Windows 10 ESU Year 2: The October 13, 2026 Cliff

Windows 10 standard support ended on October 14, 2025. Everything since has been the paid Extended Security Updates program, and it is not one program but two with different lifespans. The consumer track was a one-year bridge that expires on October 13, 2026 and, per Microsoft's ESU documentation, is not followed by a further consumer tier — after that date a consumer Windows 10 machine receives no security updates from any paid route, only the ones it already has.

The organizational track runs longer, in annual increments priced per device, and this is the one procurement teams are budgeting. Year 1 covers the twelve months ending October 13, 2026 at $61 per device. Year 2 covers October 14, 2026 through October 12, 2027 at $122 per device. Year 3, reported to double again to roughly $244 per device and to run through October 2028, closes the program; we flag the Year 3 figure as reported rather than something we have confirmed against a current Microsoft price list, and any budget line carrying it should be validated against your own licensing quote.

It matters that these are two programs rather than one schedule with a consumer discount. A mixed estate — organization-managed laptops alongside personally-owned or unmanaged machines that touch the same resources — has a hard stop on one half of it in October and a priced runway on the other. The unmanaged half is the part that quietly becomes a standing exposure, because nothing about it changes on October 14: the machines keep booting, keep opening files, and simply stop receiving patches for vulnerabilities disclosed from that day forward.

The most consequential mechanic in the whole program is the one least reflected in budget spreadsheets. ESU coverage years are cumulative, not à la carte: an organization that did not buy Year 1 cannot enroll in Year 2 at the Year 2 price. It must purchase Year 1 retroactively — for a coverage window that has already elapsed — and then pay Year 2 on top.

Run it per hundred devices. A fleet that enrolled on time paid $6,100 for Year 1 and, if it renews, will pay $12,200 for Year 2: $18,300 across the two years, with patches delivered throughout. A fleet that waited and decides in October 2026 that it needs coverage after all pays the same $18,300 — $6,100 retroactive plus $12,200 — for a single year of forward coverage, having spent the previous twelve months unpatched. 'Wait and see' does not defer the cost. It buys strictly less for exactly the same money.

Carried to the end of the program, the full three-year organizational stack is $61 + $122 + $244 = $427 per device, or $42,700 per hundred machines, using the reported Year 3 figure. That is the number worth putting next to a replacement quote, because it is the honest cost of bridging a device class all the way to the program's end rather than to next October.

An ESU-versus-refresh model has two columns, and only one of them is a published number. The ESU column is fixed and known through 2028. The refresh column is the one that has moved, hard, since most organizations last built the model — which means a crossover calculated in late 2025 or early 2026 against then-current hardware pricing is now describing a comparison that no longer exists.

Memory is the driver. TrendForce's March 31, 2026 guidance called for conventional DRAM contract prices up 58-63% quarter over quarter and NAND up 70-75% quarter over quarter in Q2 2026. Its July 3, 2026 release confirms the surge carried into Q3, guiding DRAM contract prices up a further 13-18% quarter over quarter and NAND up 10-15% from that base and describing the gains as moderating: consumer demand is hitting affordability limits while AI server demand keeps supply tight. Moderating is not reversing. Gartner's full-year 2026 forecast has DRAM up 125% and NAND up 234%, and AI data centers are projected to absorb roughly 70% of high-end DRAM output this year.

For a fleet buyer the practical consequence is narrow and specific: every replacement machine in the model carries memory, and the per-unit figure in the refresh column needs to come from a live quote rather than from last year's spreadsheet. Our companion piece on the DRAM and NAND surge covers the upstream picture in detail. Re-running the crossover with current numbers is a short exercise, and for some device classes it will move the answer in the direction of bridging — which is the opposite of what the escalating ESU schedule alone would suggest, and exactly why the model has to be rebuilt rather than remembered.

Federal buyers have a second calendar layered on the first. Fiscal year 2026 ends September 30, 2026, and October 13 falls thirteen days into FY2027. One-year appropriations generally have to be obligated — a contract or order awarded, not money spent or goods delivered — by September 30 or the authority expires. A decision left until the ESU deadline itself is a decision made with a different year's money.

That compresses the real deadline forward by about six weeks, into the most congested procurement window of the year. Research from the Mercatus Center covering 2003 through 2013 found roughly 16.9% of annual federal contract obligations landing in September alone, against 8.3% for an even monthly spread, with something like 30-40% of annual contract dollars obligating in the fourth quarter and mid-August through September 30 as the heaviest weeks. A requirement that reaches the contracting shop in early September is entering that queue, not skipping it.

The workable sequence is to finish the fleet audit in August, get the licensing and hardware priced together while there is still room to ask questions, and place the award with time against the September 30 obligation date rather than against the October 13 coverage date. Extended Security Updates are a licensing line — sourced through authorized US distribution, never held on a shelf — so the lead time on that half is paperwork rather than logistics; the replacement hardware half is where lead time is real and where the memory market has made it less predictable than it was.

A single organization-wide answer to 'ESU or refresh' will be wrong for most of the machines it is applied to. The four buckets from our refresh playbook still do the work: upgrade in place, upgrade after a firmware change, bridge with ESU, or replace. The Windows 11 baseline decides which bucket a machine lands in — TPM 2.0, a supported 64-bit processor, and Secure Boot — and the second bucket exists because TPM 2.0 is frequently present on business-class hardware but disabled in firmware, so 'no TPM detected' is often a settings problem rather than a hardware wall.

The bridge bucket should stay small and specific: a machine pinned to an application with a defined validation timeline, a site with a scheduled refresh already funded for the following cycle, a device class with genuine remaining service life. Everything else belongs in the upgrade or replace queues. And each ESU renewal is worth pairing with a funded refresh commitment for the same device class, because a renewal made without one tends to become the next renewal by default — which is the behaviour the doubling schedule is designed to punish.

Sequencing beats speed once the buckets are counted. Internet-facing and privileged-user machines move first; standard endpoints refresh in waves that imaging capacity can absorb; the outgoing fleet goes through certified data sanitization and chain-of-custody disposition in parallel rather than piling up as data-bearing inventory. Uniqcli quotes the licensing, the replacement hardware and the deployment, imaging, staging and disposition work on one document, sourced through authorized US distribution, with TAA country-of-origin and NDAA §889 screening performed on incoming hardware before the quote.

Windows 10 standard support ended October 14, 2025; consumer ESU ends October 13, 2026 with no further consumer tier; organizational ESU Year 1 $61 per device through October 13, 2026, Year 2 $122 per device October 14, 2026 through October 12, 2027, and Year 2 enrollment requires retroactive purchase of Year 1: source Microsoft's Extended Security Updates documentation, widely reported — treated as vendor-confirmed. Year 3 doubling again to roughly $244 per device and running through October 2028: reported, not confirmed here against a current Microsoft price list — validate against your own licensing quote before it enters a budget. Windows 11 system requirements (TPM 2.0, supported 64-bit processor, Secure Boot): Microsoft, vendor-confirmed. DRAM contract prices +58-63% quarter over quarter and NAND +70-75% in Q2 2026, and Q3 2026 guidance of DRAM +13-18% and NAND +10-15% with gains moderating as consumer demand meets affordability limits while AI server demand keeps supply tight: TrendForce, Q2 figures from guidance published March 31, 2026 and Q3 figures from the release published July 3, 2026 — reported (guidance, not a closed-quarter actual). Full-year 2026 forecasts of DRAM +125% and NAND +234%, and AI data centers consuming roughly 70% of high-end DRAM in 2026: Gartner — reported (analyst forecast). Federal fiscal year 2026 ending September 30, 2026 and the obligation requirement for one-year appropriations: statutory. Approximately 16.9% of annual federal contract obligations landing in September against an 8.3% even spread, with roughly 30-40% of annual contract dollars obligating in the fourth quarter: Mercatus Center research covering 2003-2013 — reported (academic study, historical period).