The Windows 10 End of Life Refresh Playbook

End of support is a specific technical state, not marketing language. Once a Windows version reaches end of life, the vendor stops shipping security updates, quality fixes, and technical support. The machine keeps booting and running your applications — nothing switches off — which is exactly why the risk is easy to underestimate. The danger is silent and cumulative: every vulnerability disclosed after the cutoff stays open on that build permanently, and attackers actively scan for unsupported systems precisely because they know the patches will never arrive.

For regulated and enterprise environments, an unsupported OS also collides with your own controls. Frameworks and internal policy generally require that production systems receive vendor security patches — which an end-of-life build cannot meet by definition — so auditors flag those endpoints, and attestations or coverage can be at risk long before a breach. Treat the end-of-support date as the hard boundary and work backwards: every machine needs to reach one of three states before that line — migrated to a supported OS, covered by a paid extended-update bridge, or fully decommissioned.

Extended Security Updates (ESU) are the vendor's paid mechanism to keep receiving critical and important security patches on an out-of-support OS for a limited window past end of life. ESU is genuinely useful, but it is a bridge — a runway to buy time for machines you cannot migrate on day one, not a place to park a fleet indefinitely. It delivers security patches only: no new features, and no change to the hardware constraints that may be the real reason a machine can't move.

The cost structure is what buyers most often misjudge. ESU is typically priced per device and, by design, escalates each year it is renewed — the second year costs more than the first, the third more than the second — making standing still progressively more expensive than moving forward. Across a large fleet and several years, that cumulative cost can rival or exceed the capital cost of refreshing sooner. So use ESU surgically: bridge only the machines that genuinely cannot migrate in time — one pinned to a certified application, one mid-contract, a site awaiting a scheduled refresh — for the shortest window that clears the constraint, and model the full escalating cost before assuming the bridge beats the buy.

The published figures put numbers on that escalation. Organizational ESU is $61 per device for Year 1, the twelve months ending October 13, 2026, and $122 per device for Year 2, covering October 14, 2026 through October 12, 2027 — exactly double. Year 3 is reported to double again to roughly $244 per device through October 2028, which would make the full three-year stack $427 per device; validate that Year 3 figure against a current licensing quote before it enters a budget. The consumer track is shorter still and simply ends on October 13, 2026, with no paid successor described in Microsoft's ESU documentation.

One enrollment mechanic changes the arithmetic more than the escalation itself: coverage years are cumulative, so Year 2 cannot be bought on its own. An organization that skipped Year 1 must purchase it retroactively — for a window that has already elapsed — before it can enroll in Year 2, making the real entry cost $61 + $122 = $183 per device, or $18,300 for a hundred machines. Because that equals what an on-time enroller pays across both years, deferring the decision does not defer the bill; it removes twelve months of patching from what the same money buys. Our companion pieces on the October 13, 2026 cliff and on ESU cost, both linked below, work the per-fleet math through in full.

The reason a Windows 10 end-of-life event forces a hardware conversation, not just a software reinstall, is the baseline of the successor OS. Windows 11 requires TPM 2.0 — a Trusted Platform Module, version 2.0 — alongside a compatible 64-bit processor, Secure Boot, and minimum memory and storage. A TPM is a dedicated hardware security component, a discrete chip or processor firmware, that stores cryptographic keys in a tamper-resistant boundary separate from general system memory — underpinning disk-encryption key protection, secure boot measurement, and hardware-backed device identity. Version 2.0 is the floor the new OS enforces.

TPM 2.0 is the piece that most often blocks an in-place upgrade — but many business-class machines already ship with it simply disabled in firmware, so 'no TPM detected' is sometimes a settings problem, not a hardware wall. That distinction shapes your audit: some machines pass outright, some pass only after enabling the TPM and Secure Boot, and some — typically older processors that predate the supported CPU list — cannot meet the baseline at all and must be replaced. You cannot know the mix until you inventory it, which is why the audit comes before any purchasing decision.

Every well-run refresh starts with a fleet audit, not a purchase order. Inventory each endpoint against the successor OS requirements — processor eligibility, TPM 2.0 presence and state, Secure Boot, memory, and storage — and sort the results into clear buckets: upgrade in place, upgrade after a firmware change, bridge with ESU temporarily, or replace. That turns a vague 'we need to refresh everything' into a costed, prioritized count of how many machines fall into each category — the document the whole budget and schedule hang on.

Sequence replacements by risk, not convenience: internet-facing and privileged-user machines move first, machines pinned to a slow-to-validate application are the natural ESU candidates, and standard endpoints refresh in scheduled waves your imaging capacity can absorb. Sourcing at fleet scale is its own workstream, and where a value-added reseller earns its keep — consistent configurations per wave, imaging and staging before units reach the desk, TAA country-of-origin and NDAA §889 screening on incoming hardware, and coordinated multi-site delivery — so replacements arrive configured, screened, and ready to deploy rather than as bare boxes that create a second project on the receiving dock.

The machines you replace do not simply disappear, and how you retire them matters for both security and value recovery. IT asset disposition (ITAD) is the disciplined end-of-life process: certified data sanitization or drive destruction, chain-of-custody documentation, environmentally responsible recycling, and — where units retain residual value — trade-in or buyback that offsets part of the new-fleet cost. Plan retirement as a parallel track to procurement so decommissioned units flow out as replacements flow in, rather than piling up as an unmanaged storeroom of data-bearing risk.

Timing ties the plan together, because a refresh does not happen in a pricing vacuum. Hardware costs move over the year, and the 2026 increases are no longer scheduled — they have landed. TrendForce reported conventional DRAM contract prices up 58-63% quarter over quarter and NAND up 70-75% in Q2 2026, and in guidance published July 3, 2026 projected a further 13-18% for DRAM and 10-15% for NAND in Q3, describing the gains as moderating rather than reversing while AI server demand keeps supply tight. Gartner's full-year 2026 forecast has DRAM up 125% and NAND up 234%. Every replacement machine carries memory, so a crossover model built against 2025 hardware pricing is describing a comparison that no longer exists — see our note on the DRAM and NAND surge, and on how to beat the 2026 summer price increase. A large-quantity buy amplifies even a small per-unit swing, so audit early, use ESU only where it is genuinely needed, and price the replacement side from a live quote — turning Windows 10 end of life into a planned, budgeted refresh instead of a scramble against the clock.