Windows 10 ESU year two: what small businesses should do now

Windows 10 left support on 14 October 2025, and the first year of paid Extended Security Updates (ESU) for organisations is now running out. If your business still has Windows 10 PCs, you have three realistic choices this month: upgrade the ones that can run Windows 11, replace the ones that cannot, and pay for ESU year two only for machines that genuinely cannot move yet.

The cost argument is simple. Microsoft's published price for commercial ESU is $61 per device for year one, doubling every year, and ESU is cumulative: a device joining in year two pays for year one as well. This article sets out the numbers, the activation steps for year two, and a short plan for the stragglers.

Where things stand in October 2026

• Windows 10 support ended on 14 October 2025. Since then Microsoft provides no feature updates, no quality updates and no technical support for Windows 10, except to devices enrolled in ESU.
• Commercial ESU runs for a maximum of three years after end of support and is bought one year at a time. Microsoft does not sell partial periods such as six months.
• ESU covers critical and important security updates only. It does not include new features, non-security fixes or general technical support.
• Only Windows 10, version 22H2 is eligible. Long-Term Servicing releases (LTSB/LTSC) follow their own lifecycles and are not part of the programme.

Windows 10 PCs keep working without ESU. They simply stop receiving security fixes, which is the problem: every month after that, the list of publicly known, unpatched vulnerabilities on those machines grows.

What ESU costs a small business

Microsoft's ESU page lists $61 per device for year one through volume licensing and states that the price doubles every consecutive year. Applied to the published figure, that gives the following list prices per device (USD, before tax and reseller margins):

For ten PCs, two years of ESU costs $1,830 at list price, which is a large share of the price of new business laptops. When Microsoft announced the pricing in 2024, it also said customers using a cloud-based update management tool such as Intune or Windows Autopatch would get a 25% discount; ask your licensing partner whether that offer applies to your purchase in year two.

The minimum purchase is one licence, so a business can buy ESU for a single machine that runs, say, a piece of lab or accounting software that has not been certified for Windows 11.

When ESU is free

ESU is included at no extra cost for Windows 10 virtual machines in Windows 365, Azure Virtual Desktop, Azure virtual machines and several other Azure-hosted services. Windows 10 PCs used to connect to Windows 365 Cloud PCs are also entitled to ESU for up to three years while the Windows 365 subscription is active. For a business that needs Windows 11 apps but cannot replace hardware immediately, a Cloud PC can be cheaper than it first looks.

The consumer programme is not for business PCs

Microsoft runs a separate consumer ESU that now covers devices until 12 October 2027. It is free if you sync PC settings, or costs 1,000 Microsoft Rewards points or a one-time $30. It is tempting for a two-person company, but Microsoft says the consumer programme cannot be used in commercial scenarios, and it is not offered to devices joined to Active Directory or Microsoft Entra ID, or enrolled in device management. Business PCs should use the organisational programme.

How to activate ESU year two

ESU is activated per device with a Multiple Activation Key (MAK) from the Microsoft 365 admin center. Before you start, each PC needs:

1. Windows 10, version 22H2 with update KB5066791 or later installed.
2. The ESU Licensing Preparation Package KB5072653, installed after KB5066791.
3. An administrator account, and internet access to Microsoft's activation servers.

To find the key, an account with the Product Key Reader or VL Administrator role opens Billing > Your products > Volume licensing, selects View contracts, then View product keys on the contract that holds the ESU licences.

Then, in an elevated Command Prompt on each PC:

rem Install the ESU key from the Microsoft 365 admin center
slmgr.vbs /ipk <ESU MAK>

rem Activate year two (Microsoft's published Activation ID for Win10 ESU Year2)
slmgr.vbs /ato 1043add5-23b1-4afb-9a0f-64343c8f3f8d

rem Verify: look for the ESU program name with "License Status: Licensed"
slmgr.vbs /dlv

The Activation IDs are the same on every eligible device. Year one is f520e45e-7413-4a34-a497-d2765967d094 and year three is 83d49986-add3-41d7-ba33-87c7bfb5c0fb. Devices that cannot reach the internet can be activated by phone with slmgr.vbs /dti and slmgr.vbs /atp, as described in Microsoft's guide.

Is the PC eligible for Windows 11?

Before paying for another year, check every Windows 10 machine against Windows 11's minimum requirements. The ones that commonly block an upgrade are the processor and TPM:

Microsoft's PC Health Check app reports whether a device meets the requirements (it does not check graphics or display). TPM 2.0 and Secure Boot are sometimes present but switched off in firmware settings, so check there before writing a machine off.

A decision plan for the stragglers

Office is not the deciding factor. Microsoft has said Microsoft 365 Apps will keep receiving security updates on Windows 10 until 10 October 2028, but with only basic troubleshooting and no bug fixes or new features specific to Windows 10.

Limitations and gotchas

• ESU is not support. It covers activation, installation and regressions of the ESU itself; other technical support needs a separate Microsoft support plan.
• Keys are per year. Year two needs the year two Activation ID; a PC activated only for year one stops receiving updates when year one coverage ends.
• Reimaging uses activations. If you reinstall PCs, you may need to request more activations for the MAK.
• Unsupported upgrade workarounds are not a plan. Installing Windows 11 on hardware that fails the requirements puts the device outside Microsoft's support terms.
• Prices vary by region and channel. The figures above are Microsoft's published USD list prices at the time of writing; your invoice will reflect local currency, tax and partner pricing.

What to do next

1. List every Windows 10 device, its owner and what it is used for.
2. Run PC Health Check (or your device management report) on each one.
3. Upgrade the eligible machines this month, starting with laptops that leave the office.
4. Price replacements against ESU year two for the rest, and buy ESU only where an app forces it.
5. Put a date on the last Windows 10 machine leaving the business, and review it each quarter.