Windows 10 Security Updates Extended Again Through 2027
On June 25, 2026, Microsoft updated a support page and changed the math for millions of Windows 10 users, with no keynote and no press release. The free consumer Extended Security Updates (ESU) program, originally set to end October 13, 2026, now runs through October 12, 2027. The change was first spotted by Windows Latest, and Microsoft has since confirmed the new date directly on its own Windows 10 ESU page.
That's genuinely good news for anyone still running Windows 10. But if you're making IT decisions for a small business, the headline is less useful than the fine print underneath it. Not every Windows 10 PC qualifies for the free extension, and a second, unrelated deadline is arriving on almost the same timeline.
What Actually Changed
Microsoft's consumer ESU program lets Windows 10, version 22H2 devices keep receiving critical and important security patches after Windows 10's official end of support on October 14, 2025. There are three ways to enroll: sync your PC settings through Windows Backup at no cost, redeem 1,000 Microsoft Rewards points, or make a one-time $30 purchase. According to Microsoft's own ESU support page, all three paths now carry coverage through October 12, 2027, and a single license covers up to 10 devices tied to one Microsoft account.
If you already enrolled under the original October 2026 end date, nothing changes on your end. Your coverage rolled forward automatically.
Two Different ESU Programs, and Why the Difference Matters
Here's the part that gets missed in most of the coverage of this story. The free consumer ESU program was never built for business use, and Microsoft is explicit about it. Per the same Microsoft support page, consumer ESU enrollment isn't offered for devices in kiosk mode, devices joined to Active Directory or Microsoft Entra, or devices enrolled in a mobile device management solution. That last category quietly excludes a lot of small business hardware, including machines managed remotely by a line-of-business software vendor or an outsourced IT provider.
Businesses in that situation need the commercial ESU program instead, sold through volume licensing. According to ManageEngine's summary of Microsoft's licensing terms, commercial ESU starts at $61 per device for the first year and doubles with each renewal, for up to three years. That schedule wasn't touched by the consumer extension. It's a separate program on its own separate clock.
I had a conversation a few months back with a two-person accounting practice that read the extension headline and assumed their whole office was covered. Their machines were joined to their tax software vendor's domain for compliance reasons, which meant none of them qualified for the free consumer path. They needed commercial ESU instead, at a cost that climbs every year it stays in place. Catching that distinction before renewal season, rather than after, kept it from becoming a surprise line item.
The Secure Boot Wrinkle Nobody's Talking About
Separately from ESU, a set of Secure Boot certificates issued back in 2011 begin expiring in June 2026, according to Microsoft. This affects Windows 10 and Windows 11 devices alike, not just Windows 10. Most machines will pick up the newer 2023 certificates automatically through Windows Update, but some older or firmware-dependent systems need an additional OEM update to make the switch. A device that misses the update doesn't stop working. It just loses future protection for the early startup process, which is a meaningful gap on any machine handling client data.
This is a good moment to check firmware status across your fleet rather than assuming Windows Update handled it quietly in the background.
What This Means If You're Still Running Windows 10
The extra year is real, and it takes some pressure off. It shouldn't take the whole plan off the table. A few things I'd actually do with the extra runway:
First, find out which ESU track applies to each machine you're running. If your systems are joined to a vendor's domain, managed through an MDM tool, or set up under a managed services agreement, the free consumer path almost certainly doesn't apply to you, and budgeting for commercial ESU pricing now beats discovering it at renewal.
Second, treat the extension as planning time, not a reason to stop planning. Hardware refresh cycles, application compatibility testing, and staff transition all take longer than people expect. A vCIO engagement is where this kind of roadmap actually gets built, rather than left as a vague intention for next year.
Third, don't let Secure Boot slide because ESU is getting the attention. It's a separate risk with its own June 2026 start date, and it's worth a firmware check on anything older than a couple of years.
If you need someone to sort out which devices are covered and which aren't, that's exactly the kind of audit our support team handles, and it's a lot faster to fix before a renewal deadline than after one. For businesses planning a full migration rather than a patchwork of extensions, a scoped consulting engagement gets you there without the guesswork.
Frequently Asked Questions (FAQs)
Q: Does the Windows 10 ESU extension mean I don't need to upgrade to Windows 11 anymore?
A: No. The extension buys time, it doesn't remove the eventual deadline. Windows 11 is where ongoing feature and security development is happening, and the ESU program is explicitly a bridge, not a permanent alternative. Treat the extra year as planning time, not a reason to shelve the migration.
Q: Our office PCs are joined to a domain for our practice management software. Do we qualify for the free ESU extension?
A: Probably not. Microsoft's consumer ESU program specifically excludes devices joined to Active Directory or Microsoft Entra, or enrolled in a mobile device management solution. If that describes your setup, you likely need the commercial ESU program instead, which has its own pricing and timeline.
Q: What's the difference between the Secure Boot certificate issue and the ESU program?
A: They're unrelated but overlapping. ESU covers ongoing security patches for Windows 10 after its official end of support. The Secure Boot certificate expiration is about firmware-level trust certificates from 2011 expiring starting in June 2026, and it affects Windows 10 and Windows 11 devices alike. Fixing one doesn't fix the other.
Q: How do I check if my Windows 10 PC is actually enrolled in ESU?
A: Go to Settings, then Update & Security, then Windows Update. Your enrollment status shows there, and if you purchased ESU, the order also appears in your Microsoft account order history. If you don't see an enrollment option at all, your device may not meet the version or account prerequisites.
Q: Should a small business still plan a Windows 11 migration this year even with the extension?
A: Yes. The extension is a reasonable reason to sequence a migration sensibly rather than scramble, not a reason to defer it indefinitely. Hardware compatibility, application testing, and staff transition all take longer than most people budget for, and starting that process now avoids doing it under pressure next year.
About the author. Justin White is the founder of TechGents, an owner-operated IT consulting firm in Springfield, IL. He has nearly two decades of experience across Apple, Windows, and mixed-platform environments, helping small businesses and professionals across Sangamon County and Central Illinois run their technology without an internal IT department.
The free extension is real, but it only covers devices that actually qualify for the consumer program, and plenty of small business machines don't. Check which ESU track applies to your fleet before you assume you're covered.
If you want a clear-eyed look at where your Windows 10 devices actually stand and a realistic timeline for moving off them, a vCIO engagement is built for exactly that kind of assessment.
Have questions about your specific setup? Get in touch and we'll walk through it together.