Windows 10 ESU vs a hardware refresh: the per-device maths for 1,000 PCs

The deadline has already passed, and the clock now runs to October 2027

Microsoft's lifecycle page is unambiguous: Windows 10 reached end of support on 14 October 2025, the current version 22H2 is the final version, and all editions remained in support with monthly security update releases only through that date. The Windows 10 end-of-support page repeats the consequence in plain terms. Microsoft no longer provides software updates, security fixes or technical assistance to Windows 10 PCs, and devices continue to function without receiving them.

That distinction matters to a team deciding this quarter. Nothing switched off. The machines boot, the line-of-business applications run, and the users notice very little on the Monday after the deadline. What changed is the patch supply: newly discovered kernel, driver and platform vulnerabilities no longer receive vendor fixes on an unenrolled device, which is the gap ESU exists to close.

The second date is the one that should drive the budget conversation. Microsoft states that Extended Security Updates keep an eligible Windows 10 PC receiving important security updates until 12 October 2027. That is a fixed ceiling of roughly two years from the end-of-support date, not a renewal a team can keep rolling forward indefinitely.

So the real question is not whether to leave Windows 10. It is whether a given device needs to be carried, patched, to October 2027 or can be replaced before then. Every device in the estate falls on one side of that line, and the answer differs by hardware age rather than by department or by user seniority.

What ESU actually covers, and what it leaves exposed

ESU is a security-only bridge. Microsoft's end-of-support page describes it as the option for a PC that cannot upgrade to Windows 11, keeping the device protected through 12 October 2027. It does not restore feature updates, quality updates or standard technical assistance, because those ended with mainstream support on 14 October 2025.

The application layer has its own, longer runway, and a team should not confuse the two. Microsoft states it will continue providing security updates for Microsoft 365 Apps on Windows 10 for three years after end of support, ending on 10 October 2028. That is more than a year beyond the ESU ceiling, which means an ESU-enrolled device can keep a patched Office while the operating system underneath it stops being patched in October 2027.

The non-subscription Office picture is messier. Microsoft says Office 2021 and Office LTSC 2021 continue to run on Windows 10 but no longer receive support there, while on Windows 11 they are supported through October 2026. Office 2024 and Office LTSC 2024 on Windows 10 continue to run but no longer receive support. A fleet carrying perpetual Office licences therefore inherits a second, separate end-of-support problem that a Windows 11 upgrade solves at the same time.

Eligibility is the gate before any of this is budgeted. Microsoft describes ESU as available on eligible Windows 10 PCs and points to a separate programme page for the terms, and the lifecycle page confirms that 22H2 is the final version. A device sitting on an earlier feature release is not simply a patching question; it is a device that has to be brought to 22H2 before enrolment is even a conversation.

The per-device price Microsoft has not published

Here is the finding that should shape the vendor call: neither Microsoft page supplied for this decision states a per-device ESU price. The lifecycle page carries dates and servicing terms. The end-of-support page describes the programme, its 12 October 2027 end date and its eligibility condition, and publishes no figure. The widely repeated per-device, per-year pricing and the year-on-year escalation are not in these pages, so they are not printed here.

That absence is not a reason to delay. It changes what a procurement lead asks for. The first request to Microsoft or to a licensing partner is the per-device annual ESU rate for the commercial programme, in writing, with the escalation schedule for the second year if one applies. The second is the enrolment mechanism and whether it is bought through the volume licensing agreement or a cloud subscription, because that determines which budget line it lands on.

The third request is the eligibility confirmation for the actual estate. A count of devices that cannot meet the Windows 11 hardware requirements is the number that matters, and Microsoft's own guidance for hardware questions is to check with the PC manufacturer or a local hardware expert on what options are available. That is a per-model exercise, not an estate-wide assumption.

Until those three answers are in hand, any three-year total cost of ownership comparison is built on a number nobody has quoted. The honest position for a finance business partner is that the ESU line is unpriced and the refresh line is not, because hardware has a list price and ESU does not, on the evidence published here.

Settings and terms that change the result

The comparison below sets the two routes against the criteria the October 2025 deadline actually moved: how long the device stays patched, what the vendor still supports, and what the buyer has to confirm before signing. It is deliberately short on prices, because the published pages do not carry them for ESU.

Read the ESU column as a fixed-term contract with a hard end date. Read the refresh column as a capital purchase that resets the support clock to whatever the new device's own lifecycle turns out to be. The two are not symmetrical, and a spreadsheet that treats them as two annual costs side by side will mislead the reader who signs it.

One row deserves attention before the rest: the Microsoft 365 Apps date of 10 October 2028 sits beyond the ESU ceiling of 12 October 2027. A team that enrols in ESU and stops there will still be running an unpatched operating system for the final stretch, with only the productivity suite receiving security updates.

The Office rows carry the same warning. Perpetual Office 2021, LTSC 2021, 2024 and LTSC 2024 installations on Windows 10 continue to run without support, so a device kept alive on ESU accumulates two unsupported layers rather than one.

Where ESU is the cheaper answer, and where it is not

ESU earns its place on devices that are close to the end of their useful life and expensive to replace early. A lab instrument controller, a shop-floor terminal bolted to a machine, a kiosk in a warehouse: hardware whose replacement cost is dominated by the surrounding equipment rather than the PC. Carrying those to October 2027 on a security-only bridge is a defensible use of the programme, provided the per-device rate comes back low enough to beat an early refresh.

It also earns its place where the blocker is application certification rather than hardware. If a line-of-business application has not been certified on Windows 11, ESU buys the time to complete that certification without leaving the estate unpatched. The two-year ceiling is the project deadline, and it is a real one.

It stops earning its place on devices that will still be in service after October 2027. Paying for two years of patches on a laptop that a user will still be carrying in 2029 defers a purchase rather than avoiding it, and the deferral ends on a date Microsoft has already fixed. The same logic applies to any device that cannot be brought to 22H2, because enrolment is not available to it.

The refresh route carries its own unpriced items, and a fair comparison names them. Data migration, application reinstallation, user downtime and the trade-in or recycling of the old device all sit on the refresh side of the ledger, and Microsoft's page points to trade-in and recycling programmes with OEMs and retailers as one way to recover some of that. None of those costs appear as a published figure either.

The decision rule for a 1,000-device estate

Choose ESU for a device if it cannot meet the Windows 11 hardware requirements, is already on 22H2, and will be retired or replaced before 12 October 2027 anyway, because the programme then covers exactly the gap that remains and no more. Choose a hardware refresh for a device if it will still be in service after October 2027 or if it carries a perpetual Office 2021, LTSC 2021, 2024 or LTSC 2024 licence, because the refresh resets both the OS and the application support clock in one purchase. Wait on the budget line until Microsoft or a licensing partner quotes the per-device ESU rate in writing, since no figure on the published pages supports a three-year total cost comparison.

For a 1,000-device estate the practical sequence is to split the fleet by Windows 11 eligibility first, then by planned retirement date, then by Office licence type. The devices that fall out of all three filters are the ESU candidates, and that count, not the full thousand, is what gets priced.

The date to put in the renewal calendar is 12 October 2027. Whatever the per-device rate turns out to be, that is the day the bridge ends and the refresh has to have happened.

What to verify before the signature

Three checks settle the decision. Confirm the Windows 11 eligibility of every device with the PC manufacturer, because Microsoft's own guidance defers hardware questions to them and an estate-wide assumption will be wrong for some models. Confirm that each ESU candidate is on 22H2, since that is the final version and the enrolment condition. Confirm the Office licence type on each device, because a perpetual 2021 or 2024 installation on Windows 10 is already unsupported and ESU does nothing for it.

Then ask for the number. The per-device ESU rate, its second-year treatment and the enrolment route are the three figures that turn this from a policy discussion into a budget line, and none of them appear on the pages Microsoft has published for the programme.