Windows 10 After October 2026: ESU Year 2, the 2027 Consumer Extension and What UAE Businesses Should Do Now

Where Windows 10 stands on 17 October 2026

Windows 10 left Microsoft’s support on 14 October 2025. Business PCs that still run it now need Year 2 of Microsoft’s paid Extended Security Updates (ESU) to keep receiving security fixes: Year 1 ended on 13 October 2026, Year 2 runs to 12 October 2027, and Year 3, the last, ends on 10 October 2028. A PC that joins now pays for Year 1 and Year 2 together.

The dates come from Microsoft’s lifecycle FAQ on Extended Security Updates, which lists the end of each ESU year, and the price from its Windows 10 ESU programme page. What confuses many searches, and many AI answers, is a second timetable. In June 2026 Microsoft extended its free consumer ESU to 12 October 2027, so pages written before then still say Windows 10 updates end in October 2026. Both statements were true for someone; only the commercial timetable applies to a company PC.

In practice, a UAE company still running Windows 10 has at most two more years of paid security updates, and each year costs twice the one before. The rest of this guide covers what ESU costs and covers, how to decide PC by PC, and the four steps that close the Windows 10 chapter: inventory, upgrade, replace and retire.

Business ESU and the consumer extension are separate programmes

Microsoft runs Windows 10 ESU as separate offers with different prices, dates and rules. For a company, the commercial programme is the one to plan on.

The consumer extension is the source of most of the confusion. Microsoft added the extra year on 25 June 2026 through an editor’s note on a Windows blog post and an edit to its consumer ESU page, not a press release, as BleepingComputer reported. The same consumer page states that “The consumer ESU program can’t be used in commercial scenarios”, and it lists the kinds of device to which enrolment is not offered. For PCs a company owns and manages, budget for the commercial programme, and treat the consumer offer as something staff may use on their own home computers.

Education customers follow the commercial rules at a lower price: the yearly dates and the rule that Year 2 needs Year 1 are the same. Schools planning a wider device refresh can start with our school device management guide.

What ESU Year 2 costs a UAE business

Microsoft’s list price for commercial ESU is US$61 per PC for Year 1, and in its words “the price doubles every consecutive year, for a maximum of three years”, so Year 2 is US$122 and Year 3 is US$244. ESU is cumulative: Microsoft’s lifecycle FAQ says Year 2 can only be acquired by customers who have also acquired Year 1. A PC that joins in October 2026 therefore costs US$183 at list price to be covered until 12 October 2027, about AED 672 at the dirham’s fixed rate of 3.6725 to the US dollar.

The same arithmetic across a fleet

Three things change the real number. First, these are Microsoft’s published list prices: the price on an invoice depends on the purchase route and, in some cases, on how the PCs are managed, so confirm the price on your quotation. Second, VAT at 5 percent is added in the UAE. Third, ESU cannot be bought for part of a year. Microsoft says customers “can’t buy partial periods”, and Year 2 coverage ends on 12 October 2027 whenever it is bought, so a PC due for replacement in March 2027 still needs a full Year 1 and Year 2 to be covered until then.

What ESU covers, and what it leaves out

ESU delivers critical and important security updates, as rated by the Microsoft Security Response Center, to PCs running Windows 10 version 22H2. It is security only. Microsoft’s ESU page rules out new features, customer-requested non-security updates and design change requests, and its lifecycle FAQ describes ESU as “a last resort paid option” and “a temporary bridge” to a supported platform.

• Version 22H2 only. A PC on an earlier Windows 10 version has to move to 22H2 first. Microsoft’s activation guide (updated 21 April 2026) also requires cumulative update KB5066791 or later, followed by the ESU Licensing Preparation Package, KB5072653.
• No technical support for Windows itself. Microsoft supports the ESU licence activation, its installation and any regression the updates cause, and only for organisations with an active Microsoft support plan.
• LTSC editions are not covered. Microsoft says Windows 10 Long Term Servicing releases have their own lifecycles and are not covered by ESU. Support for Windows 10 Enterprise LTSC 2021 ends in January 2027 and for Enterprise LTSC 2019 in January 2029, IoT Enterprise LTSC 2021 runs to January 2032, and the 2016 LTSB ended in October 2026.
• PCs keep working without it. Microsoft says Windows 10 PCs continue to work without ESU. They simply stop receiving security fixes, which is the risk ESU exists to cover.

Microsoft 365 Apps and OneDrive on Windows 10

Office apps follow their own timetable. Microsoft’s page on Windows 10 and Microsoft 365 Apps (updated 27 July 2026) says Windows 10 devices get feature updates and Copilot support (where eligible) until Version 2608 is released, then stay on Version 2608 with security updates only until 10 October 2028. Version 2608 reached Current Channel on 19 August 2026 and Monthly Enterprise Channel on 8 September 2026, according to Microsoft’s update history, so Windows 10 PCs have already reached that point. The OneDrive desktop app on Windows 10 22H2 is updated until the same date. Support narrows, though: if a problem occurs only on Windows 10 and not on Windows 11, Microsoft’s support will ask the customer to move to Windows 11.

So Word, Excel and Outlook keep receiving security updates on Windows 10, with or without ESU, but their users get no new features or Copilot support beyond Version 2608. Teams that depend on new Microsoft 365 features are a reason to move those users to Windows 11 first.

Upgrade, replace, ESU or a cloud PC: deciding PC by PC

Make the decision per PC, from two facts about each one: does it pass Windows 11’s hardware check, and does everything it runs work on Windows 11? Most fleets split three ways: PCs to upgrade in place, PCs to replace, and a smaller group that needs ESU while something else is sorted out.

Record the result against each PC in your asset inventory: upgrade, replace or ESU, and for every ESU PC the date it leaves Windows 10. That one column is what keeps ESU a bridge rather than an operating system you pay twice as much for each year.

Step 1: find every Windows 10 PC and test it for Windows 11

Start with a complete list of Windows 10 PCs, with the version, edition and model of each, and a Windows 11 hardware result for every one. Microsoft’s Windows 11 specifications set the minimum:

• Processor: 1 GHz or faster with 2 or more cores, on a compatible 64-bit processor or system on a chip
• Memory and storage: 4 GB of RAM and a storage device of 64 GB or larger
• Firmware: UEFI, Secure Boot capable
• Security chip: Trusted Platform Module (TPM) version 2.0
• Graphics and display: DirectX 12 or later with a WDDM 2.0 driver, and a 720p display larger than 9 inches diagonally

For a single PC, Microsoft’s PC Health Check app gives the answer, though Microsoft notes that it does not check the graphics card or display. Across a fleet, use your device-management tool. FileWave’s knowledge base publishes a Windows 11 readiness recipe built on Microsoft’s Hardware Readiness PowerShell script:

• Simple method. A Custom Field runs an altered version of Microsoft’s script and returns Pass or Fail (NA until it has run), without the reasons.
• Advanced method. A Fileset runs the full check once on each PC, keeps the detailed result in a local log and writes Pass or Fail to an administrator Custom Field. It needs the FileWave server name and an administrator application token, and each PC must reach the server on port 443 to report back.
• Refreshing a result. After a hardware or firmware change, reinstalling the Fileset updates the value.
• One caution. Where the server uses a self-signed certificate, the recipe has you edit the script so that it accepts any certificate, which switches off certificate checking. Weigh that trade-off before using it.

An inventory report filtered on Fail then lists every PC to replace or to look at more closely, because a Fail can come from a firmware setting, such as the TPM switched off or the PC booting in legacy BIOS (CSM) mode instead of UEFI, rather than from missing hardware. Our guide to tracking company devices and installed software covers building that inventory and how current each field is.

Hardware is only half the check. For each department, list the applications, plug-ins, printers, scanners and card readers in daily use, and confirm that each supplier supports Windows 11. PCs that pass on hardware but fail on software are the real ESU candidates.

Step 2: upgrade the PCs that pass, and activate ESU on the rest

Upgrade in waves, starting with a pilot group that covers each department’s applications and devices. FileWave’s readiness article suggests running the requirement check inside a Windows 11 upgrade Fileset, so that a PC upgrades only once it passes. It also cautions that requirement scripts should only be used where they will eventually return true, so keep PCs that fail out of that deployment rather than leaving them to retry.

For the waves themselves, FileWave applies Microsoft’s update policy to PCs enrolled through Windows MDM, offers a rule-based Windows patch policy from FileWave 16.2, and reports Windows update status every hour. Branch offices on slower links can use FileWave Boosters, which cache Microsoft updates for Windows as well as software packages, so each large download crosses the link once. Our remote software deployment guide covers pilots, success criteria and roll-back.

Activating ESU on the PCs that stay

Commercial ESU is delivered as a Multiple Activation Key (MAK). Microsoft’s activation guide says an administrator with the Product Key Reader or VL Administrator role finds it in the Microsoft 365 admin center under Billing, Your products, Volume licensing. Then, on each PC, with administrator rights:

1. Confirm the PC runs Windows 10 version 22H2 with KB5066791 or a later cumulative update, and then install KB5072653, the ESU Licensing Preparation Package.
2. Install the key by running slmgr.vbs /ipk followed by the ESU key.
3. Activate it by running slmgr.vbs /ato followed by the activation ID for the ESU year the key covers. Microsoft lists them as f520e45e-7413-4a34-a497-d2765967d094 for Year 1, 1043add5-23b1-4afb-9a0f-64343c8f3f8d for Year 2 and 83d49986-add3-41d7-ba33-87c7bfb5c0fb for Year 3.
4. Check the result with slmgr.vbs /dlv: the output should name the ESU programme and show its status as Licensed.
5. Record the PC, the ESU years activated and its planned exit date in your inventory.

These commands are usually pushed as a script from the device-management tool rather than typed on each PC. PCs that cannot reach Microsoft’s activation servers can be activated by phone, and for large numbers of offline devices Microsoft points to proxy activation in its Volume Activation Management Tool. Reimaging a PC on ESU can use another activation on the key, and Microsoft documents how to request more. On an air-gapped network the monthly updates also have to be carried in; our guide to secure USB for government and defence covers moving files into a closed network.

Step 3: image replacement PCs in batches

Replacement PCs can arrive ready to use or be imaged in-house. With Windows Autopilot and FileWave as the MDM, a new PC registered for Autopilot configures itself when its user signs in; our Mac and Windows guide describes that route, which needs Microsoft Entra ID P1 or P2. Where the business prefers a fixed image, for example identical laptops for a branch, cloning drives in batches is quicker than imaging PCs one at a time.

The KanguruClone 11 Pro has 12 M.2 sockets, one for the master and up to 11 for targets, and units sold since October 2023 take M.2 NVMe and M.2 SATA SSDs without separate adapters. For 2.5-inch SATA drives, Kanguru’s SATA Pro duplicators do the same job; our duplicator buying guide compares the range. Three rules decide whether a cloned Windows drive boots in the new PC and stays secure:

• One master per PC model, built on a reference PC of that model with its own drivers.
• Run Sysprep’s generalise step before cloning. Microsoft requires a Windows image to be generalised before it goes onto other PCs, even ones with similar hardware, because the step strips computer-specific details such as the security identifier.
• Turn BitLocker on per PC, after deployment. Leave it off on the master: a BitLocker system drive moved into a different computer can stop the TPM from releasing its key. Our guide to self-encrypting drives and BitLocker covers the encryption choice for the new laptops.

Compare every batch against the master and boot-test one drive from each batch before fitting the rest.

Step 4: retire old PCs without leaving data on the drives

Replacement leaves a pile of old Windows 10 PCs whose drives still hold whatever their users saved, cached and synced. Deleting files or formatting a drive does not remove the data, and on an SSD, wear levelling keeps copies in blocks the operating system cannot reach, so the erasure method has to suit the drive type. Our secure data erasure guide explains the three NIST SP 800-88 outcomes, clear, purge and destroy, and when each applies.

• Erase in batches. Every KanguruClone duplicator in our buying guide has erase functions, so the bench that images new drives can also clear old ones. On the KanguruClone 11, though, NVMe drives can only be overwritten, which NIST counts as Clear rather than Purge, so plan purge or physical destruction for NVMe SSDs that held sensitive data.
• Keep a record for each drive: serial number, method, result, date and operator. On the SATA Pro units, Kanguru recommends its Control Manager software on a Windows PC, rather than logging to a USB stick, for records an auditor will read.
• Know the limits of remote wipe. FileWave can send a remote wipe to Windows PCs enrolled through Windows MDM, but not to PCs that run only the FileWave Client, so do not rely on it for every retired PC.
• Close the record. Take each PC out of management and mark it retired in your inventory before it leaves the building, so reports match what is still in use.

Organisations in Saudi Arabia should note that the PDPL Implementing Regulation extends the destruction of personal data to every copy, backups included; our Enterprise IT in Saudi Arabia page maps that rule and the NCA controls to the tools above.

A 90-day plan for an office still running Windows 10

For most UAE offices, three months is enough to move the bulk of a Windows 10 fleet, leaving only replacement deliveries and genuine exceptions on ESU. A workable order:

1. Weeks 1 and 2: inventory. List every Windows 10 PC with its version, edition, model, user and department, and run the Windows 11 readiness check across the fleet.
2. Week 2: decide. Mark each PC upgrade, replace or ESU, and give every ESU PC an exit date before 12 October 2027.
3. Week 3: cover the gap. Order ESU Years 1 and 2 for the PCs that need it, bring them to 22H2 with the required updates, activate the key and confirm each PC with slmgr.vbs /dlv.
4. Weeks 3 to 5: pilot. Upgrade a pilot group that covers every department’s applications and peripherals, and fix what breaks before the waves start.
5. Weeks 6 to 12: upgrade in waves, watching update status in your reports and keeping a roll-back plan for each wave.
6. In parallel: replace. Order replacement PCs, build one master per model, clone and compare in batches, and switch BitLocker on as each PC is deployed.
7. As old PCs come back: retire. Erase or destroy each drive by a method that suits it, keep the record and remove the PC from management.
8. By mid-2027: review. Check every ESU PC against its exit date. Any still needed after 12 October 2027 needs Year 3 at US$244 each, and nothing comes after it.

How PRO TECHnology helps with Windows 10 fleets

PRO TECHnology’s Enterprise IT division covers each step in this guide, from the licences that keep the remaining PCs covered to the tools that retire the old ones.

• Windows 10 ESU licences. PRO TECHnology supplies Windows 10 ESU licences for organisations in the UAE, quoting Year 1 and Year 2 together for PCs joining now. Send the number of PCs and their Windows 10 editions.
• FileWave. PRO TECHnology is FileWave’s distributor and partner for the Middle East, as set out in our FileWave partnership announcement, and deploys and supports FileWave for inventory, the Windows 11 readiness check, software deployment and Windows update policy. See FileWave demonstrations and quotations.
• Kanguru duplicators and encrypted storage. PRO TECHnology is Kanguru’s exclusive distributor and partner for the Middle East, as announced by Kanguru, and supplies the KanguruClone range for imaging and erasing drives, along with Kanguru encrypted drives for data that has to travel.
• Backup before the move. Back up user data before any upgrade or replacement; our backup and disaster recovery guide sets out the options.

We work with companies, schools and universities across the UAE; the full range is on our Enterprise IT division page. In Saudi Arabia, enquiries go through PRONEXT in Riyadh.

Sources

We read each source below on 17 October 2026: Microsoft’s lifecycle FAQ on Extended Security Updates (updated 24 August 2026); its Windows 10 ESU programme page (dated 17 November 2025) and activation guide (updated 21 April 2026); its consumer ESU page; its page on Windows 10 and Microsoft 365 Apps (updated 27 July 2026) and the Microsoft 365 Apps update history (updated 13 October 2026); the Windows 11 specifications and the lifecycle pages for Windows 10 Enterprise and Education and for the LTSC and LTSB releases; Microsoft’s Sysprep documentation; FileWave’s Windows 11 readiness article; BleepingComputer’s report of the consumer extension; The Register’s report of Microsoft’s April 2024 pricing, our source for education prices; and Gulf News on the dirham’s peg. Dirham figures are our conversions at 3.6725 and are not quoted prices. Hypothetical examples are illustrations only, not customer cases.

• Microsoft Learn: Product lifecycle FAQ, Extended Security Updates (updated 24 August 2026)
• Microsoft Learn: Extended Security Updates (ESU) for Windows 10
• Microsoft Learn: Enable Windows 10 Extended Security Updates (updated 21 April 2026)
• Microsoft: Windows 10 consumer Extended Security Updates
• Microsoft Learn: Windows 10 end of support and Microsoft 365 Apps (updated 27 July 2026)
• Microsoft Learn: Update history for Microsoft 365 Apps (updated 13 October 2026)
• Microsoft: Windows 11 specifications and system requirements
• Microsoft Learn: Windows 10 Enterprise and Education lifecycle
• Microsoft Learn: Windows 10 Enterprise LTSC 2021 lifecycle
• Microsoft Learn: Windows 10 Enterprise LTSC 2019 lifecycle
• Microsoft Learn: Windows 10 IoT Enterprise LTSC 2021 lifecycle
• Microsoft Learn: Windows 10 2016 LTSB lifecycle
• Microsoft Learn: Sysprep and generalising a Windows installation
• FileWave knowledge base: Windows 11 compatible devices (readiness recipe)
• BleepingComputer: Microsoft quietly extends free Windows 10 ESU support to October 2027 (June 2026)
• The Register: Windows 10 ESU pricing for business and education (3 April 2024)
• Gulf News: creation, history and evolution of the UAE dirham (the 3.6725 peg)

Frequently asked questions