Windows 10 ESU Year 2 reaches the PCs you own only where someone set it up. Verify it on every covered device.

From October 14, 2026, a Windows 10 PC you own keeps receiving Windows operating system security updates through one of two routes: Year 2 of Extended Security Updates bought for it, with the Year 2 key activated on it, or Microsoft's Windows 365 entitlement for a local device that a user with an assigned Cloud PC signs in to, with the ESU policy enabled on that device. Windows 10 virtual machines in Windows 365 and Azure are covered without a purchase, because Microsoft includes ESU there at no additional cost. Everything else about a device looks the same as it did the day before.

Windows 10 reached end of support on October 14, 2025. Microsoft's Extended Security Updates program is the bridge across that date, and it is sold in one year blocks. Microsoft's Partner Center documentation publishes the coverage dates plainly: Year 1 covers October 15, 2025 through October 13, 2026. Year 2 picks up the next day and runs to October 12, 2027. Year 3 runs to October 10, 2028, and there is no Year 4.

So the program itself runs for two more years. What ends on October 13, 2026 is the coverage that a Year 1 purchase paid for. Year 2 is a fresh purchase order, a fresh key, and a fresh activation pass across every machine. Microsoft's own instruction to its partners is explicit: once Year 2 coverage dates are current, purchase both Year 1 and Year 2 for a device that has neither. It is a purchase, because there is nothing to renew.

One scoping note before going further, because the two programs are routinely confused, and the confusion got worse this summer. Everything on this page describes the commercial program, the one organizations buy for managed devices, which Microsoft's lifecycle documentation scopes to Enterprise, Education, and Pro editions in commercial use. Microsoft runs a separate Extended Security Updates program for individuals and personal devices, and that program differs in three ways that matter if you are reading this for a home PC. Microsoft extended it: its consumer page now says you can enroll any time until the program ends on October 12, 2027, and that an enrolled device's coverage continues automatically through that date. It is free with Windows settings backup, or 1,000 Microsoft Rewards points, or $30 once. And it refuses commercial use: Microsoft states that enrollment is offered neither to devices joined to an Active Directory domain or Microsoft Entra nor to devices enrolled in a mobile device management solution. A managed fleet gets nothing from the consumer extension. That is the whole contrast in one line: the consumer program carries itself forward, and a purchased commercial licence moves only when someone buys the next year.

That distinction is the reason this page exists. Almost everything else an institution buys from Microsoft is a subscription. A subscription lapses loudly. It sends a renewal notice, it charges a card, it puts a banner in the admin center, and somebody in accounting sees the line item. Extended Security Updates for Windows 10 do none of that.

No. Microsoft classifies Windows 10 Extended Security Updates as perpetual software, and perpetual purchases do not renew. Microsoft's Year 2 coverage window is fixed, October 14, 2026 to October 12, 2027, and whether a given device receives the updates inside that window depends on four separate things: the purchase, the device meeting the prerequisites, the Year 2 key being activated on it, and the updates installing. Two sentences from the same Microsoft page settle the first half.

Read those together and the shape of the risk becomes clear. A Year 1 purchase is a perpetual licence for one named coverage year, and a perpetual licence carries no expiry warning. When that year's coverage end date passes, the licence has done everything it was ever going to do. It keeps its place in the admin center. It simply has nothing left to cover. That reading is ours, and the two quoted sentences are Microsoft's.

What those two sentences establish is the licensing fact: a Year 1 purchase carries no renewal event, so there is no auto renewal charge to appear on a statement and no subscription expiry to trigger the notices that normally accompany one. What they say nothing about is who tells you. Microsoft's ESU documentation describes no renewal notice and no on-device prompt for a coverage year that is ending, so in our experience the reminder comes from a person who put the date on a calendar, a reseller or managed provider, or a patch-compliance report that notices the updates stopped. Your reseller or managed provider may well raise it, and a good one will.

That makes verification the safeguard: confirm the Year 2 licence status on each device, and confirm in your update reporting that the next monthly Windows security update installed. A missing patch is easy to overlook, which is why the check belongs on a schedule. A lapse shows up in patch compliance reporting, vulnerability scanning and endpoint management tooling, all of which register an operating system that has stopped taking updates, so an institution running those well has a good chance of catching it. The gap is between organizations that watch that data deliberately and organizations that assume a device is fine because nobody has complained about it.

There is a second trap sitting behind the first one, and it catches the organizations that decided to wait and see. Extended Security Updates are cumulative. Microsoft states it directly: "If you decide to purchase the program in Year Two, you have to pay for Year One too, as ESUs are cumulative." Sitting out a year defers the same cost and adds the next one on top. Microsoft's guidance to partners says the same thing from the other side, instructing them that once Year 2 coverage dates are current, they should purchase both Year 1 and Year 2. By arithmetic from Microsoft's published Year One figure, a device enrolling for the first time now pays $61 plus $122, which is $183 per device, for coverage that runs to October 12, 2027.

Coverage is sold in whole years only. Microsoft is explicit that the program must be purchased by year and that customers cannot buy partial periods, and its minimum purchase is a single licence, so there is no volume floor forcing an institution to buy coverage for machines it plans to retire. Microsoft's Partner Center page adds that all three coverage years can be purchased ahead of their coverage dates, so a Year 2 purchase made in September was already the right move, and one made now still goes through.

Microsoft committed to keep shipping security updates for Microsoft 365 Apps on Windows 10 for three years past the operating system's end of support, ending on October 10, 2028. Devices receive feature updates and Copilot support where eligible until Version 2608 is released, then stay on Version 2608 with security updates only until 2028. Version 2608 reached Current Channel in August 2026 and Monthly Enterprise Channel on September 8, 2026, per Microsoft's update history. The OneDrive desktop app on Windows 10 22H2 keeps updating on the same schedule.

None of that depends on Extended Security Updates. It is a Microsoft 365 commitment, separate from the Windows one. So on October 14, 2026, a purchased-ESU Windows 10 machine with no Year 2 key keeps running its applications as it did on October 13: Outlook opens, Excel opens, files sync. The evidence that Windows coverage lapsed lives in two places, the device's licence status and its update record, and those are the two places to check.

Underneath, the thing that stopped is the layer that matters most. Operating system patches are what close kernel flaws, driver flaws, and remote code execution paths. Those are the vulnerabilities a supported Windows install receives a fix for on the second Tuesday of each month, and the ones a machine without a current ESU year now simply keeps.

There is a small mercy in the pile-up. Every one of these is found by the same inventory question, and for many institutions the same hardware refresh answers most of them at once. The machines still running Windows 10 in late 2026 are usually the oldest machines in the building, and the ones running Windows 11 Pro on an aging feature update are usually managed by the same team with the same tooling. One project, with a longer list.

Long-Term Servicing Channel devices run on their own dates and their own program

Microsoft states that Windows 10 Long Term Servicing releases have their own lifecycles and are not covered via the Windows 10 ESU program. This matters more in financial services than in most industries. Teller terminals, ATM controllers, kiosks, and other specialized endpoints are frequently built on Long-Term Servicing Channel images precisely because they are meant to sit still for years. A Windows 10 ESU Year 2 purchase covers none of them. Each build has its own date and, where Microsoft offers one, its own Extended Security Updates: Windows 10 Enterprise LTSB 2016 reaches end of updates on October 13, 2026, and Windows 10 Enterprise LTSC 2021 reaches end of support on January 12, 2027 with its own ESU purchasable since September 1, 2026. Those devices need their own line in the inventory and their own purchase decision, which our Windows 10 LTSC page walks through.

Only limited ESU-specific support is included

Microsoft answers the question directly with a single word: no. The program covers license activation, installation, and possible regressions caused by the Extended Security Updates themselves, and nothing else. General support is unavailable for a Windows version past its end of support date. New features, customer requested nonsecurity updates, and design change requests are all explicitly out of scope. An institution treating ESU as a way to keep a supported estate is misreading what it buys.

Bought for your own hardware, Year 2 needs a new key on every device, and the device has to be prepared first

Enrollment is more than a purchase. Devices must be running Windows 10 version 22H2 with update KB5066791 or later installed, and then the Extended Security Updates Licensing Preparation Package, KB5072653, installed after it. Order matters there. Each coverage year then has its own Multiple Activation Key and its own activation identifier, so moving a fleet from Year 1 to Year 2 means installing the Year 2 key with Microsoft's licensing tool, activating the Year 2 identifier, and confirming on each machine that the licence status reads Licensed for the Year 2 program. A Year 1 activation proves nothing about Year 2. It is a deployment task with a verified finish, and it has to reach every device. Windows 10 virtual machines in Windows 365 and Azure sit outside this step, because Microsoft includes ESU for them at no additional cost. A local PC covered through Microsoft's Windows 365 entitlement sits outside it too; that route uses an ESU policy set through Intune or the registry in place of a purchased key.

Only whole years, and only three of them

Coverage cannot be bought for part of a year. Enrolled devices in a commercial or educational organization can receive security updates for a maximum of three years past end of support, which puts the hard floor under all of this at October 10, 2028. Whatever an institution decides about Year 2, the calendar ends in the same place. Every path that involves keeping Windows 10 is a path to the same date, and the only variable is how much gets spent getting there.