular hardware. Add setup labor, monitors and docking stations if needed.

How should you budget for PC replacement?

Plan to replace business PCs about every four to five years, and spread the replacements evenly so you buy a few each year instead of all at once. It turns a surprise capital expense into a predictable line item.

Windows 10's end of support caught many offices with a large batch of PCs bought at the same time, all needing replacement in the same year. A replacement cycle prevents that from happening again.

A simple replacement cycle

1. Set a target lifespan. Four to five years is common for desktops; laptops may be three to four, depending on use.
2. Divide your fleet by the lifespan. With 20 PCs on a five-year cycle, you replace about four PCs each year.
3. Budget annually. Four PCs at a typical $900–$1,500 each is a predictable yearly amount.
4. Replace the oldest and most critical first. Front desk, clinical, and anything handling payments.
5. Keep a spare (or two in larger offices), so a failure is a swap, not an emergency.
6. Review each year: warranty expirations, Windows version support, and vendor requirements.

Example: a 12-PC dental office

Imaging acquisition PCs may be on a different schedule tied to the equipment. The Computer Replacement Planner builds a schedule and budget like this from your own inventory, and our managed IT services cost guide explains how hardware fits alongside monthly IT costs.

How do you isolate legacy devices tied to equipment?

Some PCs can't leave Windows 10 because they control an X-ray unit, a lab analyzer or other equipment whose manufacturer hasn't certified a newer system. Keep them patched with ESU if possible, lock them down, isolate them on the network, and plan their retirement.

Microsoft itself notes that its Long-Term Servicing Channel (LTSC) editions are "designed to be used only for specialized devices - for example, those that control medical equipment." If your equipment PC runs an LTSC edition, it isn't covered by the Windows 10 ESU program, but it may still be within its own support period. Check the exact edition and its end date before assuming either way.

Lockdown checklist for an equipment PC

1. Identify the edition and support status. Standard Windows 10 Pro (needs ESU) or LTSC (check its own lifecycle date)?
2. Enroll in ESU if it's standard Windows 10, and verify activation.
3. No email, no web browsing, no personal use. Remove or block browsers where possible. This PC does one job.
4. Separate network segment (VLAN) that can reach only the systems it needs (for example, the imaging server) and not the internet, unless the vendor requires specific connections. Our small office network guide explains how to set this up.
5. Endpoint protection running and reporting, with application control if possible so only approved programs run.
6. No local admin rights for everyday users.
7. Remote access for the vendor only on request, with each session approved and logged; no always-on remote tools with shared passwords.
8. Disable USB storage unless the workflow needs it.
9. Back it up, including an image you can restore if it fails.
10. Document it in your risk assessment: why it can't be upgraded, what protections are in place, and the planned retirement date.
11. Ask the equipment manufacturer for a written statement of their supported operating systems and upgrade path. Some offer upgraded acquisition PCs or software as part of a service plan.

Scenario walk-throughs

Dental office: A practice's panoramic unit's acquisition PC runs Windows 10 Pro, and the manufacturer hasn't released a Windows 11 driver for that model. The practice enrolls the PC in commercial ESU, moves it onto an imaging VLAN that can only reach the imaging server, removes the browser, and sets up vendor remote access that the office manager approves per session. The risk assessment records the exception and a target date tied to the unit's planned replacement. All other operatory PCs move to Windows 11 after a one-day pilot confirms the intraoral sensors work.

Medical office: A family practice has 15 PCs; 11 upgrade for free and 4 are too old. The practice uses a cloud EHR, so testing focuses on the browser, e-prescribing, the signature pad and the label printer. The pilot finds the label printer needs a new driver; once installed, the other 10 upgrade in two evenings. The four old PCs are replaced with business-class desktops that set themselves up through Autopilot and Intune. No ESU is purchased because nothing needs it.

CPA firm: An accounting firm discovers its document management software's older version doesn't support Windows 11. The vendor confirms the current version does, as part of the firm's existing maintenance plan. The firm upgrades the software first, then Windows, scheduling the work for after the October extension deadline to avoid disrupting busy season. One senior partner's laptop is replaced rather than upgraded because it's six years old.

Mistakes we see

Most Windows 10 problems at this stage are about the last few machines, not the first ninety percent. Common mistakes:

1. Assuming "it still works" means "it's fine." Function and security are different things.
2. Buying ESU for every PC instead of upgrading the ones that can upgrade free.
3. Buying ESU and never activating it, or activating Year 1 and forgetting Year 2.
4. Using consumer ESU on business PCs by signing in with someone's personal Microsoft account.
5. Upgrading everything at once without a pilot, and discovering the imaging sensor doesn't work on Monday morning.
6. Replacing with retail consumer PCs running Windows 11 Home.
7. Leaving a legacy PC on the main network with email and web access.
8. Not wiping old drives when PCs are recycled.
9. Not updating the risk assessment or telling the insurer.
10. No replacement cycle, so the same cliff appears again in a few years.

Questions to ask your IT provider

1. How many of our PCs are still on Windows 10, and which ones?
2. Which can upgrade to Windows 11 for free, and when will you do it?
3. Which need replacing, and what do you recommend we buy?
4. Are any of our PCs on ESU? Is it activated for the current year?
5. Which PCs are tied to equipment, and how are they isolated?
6. Have our software and equipment vendors confirmed Windows 11 support in writing?
7. How are BitLocker recovery keys stored?
8. What's our replacement schedule and annual budget going forward?
9. How are old drives wiped or destroyed when PCs are retired?
10. Is our risk assessment updated to reflect any remaining Windows 10 devices?

The bottom line

Windows 10 PCs aren't an emergency the day support ends, but every month they stay in use the risk grows. Get a list together, upgrade what you can for free, replace the rest on a schedule, and document anything that has to stay behind.

A year after end of support, the remaining Windows 10 machines are usually the hardest ones, the equipment PCs and the forgotten front desk computer. Treat them as deliberate, documented exceptions with ESU, isolation and a retirement date, and put a regular replacement cycle in place so this doesn't sneak up on you again.

If you'd like us to check your machines and give you a plan, see our IT services and healthcare IT pages, or book a free 20-minute call.