Windows 10 and the October toll: ESU doubles every year and you cannot skip year one

There is one sentence in Microsoft's documentation worth more than every headline you have read about the end of Windows 10: "If you decide to purchase the program in Year Two, you have to pay for Year One too, as ESUs are cumulative." Next to it, another one: the price doubles every consecutive year, for a maximum of three. Translation: postponing the decision is neither free nor priced at next year's rate. It is priced at all the years you let go by, added up, on the day you finally decide.

Windows 10 reached end of support on 14 October 2025. Year one of the paid programme started in November 2025, so this autumn it is renewal time — or not — and the same conversation will play out in hundreds of boardrooms around the same wrong question: how much does ESU cost? The right question is a more uncomfortable one: how many devices will you still have in October that cannot move to Windows 11, and why exactly can they not? Depending on the answer — hardware or application — the plan is completely different, and only one of the two can be fixed with money.

The full math, with Microsoft's own rule applied

Microsoft publishes a single price: $61 per device for year one, through volume licensing, with a minimum purchase of one licence. The other two prices are not published as figures: they are published as a rule ("the price doubles every consecutive year, for a maximum of three years"). Applying it is arithmetic, not speculation, so here is what we put in front of people when they ask what waiting costs. The amounts are volume rates in US dollars: your final price depends on your agreement and your partner, but the shape of the curve does not change.

The $61 is Microsoft's published price. The $122, $244, $183 and $427 figures are a direct application of the doubling rule: our arithmetic, not published numbers, at volume rates and before taxes or agreement discounts.

Delaying enrolment does not reduce the bill if you end up enrolling: it only shifts the payment and leaves you unpatched while you wait. The closest analogy is a toll collected on the way out: you get to choose when you go through the barrier, not the amount. The only move that genuinely saves money is the one almost nobody puts on the table in that meeting: not needing the programme at all.

What you are buying is not support

ESU delivers critical and important security updates as rated by Microsoft's security response centre. That is all. The documentation itself lists what it does not include:

• New features.
• Customer-requested non-security updates. In other words: the reliability bug that is annoying you will not be fixed by anyone.
• Design change requests.
• General technical support. ESU only covers licence activation, installation and possible regressions of ESU itself; and even that requires an active support plan.

It is worth saying plainly, because meetings tend to say the opposite: ESU does not buy support, it buys time. A device under ESU still gets half the maintenance — the important half, yes, but half — and has stopped improving. Paying for that is perfectly justified if you know what you want the time for. If you do not, you are paying for a sedative.

The "Windows 10 until 2027" headline is not about your company

On the consumer end-of-support page for Windows 10, Microsoft currently says that devices enrolled in the consumer programme receive critical and important security updates through 12 October 2027. That is the headline doing the rounds, and it is true. It is also irrelevant to your fleet: the consumer programme and the commercial one are two different things, with different enrolment, a different key and different terms. What applies to your company laptops is the commercial programme, which runs for a maximum of three years after end of support — that is, until October 2028 — and is paid per device. We have watched this scene play out several times already: someone reads "Microsoft extends Windows 10 to 2027" and assumes the problem postponed itself. Nothing postponed itself.

The devices that need it most are not eligible

The ESU enablement documentation says it in one line that reads fast and costs dearly: Windows 10 Long Term Servicing releases (LTSB/LTSC) have their own lifecycles and are NOT covered by the Windows 10 ESU programme. Now think about which machines in your fleet run LTSC: the production line PC, the one driving the microscope, the CT scanner, the point of sale, the panel on the machine the vendor certified once and never looked at again. Precisely the ones that will never move to Windows 11, and precisely the ones that show up in the steering meeting as "we will cover those with ESU". No, it does not cover them: they have their own dates, and you have to check them one by one before counting licences. The first deliverable of this project is not a purchase order, it is an inventory with the edition and version of every machine.

Office lives on until 2028, but you have already lost the right to complain

This is the real hidden cost, because it never shows up on an invoice. Microsoft is keeping security updates for Microsoft 365 Apps on Windows 10 until 10 October 2028, three years after the operating system's end of support. That sounds reassuring until you read the small print, which Microsoft updated on 27 July 2026: those devices receive feature updates and Copilot support — where eligible — only until version 2608 ships; from then on they stay frozen on 2608, receiving security updates only, until 10 October 2028. The OneDrive desktop app keeps updating until that same date on 22H2 only: on older Windows 10 versions it simply stops updating.

And then there is the part nobody budgets for. Since 14 October 2025, for Microsoft 365 Apps incidents on Windows 10 — with or without ESU — Microsoft describes three limits: if the issue only occurs on Windows 10 and not on Windows 11, support will ask you to move the device to Windows 11; if you cannot move it, you get troubleshooting assistance only, with limited or unavailable technical workarounds; and those incidents do not include the option to log a bug or request a product change. Read that again: you keep paying the full Microsoft 365 subscription while losing the ability to get your own defect into the fix queue. That is not an expense, it is a silent loss of rights, and it costs far more than $61. If you are reviewing this year's Microsoft bill, this sits right next to the Microsoft 365 price increase.

ESU is not purchased: it is deployed

The second usual surprise comes after signing. Enabling ESU in a commercial environment has concrete requirements, and none of them is solved with a credit card:

• The device must be on Windows 10 version 22H2 with KB5066791 or later and then — order matters — the licensing preparation package KB5072653.
• The MAK comes from the Microsoft 365 admin centre, and only someone with the Product Key Reader or VL Administrator role can see it. A silly detail that burns entire afternoons.
• Each programme year has its own activation ID: you install with slmgr.vbs /ipk and activate with slmgr.vbs /ato, pointing at that year's ID. Renewing is not "renewing": it is going round every machine again.
• Activation needs outbound access to thirteen Microsoft endpoints. And the isolated machines, which tend to be exactly the ones staying on Windows 10? Phone activation, one machine at a time, or proxy activation with VAMT for large fleets. Budget those hours: they are real.

What costs nothing and almost nobody looks at

Microsoft includes ESU at no additional cost for Windows 10 virtual machines in a handful of places: Windows 365, Azure Virtual Desktop, Azure virtual machines, Azure Dedicated Host, Azure VMware Solution, Nutanix Cloud Clusters on Azure, Azure Local, Azure Stack Hub and Azure Stack Edge. And it adds something that gets missed: Windows 10 endpoints connecting to a Windows 365 Cloud PC are entitled to ESU for up to three years while the subscription is active. Let us be honest about the caveat, because this is not a savings trick: a Cloud PC costs considerably more per month than $61 a year, so on its own it does not pay off. It pays off when desktop virtualisation was already on the table for other reasons and that handful of problem devices stops being a separate project and becomes the first pilot group.

When paying for ESU is the right call

We deploy and manage end-user devices and Microsoft 365 environments, and migration projects are part of what we bill for, so the comfortable answer would be "never, migrate everything". It is not true. There is one crystal-clear case where paying for ESU is the sensible move: the PC tied to a machine — a lathe, an analyser, an industrial printer, a line-of-business application with a hard dependency — whose vendor does not certify Windows 11 and which you are not going to scrap because it cost six figures. There, ESU is exactly what it claims to be: time you bought. But buying it well comes with conditions, the same ones we always set: a segmented network for that machine, no mail and no browsing, no wildcards in the firewall; an inventory with name, location and owner; and an exit date written into the very document that approves the spend. An ESU with an exit date is a bridge. An ESU renewed out of inertia is the new normal, and that normal ends in 2028 anyway — except by then you will have paid three times and still have the same problem.

The five questions we answer before signing an ESU

• How many devices cannot move to Windows 11, and why? Separate the ones blocked by hardware from the ones blocked by an application. The first are solved with budget; the second by talking to a software vendor, and that conversation takes months.
• How many are LTSC? Those are not covered by ESU and need their own calendar.
• How many are on 22H2 today? Anything that is not is work to do before, not after.
• Which ones have no internet access? Those get activated by hand or with VAMT. Count the hours.
• What share of the replacement price is that bill? Divide the $427 cumulative total by what you paid on your last laptop order — that number is yours, and it is the only one on this list we cannot give you. On the oldest machines in the fleet the result is uncomfortable. Do the division per group, not for the whole fleet: there is almost always one block that should migrate now and another that genuinely needs the bridge.

None of those five answers comes from a salesperson: they come from an inventory — a documented, current source of truth, the same logic with which we run our network in NetBox, not a spreadsheet somebody last touched in March. It is the same boring work behind any well-managed end of support, which we wrote about a few days ago regarding SharePoint 2016 and 2019: the vendor calendar does not negotiate, and your only room for manoeuvre is having counted properly what you have before the date arrives.

What we would do if the renewal lands this autumn

Split the fleet into three blocks and treat them differently. Block one: devices that move to Windows 11 without drama — those are not up for debate, they get migrated, and every one you migrate stops paying the toll forever. Block two: devices with a hard dependency and no short-term way out — ESU, network isolation and an exit date. Block three: devices that were due for replacement anyway, where ESU is money spent on a machine you will retire regardless. The boardroom discussion stops being "how much does ESU cost" and becomes "how many devices are in each block", which is a question with an objective answer. And if block two comes out at zero, congratulations: you do not need the programme, and you have just saved yourself a renewal that doubles every year.

Sources (verified): the $61 per-device price for year one, the annual doubling rule with a three-year maximum, purchasing by whole years, the cumulative condition ("if you decide to purchase the program in Year Two, you have to pay for Year One too"), the one-licence minimum, the programme exclusions (new features, customer-requested non-security updates, design change requests and general technical support) and the list of services with ESU at no additional cost —Windows 365, Azure Virtual Desktop, Azure virtual machines, Azure Dedicated Host, Azure VMware Solution, Nutanix Cloud Clusters on Azure, Azure Local, Azure Stack Hub and Azure Stack Edge, plus Windows 10 endpoints connecting to a Cloud PC— are in the Windows 10 ESU programme page on Microsoft Learn. The enablement requirements (22H2 with KB5066791 and then KB5072653, Product Key Reader / VL Administrator roles to view the MAK, a different activation ID per year, slmgr.vbs, the thirteen activation endpoints, phone activation and VAMT proxy activation) and the explicit exclusion of LTSB/LTSC releases come from the ESU enablement guide. The Microsoft 365 Apps dates (security updates through 10 October 2028, freeze on version 2608, OneDrive on 22H2 only and the three support limits) are in the Windows 10 end of support and Microsoft 365 Apps page, updated on 27 July 2026. The consumer programme coverage through 12 October 2027 is on the Windows end of support page. These are our arithmetic and our opinion, not Microsoft's: the $122, $244, $183 and $427 figures (a direct application of the published doubling rule, at volume rates, before taxes or agreement discounts), the reading that enrolling late does not reduce the total, the three-block split of the fleet and the five questions to answer first.