The free Windows 10 Extension Doesn’t Cover Your Clients
Welcome to the first post on OpStacks. Each week I’ll cover the patches, deadlines and tools that sysadmins, security engineers and MSPs have to deal with, with a checklist you can use the same day.
In June, Microsoft extended free Windows 10 security updates for another year, and the headlines ran with it. If you manage Windows machines for a business, there’s a good chance someone has already forwarded you one of those articles with the same question attached, “so we’re good on Windows 10 until 2027, right?”
For any machine that’s managed like a business device, the answer is no. Those devices are on the paid program, Year 2 costs twice what Year 1 did, and it comes due in October.
What Microsoft actually extended
The June extension applies to the consumer ESU program only. Personal Windows 10 PCs can now get security updates through October 12, 2027, and enrollment is free if you sync PC settings to a Microsoft account. The other options are 1,000 Microsoft Rewards points or a one-time $30 payment, and one license covers up to 10 devices.
Microsoft’s own consumer ESU page lists the devices that can’t use it:
Domain-joined devices — anything joined to an Active Directory domain
Entra-joined or MDM-enrolled devices — anything joined to Microsoft Entra, or enrolled in Intune or another MDM
Kiosk devices — machines running in kiosk mode
There’s one gray area worth knowing about. A personally owned PC that’s only Entra registered, meaning someone added a work account to their own machine, can still qualify. However, if a consumer-enrolled PC later gets joined or enrolled by a business, Microsoft suspends its consumer ESU enrollment automatically.
So if you or your clients manage the device, the free extension doesn’t apply to it.
What business devices pay for Year 2
Commercial ESU is sold through Microsoft Volume Licensing, and Microsoft doubles the price every year for up to three years.
Year 1 — Oct 2025 to Oct 2026 — $61 per device
Year 2 — Oct 2026 to Oct 2027 — $122 per device
Year 3 — Oct 2027 to Oct 2028 — $244 per device
A few rules catch people off guard:
It’s cumulative — if a device skipped Year 1, you pay for Year 1 and Year 2 to get it covered now, which is $183 per device
No partial years — you buy a full year or nothing, and the minimum purchase is one license
22H2 only — devices have to be on Windows 10 version 22H2 with the ESU prerequisite updates installed
LTSC isn’t included — Windows 10 LTSB and LTSC editions follow their own lifecycle and aren’t part of this program
To put numbers on it, a client with 40 Windows 10 PCs that renews all of them for Year 2 pays $4,880. If that same client skipped Year 1, the bill is $7,320.
Year 2 is also licensed and activated separately from Year 1, with its own activation ID. Once you have the Year 2 key from the Microsoft 365 admin center, activation from an elevated command prompt looks like this:
slmgr.vbs /ipk <Year 2 ESU MAK>slmgr.vbs /ato 1043add5-23b1-4afb-9a0f-64343c8f3f8dslmgr.vbs /dlvThe last command should show the Win10 ESU Year 2 program with a license status of Licensed. A device that only shows Year 1 isn’t covered once Year 2 starts.
The four ways out
Every Windows 10 device in a business ends up in one of four buckets. The goal is to put each machine in a bucket on purpose, so nothing gets renewed just because nobody looked at it.
Upgrade what can upgrade — plenty of Windows 10 machines already meet the Windows 11 hardware requirements and just haven’t been moved. An in-place upgrade through Intune, Windows Autopatch or your RMM costs you time and no license fees.
Renew named devices only — pay for Year 2 on specific machines that have a reason to stay on Windows 10, like a line-of-business app or a piece of lab equipment, and give each one an exit date. A blanket renewal turns into a yearly bill that keeps doubling.
Replace the hardware — for machines that can’t run Windows 11. PC prices are still elevated because of memory shortages, so get quotes and order early instead of waiting until the renewal forces your hand.
Move to the cloud — Windows 10 virtual machines in Windows 365, Azure Virtual Desktop and Azure VMs get ESU at no extra cost. Windows 10 PCs that connect to Windows 365 Cloud PCs also get up to three years of ESU with an active Windows 365 subscription.
Your checklist before October
Year 1 coverage ends in October 2026, so any business device without Year 2 stops getting security fixes after that. Work through this list now.
1) Inventory every Windows 10 device. In Active Directory, this pulls the list with version numbers:
Get-ADComputer -Filter ‘OperatingSystem -like “Windows 10*”’ -Properties OperatingSystem, OperatingSystemVersion | Select-Object Name, OperatingSystemVersionIn Intune, filter your Windows devices by OS version 10.0.19045, which is 22H2.
2) Check how each questionable device is joined. Run dsregcmd /status and look at the Device State section. If AzureAdJoined or DomainJoined says YES, the free consumer extension is off the table. If only WorkplaceJoined says YES, the PC is just registered.
3) Confirm the ESU prerequisites. Devices need 22H2 (build 19045) with KB5066791 or a later update installed, then the ESU licensing preparation package KB5072653.
4) Check Windows 11 eligibility. Use PC Health Check or your RMM’s hardware inventory to split upgradable machines from the ones that need replacing.
5) Put every device in one of the four buckets and price Year 2 only for what’s left in the renew bucket.
6) Verify what you’ve already enrolled. Run slmgr.vbs /dlv on a sample of Year 1 devices, so you know which ones still need the Year 2 key.
What to tell your clients
Keep it short and bring the plan with you. Something like this works:
The free Windows 10 extension in the news is for personal PCs. Your company’s computers are managed, so they don’t qualify. Paid security updates for Year 2 are $122 per PC, or $183 if a PC wasn’t covered in Year 1. Here’s our plan for each machine, and most of them can move to Windows 11 without a license cost.
That conversation goes a lot better in September than it does the week after a PC stops getting patches.
If you’re working through this for your own fleet or your clients and run into something this post didn’t cover, let me know at opstacks@outlook.com.
Sources
Microsoft Learn: Extended Security Updates (ESU) program for Windows 10
Microsoft Learn: Enable Windows 10 Extended Security Updates for physical machines
Tom’s Hardware: Microsoft extends free Windows 10 security updates for a second year
Tiago S. Carvalho: Windows 10 ESU Year 2, renew, migrate or retire?