Microsoft End of Support October 2026: Windows 10 and Office

On Tuesday, October 13, 2026, Microsoft's October security release doubles as a finish line. Windows 10 PCs covered by the first year of Extended Security Updates (ESU), Office 2021 and Office LTSC 2021, Windows Server 2012 R2, and Windows 11 Pro devices still on version 24H2 all reach the end of their current coverage that day. That's twenty days from this article's date.

Handled as an upgrade window, the date leaves every desk on Windows 11 and current Microsoft 365 Apps, the release train where Microsoft 365 Copilot and new features keep arriving. Handled as a renewal line item, it doubles the price of another year of Windows 10 patches and carries a longer exception list into the next exam.

For credit unions, banks, and mortgage companies, the systems on this list can sit anywhere from the teller line to the server closet. ABT, a Tier-1 Microsoft Cloud Solution Provider, serves more than 750 of these institutions. This guide takes each deadline in turn: what changes on October 13, what keeps working, and what goes in the file for your examiner. Every Microsoft support date below comes from Microsoft's lifecycle documentation and its product support pages.

That figure is why end of support weighs more than it used to. A system that stops receiving security updates keeps collecting the exact kind of flaw attackers now use most often, and every month past the date adds to the pile.

Microsoft end of support in October 2026: six deadlines on one Tuesday

Microsoft publishes these dates well in advance on its lifecycle pages. Every date in the table below lands on the same Patch Tuesday. Here are the six deadlines, plus one related milestone, with the move that clears each one.

The last row is the calm one. Microsoft's 2026 lifecycle list puts Windows Server 2022 among products moving to extended support on October 13, and extended support "includes security updates at no cost." ABT's page on Windows Server 2022 end of mainstream support explains what actually changes. The other six rows are where the money and the exam findings sit.

For branch kiosks and specialty terminals on the Long-Term Servicing Branch (LTSB) row, ABT's page on Windows 10 LTSC end of support dates sorts out which release runs on which clock.

Six deadlines on one Patch Tuesday, and the move that clears each. Windows Server 2022 keeps its security updates.

Windows 10: the Year 2 invoice

Windows 10 reached end of support on October 14, 2025. Organizations that bought the first year of commercial Extended Security Updates have received critical and important security fixes since then, and that first year ends on October 13, 2026. The qualifying editions are Enterprise, Education, and Pro in commercial use.

Windows 10 is still common. In August 2026, it accounted for 23.55 percent of Windows desktop web traffic in North America, according to StatCounter, nearly a year after support ended.

Microsoft's published volume-licensing price for commercial ESU is $61 per device for Year One, and the price doubles each consecutive year, which puts Year 2 at $122 per device. The program is cumulative: a device that joins in Year 2 pays for Year 1 as well. Enrolled devices must run Windows 10 version 22H2, and ESU delivers security updates only, with technical support for Windows 10 itself outside the program.

There's a cheaper path for some of those desks: run the Windows desktop in Microsoft's cloud and connect to it from the branch PC. Microsoft makes ESU available at no additional cost for Windows 10 virtual machines in Windows 365, Azure Virtual Desktop, and Azure virtual machines. Windows 10 endpoints that connect to Windows 365 Cloud PCs are entitled to ESU for up to three years with an active Windows 365 subscription.

For a branch PC whose work moves to a Windows 365 Cloud PC, that changes the math, because Microsoft extends ESU to the PC itself for up to three years. With Azure Virtual Desktop, the no-cost ESU applies to the Windows 10 virtual machines in the service. ABT runs Azure Virtual Desktop for financial institutions inside the Azure environments it hosts, and as a Tier-1 Microsoft Cloud Solution Provider can license Windows 365 alongside your Microsoft 365 subscriptions.

The decision works device by device: a teller PC that runs one browser-based core application is a strong Cloud PC candidate. A loan officer's laptop that travels and runs Microsoft 365 Copilot all day belongs on Windows 11 with current apps. A check scanner station waiting on a vendor driver may be the one place a Year 2 ESU license earns its $122. The enrollment mechanics are on ABT's Windows 10 ESU Year 2 page.

The Windows 10 decision, device by device. Windows 365 also covers the Windows 10 PC that connects to it.

Whichever path each device takes, write the choice down before the Year 2 renewal. The 20-day plan below starts there.

Office 2021 and Office LTSC 2021: the Copilot line

Office 2021 retires on October 13, 2026 under Microsoft's Modern Lifecycle Policy, and Office LTSC 2021, the volume-licensed version many institutions bought to avoid a subscription, reaches end of support the same day. Microsoft's lifecycle pages spell out the result: no new security updates, no non-security updates, and no assisted support.

The desktop apps keep opening. Word still edits documents and Excel still calculates. What changes is exposure. Office documents arrive by email all day, and a suite that stops receiving fixes stays open to each Word and Excel flaw disclosed after October 13 that affects it.

Office LTSC 2021 carries one more date. Microsoft supports it for connecting to Microsoft 365 services such as Exchange Online, SharePoint Online, and OneDrive until October 13, 2026. After that, in Microsoft's words, older versions "might still be able to connect to Microsoft 365 services, but that connectivity isn't supported," and over time they "might encounter other unexpected performance or reliability issues." For an institution whose mail lives in Exchange Online, that describes an Outlook client drifting out of support against the service it depends on.

The larger cost is what these versions leave out. Microsoft lists Microsoft 365 Apps, the subscription desktop apps, as the app requirement for Microsoft 365 Copilot in Word, Excel, PowerPoint, and Outlook. Office 2021 and Office LTSC 2021 are perpetual versions, outside the Microsoft 365 Apps requirement Copilot lists.

The replacement is Microsoft 365 Apps, included with Microsoft 365 Business Standard and Business Premium and with Microsoft 365 E3 and E5. ABT licenses those plans and manages the Microsoft 365 tenant they run in, so the Office decision and the Copilot decision sit with one partner. ABT's free Microsoft 365 licensing assessment reviews your seat usage, plan mix, and pricing gaps before you add a seat. Our comparison of Microsoft 365 E3, E5, and Business Premium for financial institutions covers which plan fits which institution.

Where a perpetual license is a hard requirement, Microsoft supports Office LTSC 2024 for connecting to Microsoft 365 services until October 9, 2029. Office LTSC 2024 is also a perpetual version, outside the Microsoft 365 Apps requirement Copilot lists. ABT's page on Office LTSC 2021 end of support shows which upgrade path fits each group of users.

Windows Server 2012 R2: Year 3 is the last year

Windows Server 2012 and 2012 R2 left extended support on October 10, 2023. Since then, security updates have reached them only through the Extended Security Update program, and Microsoft's ESU table stops at Year 3: October 13, 2026.

Azure has been the usual answer for a 2012 server that could not be upgraded in time, because Microsoft gives Windows Server 2012 and 2012 R2 workloads in Azure free ESUs. The length matters. Microsoft's lifecycle FAQ says customers who migrate to Azure get ESUs for 2012 and 2012 R2 "for three years after the End of Support dates," a period that ends on the same October 13. The extra Azure-only year Microsoft granted Windows Server 2008 and 2008 R2 applies to those versions only, per the same FAQ.

Microsoft's security updates for 2012 R2 end on October 13, in Azure as well as on premises. The fix is to rebuild the workload on a supported Windows Server version, in Azure or on premises. The same Microsoft FAQ addresses the most tempting workaround directly: "Third party application control solutions are not a replacement for product security fixes."

If your remaining 2012 R2 servers run something unglamorous and important, such as a reporting database, a file share for scanned documents, or an interface to a vendor system, name the workload and its owner now. ABT hosts dedicated Azure environments for exactly this kind of line-of-business system through private system hosting on Azure. Our Azure disaster recovery guide covers how a rebuilt workload meets Federal Financial Institutions Examination Council (FFIEC) business continuity expectations.

Windows 11 Pro 24H2: the date hiding in the list

The easiest deadline to miss belongs to machines that already run Windows 11. Windows 11 Home and Pro, version 24H2, reaches end of servicing on October 13, 2026. Version 25H2 is serviced into October 2027. Enterprise and Education editions follow a longer schedule; their next date appears in the timeline below.

Each device's edition, along with its version number, decides which date applies. ABT's page on Windows 11 24H2 end of support explains the Pro and Enterprise difference.

The fix itself is routine. A feature update policy in Microsoft Intune can move 24H2 devices to 25H2, and Intune's Windows feature update device readiness report shows compatibility risks per device before you push the update. Our guide to risk-based device compliance with Microsoft Intune covers the policy side.

What an examiner looks for

The examiner's expectation was published in June 2021, more than five years before this October's deadlines. It sits in the FFIEC's IT Examination Handbook, in the booklet on architecture, infrastructure, and operations.

Read that the way an examiner would. It asks for three things: an inventory that shows where end-of-life software runs, a way to track those dates, and a plan to replace or upgrade what is past them. Three other documents describe the same expectation in their own vocabulary.

• CIS Controls v8, Safeguard 2.2, from the Center for Internet Security (CIS), titled "Ensure Authorized Software is Currently Supported," designates unsupported software as unauthorized unless a documented exception details the mitigating controls and residual risk acceptance. The safeguard also expects the software list to be reviewed for support at least monthly. It belongs to Implementation Group 1, the baseline tier.
• NIST Cybersecurity Framework (CSF) 2.0, published by the National Institute of Standards and Technology (NIST), includes subcategory ID.AM-08: "Systems, hardware, software, services, and data are managed throughout their life cycles." On September 21, 2026, the Office of the Comptroller of the Currency (OCC) issued Bulletin 2026-48, which restructures the Cybersecurity Supervision Work Program its examiners use around the six CSF 2.0 functions. The OCC notes that the work program "does not establish new regulatory expectations."
• The Federal Trade Commission (FTC) Safeguards Rule, which covers mortgage companies and other non-bank financial institutions, requires vulnerability assessments "at least every six months" under 16 CFR 314.4(d)(2), absent effective continuous monitoring. A scan designed to find publicly known vulnerabilities will keep finding them on a system whose fixes have stopped.

Taken together, these documents describe one practice: know where end-of-life software runs, hold a dated plan to replace it, and document any exception along with its compensating controls, the piece CIS Safeguard 2.2 spells out. Mortgage lenders can map the Safeguards Rule in our FTC Safeguards Rule guide for Microsoft 365, and if a finding has already been written, ABT's finding-to-fix map for Microsoft 365 covers remediation.

A 20-day plan

Twenty days is enough to make every decision and document it, even where the replacement itself takes longer. The order below puts the steps that produce evidence first.

Three of these steps end in a purchase or a hosting decision: the path for each Windows 10 device, the move to Microsoft 365 Apps, and a new home for each 2012 R2 workload. ABT prices all three in one conversation with an expert. It licenses Microsoft 365 and Windows 365, manages the Microsoft 365 tenant where the minimum-version rule lives, and hosts the Azure environments where Azure Virtual Desktop and rebuilt servers run.

The memo is the step that turns a lingering system into a documented, dated decision. For credit unions, it also belongs in the regular technology report to the board; our guide to credit union board IT reporting shows where it fits.

Microsoft end-of-support dates after October 13

October 13 starts a sequence. Four more dates are already on Microsoft's calendar, and the first arrives four weeks later.

Windows Server 2016 is the one to start on now. It leaves extended support on January 12, 2027, 111 days from this article's date, and on-premises ESU for it requires Software Assurance. The options and costs are on ABT's Windows Server 2016 end of support page.

Frequently Asked Questions