If your office still has Windows 10 PCs on desks, the decision in front of you this week is easy to state: pay for another year of Extended Security Updates, upgrade the PCs that can run Windows 11, or replace the ones that cannot. Windows 10 end of support was 14 October 2025, and the paid Year 1 of commercial ESU closes on 13 October 2026. This guide gives you the dates, the hardware test, a replace-or-upgrade table and a rollout plan sized for a Singapore office of 10 to 150 staff.
What changed when Windows 10 end of support arrived
On 14 October 2025 Microsoft stopped shipping security fixes, feature updates and technical support for Windows 10. The PCs still boot and still run Word, Excel and your browser. What stops is the monthly patch, so every vulnerability found after that date stays open on any machine that is not enrolled in ESU.
Two details matter for an office fleet. ESU is only offered to Windows 10 version 22H2, so any PC still on an older version needs a feature update before it can be covered. The change is also quiet rather than dramatic: nothing breaks on the day, which is exactly why unpatched PCs linger in offices for years after the Windows 10 end of support date.
Windows 10 ESU: what it covers and what it does not
Windows 10 ESU is a paid subscription that keeps delivering critical and important security updates to Windows 10 version 22H2. It does not add features, fix non-security bugs or include general technical support. Treat it as a bridge that keeps a PC patched while you replace or upgrade it, not as a way to stay on Windows 10.
| Option | Who it is for | Microsoft list price (USD) | Covers until |
|---|---|---|---|
| Commercial ESU Year 1 | Windows 10 Pro, Enterprise and Education in business use | 61 per device | 13 Oct 2026 |
| Commercial ESU Year 2 | Same editions; cumulative, so a late joiner also pays Year 1 | 122 per device | 12 Oct 2027 |
| Commercial ESU Year 3 | Same editions; final year | 244 per device | 10 Oct 2028 |
| Consumer ESU | Home and Pro PCs that are not domain-joined or enrolled in device management | Free with Windows Backup sync, 1,000 Rewards points or 30 | 12 Oct 2027 |
| Windows 365 and Azure Virtual Desktop | Windows 10 virtual machines, and Windows 10 PCs connecting to Windows 365 Cloud PCs | No additional cost | Up to three years |
Prices are Microsoft’s published list prices, checked on 23 September 2026. Two traps catch small offices. The consumer programme, which Microsoft extended in June 2026 from 13 October 2026 to 12 October 2027, is not offered to PCs joined to Active Directory or Microsoft Entra ID, or enrolled in device management, which describes most properly managed office machines. Commercial ESU is also cumulative: a PC that skipped Year 1 must pay for Year 1 as well before it can get Year 2.
Windows 10 ESU Year 2: the 13 October 2026 decision
Buy Windows 10 ESU Year 2 only for PCs that genuinely cannot move before 13 October 2026. At USD 122 per device, or USD 183 if Year 1 was skipped, it buys time, not a better computer. Nearly a year after Windows 10 end of support, every other machine should be on Windows 11 or the replacement list.
Year 2 is a reasonable spend in three cases:
- A line-of-business application vendor has not yet supported Windows 11 and has given you a written date.
- Replacement PCs are ordered but will not be on desks before 13 October.
- A PC controls a piece of equipment and will be retired together with that equipment within the year.
Year 3 doubles again to USD 244 per device, and the programme ends for good on 10 October 2028. Give every PC on the Year 2 list a named replacement date, or it will still be there next October.
Windows 11 hardware requirements: which office PCs qualify
A PC qualifies for Windows 11 if it has a compatible 64-bit processor with two or more cores at 1 GHz or faster, 4 GB of RAM, 64 GB of storage, UEFI firmware with Secure Boot capability, TPM 2.0 and a DirectX 12 graphics driver. In most offices the processor list is the blocker, not the memory or the disk.
Microsoft’s supported-processor lists start at Intel’s 8th Generation Core chips and selected AMD Ryzen 2000 series chips (the Ryzen 5 2600 and Ryzen 7 2700X are listed; the Ryzen 5 2400G is not), so machines built on older or unlisted chips will fail the check. Run Microsoft’s PC Health Check app on each machine, or pull the same data from your management tool, and record the result against the asset tag.
- TPM 2.0 and Secure Boot are often present but switched off in firmware, so a fail on those two lines alone may be fixed in the BIOS settings.
- 4 GB of RAM is Microsoft’s floor, not a working spec; for Microsoft 365, Teams and a browser open all day, plan on 8 GB or more.
- Do not bypass the check: Microsoft says a PC below the minimum requirements is not entitled to receive updates, shows a desktop watermark, and compatibility damage is not covered by the manufacturer warranty.
Replace or upgrade: apply the Windows 11 hardware requirements PC by PC
Upgrade a PC in place when it passes the check and has at least two years left in your refresh plan. Replace it when the processor fails or the machine is near the end of its life. Microsoft does not charge for the Windows 11 upgrade on eligible PCs, so hardware and labour are the real costs.
| PC profile | Decision | Note |
|---|---|---|
| Supported CPU, TPM 2.0 on, 8 GB RAM or more, SSD | Upgrade in place | Files move across by default; you have 10 days to roll back |
| Supported CPU, TPM or Secure Boot off in firmware | Enable in firmware, then upgrade | Record the BitLocker recovery key before changing firmware settings |
| Supported CPU, 4 GB RAM or a hard disk | Add RAM or an SSD, or replace | Replace if less than two years remain in the refresh plan |
| CPU not on Microsoft’s supported list (most chips older than Intel 8th Generation or AMD Ryzen 2000) | Replace | Use ESU Year 2 only as a bridge to the delivery date |
| Runs an application that only supports Windows 10 | Keep on ESU and isolate, or move the app to Windows 365 or Azure Virtual Desktop | ESU is included for Windows 10 there at no additional cost |
If replacements are on the cards, use the moment to standardise specifications and naming. Our office IT setup checklist covers what a new desk should ship with, from security baseline to backup.
The Windows 11 upgrade Singapore offices can run in 4–6 weeks
A Windows 11 upgrade for a 10 to 150-seat office usually fits into four to six weeks: one week to audit, one to prepare and back up, a pilot, then department-by-department waves after hours. The cutover itself is the short part. Most of the time goes into knowing what each PC runs and who depends on it.
| Week | Task | Owner |
|---|---|---|
| 1 | Inventory every PC: model, CPU, TPM, RAM, disk, Windows version and installed apps; run PC Health Check | IT provider |
| 2 | Confirm Windows 11 support with software vendors, order replacements and fix the ESU Year 2 list before 13 October | Office manager with IT provider |
| 2 | Back up user data and record BitLocker recovery keys | IT provider |
| 3 | Pilot on three to five users from different teams, inside the 10-day rollback window | IT provider with pilot users |
| 4–5 | Upgrade or replace by department, in the evening or at the weekend | IT provider |
| 6 | Clear stragglers, retire old PCs, wipe their drives and update the asset register | IT provider with office manager |
Keep finance staff out of month-end and payroll week, and hold a spare laptop ready in case an upgrade fails. Old drives hold personal data, so wipe or destroy them before disposal. It is also a good week to rerun our cyber security checklist.
Data, backup and Microsoft 365 Apps after Windows 10 end of support
Back up before you touch a single PC. An in-place upgrade moves files across by default, but Microsoft still recommends a backup first, and a replacement PC starts empty. Microsoft 365 Apps keep receiving security updates on Windows 10 until 10 October 2028, but Microsoft’s own guidance is to move those devices to Windows 11.
Before each PC is touched, capture:
- Desktop, Documents and Downloads folders that are not already synced to OneDrive.
- Outlook data files and signatures.
- Licence keys and installers for software tied to that specific machine.
- The BitLocker recovery key, stored somewhere other than the PC itself.
On Windows 10, Microsoft 365 Apps receive feature updates and Copilot support only until Version 2608 is released, and Microsoft warns that an unsupported operating system can cause performance and reliability issues. If mailboxes and OneDrive are not backed up separately, look at Microsoft 365 backup before the project starts.
Staying past Windows 10 ESU: security and PDPA risk
An unpatched PC is an open door that stays open. Once a machine falls outside Windows 10 ESU, every new operating system vulnerability is permanent on it, and staff PCs are where phishing emails, malicious attachments and unsafe downloads land first. The risk grows each month rather than arriving on one date.
For Singapore organisations this is also a data protection question. Section 24 of the PDPA requires an organisation to make reasonable security arrangements to protect personal data in its possession or under its control, and the PDPC’s advisory guidelines list updating computer security and IT equipment regularly among the technical measures it expects. Running PCs past Windows 10 end of support, with no ESU, on machines that open customer or staff records is hard to square with that. This is general information, not legal advice; speak to your DPO or lawyer about your own position.
The fix is to make patch status someone’s job. A good managed IT services Singapore contract reports patch compliance every month, so an unsupported PC appears as a line item long before it becomes an incident.
Frequently asked questions
Can I still use Windows 10 after 2026?
Yes, PCs keep working after Windows 10 end of support, but they only stay patched while enrolled in ESU. Commercial ESU runs in yearly blocks to 10 October 2028 at the latest, and consumer ESU now runs to 12 October 2027. After those dates there are no more security updates of any kind, so plan the move to Windows 11 well before them.
Can I still use Windows 10 after it is no longer supported?
You can, and nothing stops working on the day. After Windows 10 end of support, a PC without ESU gets no security fixes, so every newly found vulnerability stays open. For an office holding customer or staff data, that sits badly with the PDPA requirement for reasonable security arrangements. Use ESU as a short bridge only.
What should I replace Windows 10 with?
Windows 11 is the direct replacement, and the upgrade is free on PCs that meet the Windows 11 hardware requirements. PCs with older processors need new hardware. For an application that only runs on Windows 10, a Windows 365 Cloud PC or Azure Virtual Desktop session can host it, with ESU included at no additional cost.
Is Windows 10 support extended to 2027?
Only through ESU. In June 2026 Microsoft moved the consumer ESU end date from 13 October 2026 to 12 October 2027. Businesses reach 12 October 2027 by paying for commercial ESU Year 2 at USD 122 per device, plus Year 1 if it was skipped. Regular support ended on 14 October 2025 and was not extended.
How much does Windows 10 ESU cost for a business?
Microsoft's published list price is USD 61 per device for Year 1, USD 122 for Year 2 and USD 244 for Year 3, and the programme is cumulative, so joining in Year 2 means paying for Year 1 too. Windows 10 virtual machines on Windows 365 or Azure Virtual Desktop get ESU at no additional cost.
About the author
Written by the Rezolva Engineering Team – Rezolva has provided managed IT for Singapore SMEs and enterprises since 2012 and holds bizSAFE Level 3. Sources checked September 2026.