Tomorrow, October 13th, is the last day of Year 1 coverage under Microsoft's Windows 10 Extended Security Updates program. Starting October 14, any commercial Windows 10 device without a Year 2 ESU license stops receiving security patches entirely — not after a grace period, immediately (O365HQ, 2026). If your business hasn't already confirmed which devices are covered, this is the week to find out.
What Actually Changes?
Any Windows 10 device without an active Year 2 ESU license receives no further security updates from Microsoft as of October 14 — the operating system keeps running, but every vulnerability discovered from this point forward stays permanently unpatched on that machine. Microsoft 365 Apps will continue getting their own security updates on Windows 10 through October 2028, but that doesn't protect the underlying operating system itself, which is where most serious exploits actually land.
Can a Business Still Enroll in ESU Year 2 Today?
Yes, but not instantly. Enrollment requires the device to already be on Windows 10 version 22H2 with the current cumulative update and the ESU licensing preparation package installed — a prerequisite that itself takes a full patch cycle to complete, meaning a device that isn't already current can't be licensed and compliant on the same day (O365HQ, 2026). Year 2 licenses are sold per device, per year, through a Cloud Solution Provider partner or volume licensing, and because ESU years are cumulative, a device that skipped Year 1 coverage has to be licensed for both years before it's current.
What Should Happen to Devices That Won't Be Licensed in Time?
Devices that won't make it into ESU coverage before tomorrow should be treated as unpatched starting immediately — removing local admin rights, using conditional access to block email and VPN access from those machines, and setting a firm exit date for replacement or upgrade, rather than leaving them on the network with the same access they had yesterday (O365HQ, 2026). An unpatched Windows 10 machine isn't necessarily an immediate problem, but it should never be treated as business-as-usual once its patch stream has actually stopped.
What's a Reasonable Timeline From Here?
A practical response this week looks like: finish a full device inventory within the next few days, order and activate Year 2 ESU licenses for any device that genuinely must stay on Windows 10 a while longer, and apply the containment steps above to everything else by the end of the month. The goal isn't to panic over every unlicensed device today — it's to make sure none of them sit unaccounted for while the decision gets made.
Frequently Asked Questions
Is there a grace period after October 13 for Windows 10 ESU Year 1?
No. Coverage ends at the close of October 13, 2026, and unlicensed commercial devices stop receiving security updates the next day with no buffer period described in Microsoft's program.
Can I still buy Windows 10 ESU after tomorrow?
Yes, Year 2 licensing remains available through a Cloud Solution Provider or volume licensing, but the device must already be current on required updates before it can be licensed, and devices that skipped Year 1 need both years purchased.
Do Windows 10 devices stop working entirely without ESU?
No. The device keeps functioning normally, but the operating system stops receiving security patches, so newly discovered vulnerabilities remain permanently open on that machine until it's licensed or upgraded.
What should we do with Windows 10 devices we can't license by this week?
Treat them as unpatched immediately: restrict local admin rights, block email and VPN access through conditional access policies, and set a concrete replacement or upgrade date rather than leaving them with normal network access.