Windows 10 Extended Security Updates Cost

Windows 10 standard support ended on October 14, 2025. Everything after that date is the paid Extended Security Updates program, priced per device per coverage year and delivering security updates only — no feature updates, no quality fixes beyond security, and no change to the hardware constraints that may be the reason a machine cannot move in the first place.

Year 1 covers October 14, 2025 through October 13, 2026 at $61 per device. Year 2 covers October 14, 2026 through October 12, 2027 at $122 per device — exactly double. Year 3 is reported to double once more, to roughly $244 per device, running through October 2028; treat that figure as reported rather than confirmed and validate it against a current licensing quote before it enters a budget line. The full three-year stack at those figures is $427 per device, or $42,700 for a hundred machines.

The doubling is deliberate rather than incidental. The program is designed to be a tolerable one-year cost, an uncomfortable two-year one, and an obviously bad three-year one, so that the cheapest path through it is the one that ends soonest. The budgeting error that follows from missing this is modelling ESU as a flat annual line item — the same number every cycle — which makes a Year 3 renewal look defensible right up to the moment someone adds the three years together.

The rule most often missed in planning is that Year 2 cannot be purchased on its own. An organization that skipped Year 1 must buy it retroactively — paying for coverage over a period that has already passed — before it can enroll in Year 2. There is no route into the program at the current year's price alone.

The arithmetic per hundred devices makes the point. A fleet that enrolled on time paid $6,100 for Year 1 and pays $12,200 for Year 2: $18,300 across two years, patched throughout. A fleet that waited and enrolls in October 2026 pays $6,100 retroactively plus $12,200 for Year 2: the same $18,300, for one year of forward coverage, having spent the previous twelve months receiving no security updates at all.

The planning consequence is that 'decide later' is not a cost-avoidance strategy for any device that will still be running Windows 10 after the deadline. It is only a real option for devices that will be retired or migrated before coverage is needed — which is a scheduling decision that has to be made and funded, not assumed.

The consumer program is a separate track on its own clock, and it is not the one-year bridge it was first announced as. Microsoft's consumer ESU page now states that enrollment stays open until the program ends on October 12, 2027, and that all three enrollment routes carry coverage to that same date: at no additional cost when PC settings are synced, for 1,000 Microsoft Rewards points, or as a one-time $30 purchase. One consumer license covers up to ten devices.

For an organization this matters mainly at the edges of the estate: personally-owned laptops that reach corporate resources, contractor machines, home-office devices that were never enrolled in management, and small-site equipment bought outside the standard procurement path. Those devices do not appear on an organizational ESU invoice and will not be caught by a licensing review, which is exactly why they are the ones still running unpatched in November.

Treat that half of the estate as an access-policy question rather than a licensing one. The consumer route patches a machine; it does not manage it, report on it, or bring it inside the controls the organization is assessed against — and it stops entirely on October 12, 2027. The decision available for an unmanaged device is whether it keeps its access, gets migrated, or gets replaced.

Organizational ESU is bought as a licensing item through the usual volume-licensing or cloud-solution-provider routes rather than as a per-machine consumer purchase, and the path chosen carries its own terms and device-management prerequisites. Confirm eligibility and the enrollment mechanics before budgeting a renewal, because the requirements are not identical across paths and an assumption made in a spreadsheet is not an entitlement.

Continuity is the operational detail worth protecting. A gap between coverage years leaves a device unsupported and unpatched during the lapse — an exposure with no ESU price attached to it, because there is no ESU coverage in force. Renewals are therefore worth aligning to the coverage year boundaries rather than to whatever the local purchasing calendar happens to be.

Because ESU is licensing, it is sourced through US distribution rather than held in stock, and it can be quoted on the same document as the hardware and services it sits alongside — replacement endpoints for the devices that fail the crossover, and the imaging, staging, deployment and certified disposition work that a refresh wave actually requires. Uniqcli does not publish licensing prices on this page; the current program terms and the specific figures are confirmed on the quote on the day it is issued.

ESU is the cheaper answer when a device has genuine remaining service life, when it is pinned to an application or contract with a defined end date, and when the bridge is short — one year, occasionally two. It is the wrong answer for a device already on a refresh schedule, for a low-value endpoint where a replacement costs less than a couple of years of coverage, and for anything handling regulated data where 'patched but out of support' is not a posture the organization's obligations will accept at any price.

Build the crossover at the device-class level rather than fleet-wide. Standard office laptops, mobile workstations, fixed-function kiosks and field units carry different replacement costs and different tolerances, so a single organization-wide ESU-versus-refresh number will be wrong for most of the machines it is applied to. And run each class against the full remaining program, not just the coming year — a device that clears the threshold for Year 2 but would fail it in Year 3 needs its refresh funded now rather than deferred into a budget cycle that will inherit a doubled fee.

One input has changed enough to require rebuilding a model that was sound six months ago. The ESU column is published and fixed; the replacement column is not. TrendForce's March 31, 2026 guidance called for conventional DRAM contract prices up 58-63% quarter over quarter and NAND up 70-75% in Q2 2026, and its July 3, 2026 release confirms the surge carried into Q3 at a further 13-18% on DRAM and 10-15% on NAND — moderating, but still rising, as AI server demand keeps supply tight. Gartner's full-year 2026 forecast has DRAM up 125% and NAND up 234%. Every replacement machine carries memory, so the refresh figure in any current model needs to come from a live quote rather than from a 2025 price.

Whether ESU is even the relevant question for a given machine depends on the successor operating system's baseline. Windows 11 requires TPM 2.0, a supported 64-bit processor, and Secure Boot, alongside minimum memory and storage. A machine that meets all of that can be migrated and never needs an ESU line at all; a machine that cannot is either bridged or replaced.

TPM 2.0 is the most common blocker on paper and the most commonly misread one in practice. A great many business-class machines already have a TPM 2.0 module that is simply disabled in firmware, so a 'no TPM detected' result from an inventory sweep is often a settings problem rather than a hardware wall. Checking that before writing a device off is the single highest-return step in a Windows 10 audit, because it moves machines out of the buy column at no hardware cost.

That yields four buckets rather than two: upgrade in place, upgrade after a firmware change, bridge with ESU, or replace. Counting them is what turns an open-ended 'we need to refresh everything' into a costed decision — and it is the document that the ESU budget, the hardware quote and the deployment schedule all hang from.