Windows 10 reached end of support on October 14, 2025. A year later, a lot of IT organizations are in the same meeting: the first year of Extended Security Updates is running out, there are still Windows 10 devices in the fleet, and someone has to decide whether to pay for Year Two.
The ESU decision itself is a budgeting question. The more interesting question is why those devices are still there. Twelve months after a deadline that was announced years in advance, the leftover population is a pretty accurate map of where the migration program got stuck.
The Economics Get Worse Every Year
Microsoft's terms are designed to make waiting expensive. Commercial ESU costs "$61 USD per device for Year One," and "the price doubles every consecutive year, for a maximum of three years." The program is also cumulative: "If you decide to purchase the program in Year Two, you have to pay for Year One too" (Microsoft Learn). ESU also only covers security fixes. No new features, no non-security fixes, and no general technical support.
There's one notable exception. Microsoft lists ESU at no additional cost for Windows 10 virtual machines in several of its own cloud services, including Windows 365, Azure Virtual Desktop, and Azure VMware Solution, which it notes includes Citrix and Omnissa Horizon deployments there (Microsoft Learn). For some organizations, that turns the ESU question into a hosting question.
Who's Still on Windows 10, and Why
In my experience, the devices left after a hard deadline usually fall into a handful of groups, and each one points to a different gap in the program.
Hardware that can't run Windows 11. These are the easy ones to explain and the hardest to fix quickly, because the answer is a purchase. If they're still around a year later, it usually means the refresh was planned as one big budget line instead of being phased in with the normal replacement cycle.
Devices tied to one application. A lab instrument, a manufacturing station, a line-of-business app that was certified on Windows 10 and never re-tested. Nobody owns the work of validating the app on Windows 11, so it waits. This is a dependency management failure, not a technical one.
Devices nobody knew about. Machines under a desk in a branch office, kiosks, shared PCs in a warehouse. If the inventory was wrong at the start, the program spent its effort on the devices it could see.
Users who opted out. Executives who asked to be moved "after the quarter." Teams in the middle of a launch. A long tail of "not right now" turns into a permanent population if no one comes back for them.
What I'd Do in the Year Two Meeting
Break the number down before deciding. "We still have 4,000 Windows 10 devices" is not something you can act on. "1,800 are hardware-blocked, 900 are tied to four specific applications, 700 we just found, and 600 deferred" is. Each group gets its own plan and its own owner.
Buy ESU for the groups that need it, not the whole fleet. Because the price doubles, every device you can move before Year Two starts is real money. A partial purchase targeted at the genuinely blocked groups, with a firm exit date for each, is better than a blanket renewal that takes the pressure off everyone.
Treat application blockers as their own workstream. For each app, there should be a named owner, a test plan, and a date. Sometimes the answer is to validate on Windows 11. Sometimes it's to publish the app from a hosted Windows 10 session while the physical endpoint moves on, which is where the no-cost ESU for some cloud-hosted desktops becomes useful. Sometimes the right answer is to retire the app. What doesn't work is letting it sit unowned for another year.
Look at virtual delivery for the stragglers. Moving a hard-to-migrate workload into a virtual desktop doesn't make the old OS go away, but it separates the problem from the physical device. Users can get new hardware on Windows 11 while the legacy workload runs in a contained, centrally patched environment until it can be retired. It is a bridge, not a destination, and it should be planned with an end date like any other bridge.
Lessons for the Next Deadline
There will be another one. There always is: an OS version, a browser engine, a hypervisor, a certificate change, a protocol being deprecated. A few things I'd carry forward from Windows 10:
Inventory is the first milestone, not a prerequisite you assume is done. Every migration I've seen go badly had a bad device or application inventory at the start.
Track the long tail separately. The first 80% of a migration moves on automation. The last 20% is made of exceptions, and each exception needs a human decision. Report on that group on its own so it doesn't hide behind a healthy overall percentage.
Make deferrals expire. Every "not right now" should come with a date when someone will ask again. Otherwise it turns into "never" without anyone deciding that.
Price the delay early. When the cost of waiting is known up front, as it is with ESU, put it in front of decision makers early. "Each device we don't move costs $122 next year" is a much stronger argument for funding the migration than any slide about security posture.
The Windows 10 deadline was one of the best-signposted deadlines in enterprise IT. The organizations still paying for it a year later mostly aren't short on warning. They're short on ownership for the hard cases. That's fixable, and Year Two is a reasonable time to fix it.