Windows 10 ESU Deadline: Year One Pricing Ends October 13, 2026
Year one of paid Windows 10 Extended Security Updates closes October 13, 2026, and year two roughly doubles the per-device cost. Here's the enrollment math and the decision window for fleets still on Windows 10.
By Uniqcli Team · · 4 min read
Windows 10 reached end of support on October 14, 2025, and organizations that enrolled in Microsoft's paid Extended Security Updates program are now inside a firm calendar deadline: Year 1 ESU coverage runs October 15, 2025 through October 13, 2026, at $61 per device (Managed Solution, 2026). Year 2 coverage begins October 14, 2026 and carries a list price of $122 per device — double the Year 1 rate — according to the same reporting. Fleets still running Windows 10 have roughly three months left to decide whether to renew, skip, or replace before the Year 1 window closes.
The ESU calendar, confirmed
Per Managed Solution's 2026 reporting on Microsoft's enterprise ESU program, the two-year paid structure breaks down as follows: Year 1 runs October 15, 2025 through October 13, 2026 at $61 per device; Year 2 runs October 14, 2026 through October 12, 2027 at $122 per device. The pricing effectively doubles at the Year 1-to-Year-2 transition, and Microsoft has not published a Year 3 enterprise tier in the findings reviewed here.
Skipping Year 1 doesn't skip the bill
One enrollment mechanic buyers frequently miss: organizations that did not purchase Year 1 ESU coverage cannot simply buy into Year 2 at the Year 2 rate. According to Managed Solution's reporting, orgs that skip Year 1 must still purchase it retroactively in order to enroll in Year 2 — meaning a fleet that delayed enrollment doesn't avoid the Year 1 cost, it just defers paying it, and then adds the Year 2 cost on top. For budget planning, that changes the real question from "is Year 2 worth $122/device" to "is $61 (Year 1, retroactive) plus $122 (Year 2) worth it versus replacing the device."
A second deadline: Secure Boot certificates
A separate but related date sits inside the same window. Microsoft's original 2011 Secure Boot certificates begin expiring starting June 2026, per the same Managed Solution reporting. Only devices that are current on ESU-delivered updates avoid Secure Boot validation issues tied to that certificate expiration — meaning a device that has lapsed on ESU enrollment, even briefly, is at elevated risk of hitting Secure Boot problems as the 2011 certificates age out. This raises the cost of any gap in ESU coverage beyond the direct per-device fee.
What this means for fleets still on Windows 10
For buyers weighing renewal against refresh, the math changes at each ESU year boundary. Year 1 at $61/device is the cheapest ESU coverage Microsoft has published in this program; Year 2 at $122/device roughly doubles that cost per device, and the retroactive-purchase rule means procrastination doesn't reduce the eventual bill. Combined with the June 2026 Secure Boot certificate expiration, the October 13, 2026 date functions as a practical checkpoint: decide before it whether specific devices are worth a second year of paid ESU coverage or should be replaced with current-generation hardware instead. The strategic tradeoffs — refresh timing, budget sequencing, which devices to prioritize — are covered in the companion playbook linked below; this post covers the dates and pricing mechanics only.
Year 1 ESU price per device (Managed Solution, 2026)
Year 2 ESU price per device (Managed Solution, 2026)
Year 1 coverage window (Managed Solution, 2026)
Year 2 coverage window (Managed Solution, 2026)
What to do before the window closes
- Confirm which devices in the fleet are currently enrolled in Year 1 ESU and which are not.
- For unenrolled devices still needed past October 13, 2026, budget for the retroactive Year 1 fee plus the Year 2 fee to enroll — not just the Year 2 rate alone.
- Check ESU update currency ahead of the June 2026 Secure Boot certificate expiration window; lapsed devices carry added validation risk.
- For devices nearing end of useful life, compare the two-year ESU cost stack ($61 + $122 per device) against replacement hardware pricing before renewing.
When does Windows 10 Year 1 ESU coverage end?
Year 1 Extended Security Updates coverage runs through October 13, 2026, per Managed Solution's 2026 reporting on Microsoft's ESU program.
How much does Year 2 ESU cost compared to Year 1?
Year 1 is $61 per device; Year 2 is $122 per device — double the Year 1 price, according to the same reporting, covering October 14, 2026 through October 12, 2027.
Can we skip Year 1 and enroll directly in Year 2 at a lower cost?
No. Per the reporting reviewed, organizations that skip Year 1 must still purchase it retroactively before they can enroll in Year 2 — there is no way to bypass the Year 1 fee.
Does ESU enrollment affect anything besides security patches?
Yes. Microsoft's original 2011 Secure Boot certificates begin expiring starting June 2026, and per the reporting, only devices current on ESU-delivered updates avoid Secure Boot validation issues tied to that expiration.
Sources and status
All figures and dates in this post come from a single source: Managed Solution's 2026 reporting on Microsoft's Windows 10 Extended Security Updates program (managedsolution.com), which this post treats as vendor-confirmed per the underlying findings. Covered claims: Windows 10 end of support (October 14, 2025); ESU Year 1 window and price (October 15, 2025–October 13, 2026, $61/device); ESU Year 2 window and price (October 14, 2026–October 12, 2027, $122/device); the retroactive Year 1 purchase requirement for Year 2 enrollment; and the June 2026 start of 2011 Secure Boot certificate expirations with the ESU-currency dependency for avoiding validation issues. No additional sources were used, and no figures beyond these were introduced.
Evaluate refresh vs. ESU renewal for your fleet
Get a quote to compare hardware refresh pricing against continued ESU costs before the October 13, 2026 Year 1 deadline.