Your Windows 10 security updates stop on a date the device will never mention.

If the device is enrolled in Extended Security Updates Year 2, nothing happens. If it is not, the operating system stops receiving security updates that day and the machine itself gives no sign of it.

Windows 10 reached end of support on October 14, 2025. Microsoft's Extended Security Updates program was the bridge across that date, and it is sold in one year blocks. Microsoft's Partner Center documentation publishes the coverage dates plainly: Year 1 covers October 15, 2025 through October 13, 2026. Year 2 picks up the next day and runs to October 12, 2027. Year 3 runs to October 10, 2028, and there is no Year 4.

So the program itself has not ended. What ends on October 13, 2026 is the coverage that a Year 1 purchase paid for. Buying the next year is a fresh decision, a fresh purchase order, and a fresh key deployment across every machine. It is not a renewal, because there is nothing to renew.

One scoping note before going further, because the two programs are routinely confused. Everything on this page describes the commercial program, the one organizations buy for managed devices. Microsoft runs a separate Extended Security Updates program for individuals and Windows 10 Home customers, with its own enrolment path, its own terms, and its own duration. If you are reading this for a home machine rather than a managed fleet, the consumer documentation is the one that governs you and the dates here do not apply.

That distinction is the whole reason this page exists. Almost everything else an institution buys from Microsoft is a subscription. A subscription lapses loudly. It sends a renewal notice, it charges a card, it puts a banner in the admin center, and somebody in accounting sees the line item. Extended Security Updates for Windows 10 do none of that.

No. Microsoft classifies Windows 10 Extended Security Updates as perpetual software, and perpetual purchases do not renew. Two sentences from the same Microsoft page settle it.

Read those together and the shape of the risk becomes clear. A Year 1 purchase is not a subscription that expires with a warning. It is a perpetual licence for one named coverage year. When that year's coverage end date passes, the licence has done everything it was ever going to do. It does not fail. It does not alert. It simply has nothing left to cover. That reading is ours rather than Microsoft's wording, and we would rather say so than dress an inference up as a quotation.

The practical consequence is that the safety nets a subscription provides are simply not there. There is no auto renewal charge to appear on a statement, and no subscription expiry to trigger the notices that normally accompany one. The device itself stays quiet too: it does not display a nag screen the way an unactivated copy of Windows does. Whether anyone tells you therefore depends on whether a person put the date on a calendar, which is a very different kind of control from a system that reminds you by default. Your reseller or managed provider may well raise it, and a good one will. The point is that the reminder has to come from somebody, because the licence will not generate one.

That leaves the absence of a patch as the first mechanical signal that coverage has lapsed, and absences are the hardest thing in technology operations for anyone to notice. To be clear about where it does show up: patch compliance reporting, vulnerability scanning and endpoint management tooling will all register an operating system that has stopped taking updates, and an institution running those well has a good chance of catching it. The gap is between organizations that watch that data deliberately and organizations that assume a device is fine because nobody has complained about it.

There is a second trap sitting behind the first one, and it catches the organizations that decide to wait and see. Extended Security Updates are cumulative. Microsoft states it directly: "If you decide to purchase the program in Year Two, you have to pay for Year One too, as ESUs are cumulative." Sitting out a year does not bank the money. It defers the same cost and adds the next one on top. Microsoft's own guidance to partners says the same thing from the other side, instructing them that once Year 2 coverage dates are current, they should purchase both Year 1 and Year 2.

Nor can the bill be trimmed by covering only part of a year. Microsoft is explicit that the program must be purchased by year and that customers cannot buy partial periods. The minimum purchase, on the other hand, is a single licence, so there is no volume floor forcing an institution to buy coverage for machines it plans to retire.

Microsoft committed to keep shipping security updates for Microsoft 365 Apps on Windows 10 for three years past the operating system's end of support, ending on October 10, 2028. Devices carry on receiving feature updates and Copilot support where eligible until Version 2608 ships, then hold on that version and keep taking security updates until 2028. The OneDrive desktop app on Windows 10 22H2 keeps updating on the same schedule.

None of that depends on Extended Security Updates. It is a Microsoft 365 commitment, not a Windows one. So on the morning of October 14, 2026, an unenrolled Windows 10 machine will look exactly like it did the day before. Outlook opens. Excel opens. Files sync. Copilot answers. There is no error, no red banner, and no help desk ticket, because from the user's chair nothing has changed at all.

Underneath, the thing that stopped is the layer that matters most. Operating system patches are what close kernel flaws, driver flaws, and remote code execution paths. Those are the vulnerabilities a supported Windows install receives a fix for on the second Tuesday of each month, and the ones an unenrolled machine now simply keeps.

October 13, 2026 is not only the Windows 10 date. Microsoft's release information for Windows 11 lists version 24H2 with two different end of updates dates depending on edition, and the earlier one lands on exactly the same day.

Windows 11 version 24H2 stops receiving updates on October 13, 2026 for Home, Pro, Pro Education and Pro for Workstations. For Enterprise, Education, IoT Enterprise and Enterprise multi-session, 24H2 runs a further year, to October 12, 2027.

The edition split is the part that decides whether this matters to you, so it is worth being careful rather than dramatic about it. Windows 11 Business, the edition that comes with Microsoft 365 Business Premium, is the Pro edition. A great many credit unions, banks, and mortgage companies are licensed exactly that way. For those institutions, a fleet that is part Windows 10 on Extended Security Updates and part Windows 11 Pro on 24H2 has both halves stop on one October Tuesday. An institution standardized on Enterprise editions has the easier version of this problem, with a full extra year on the Windows 11 side.

The fix for the Windows 11 half is ordinary servicing rather than a purchase: move those devices to version 25H2, which carries Home and Pro editions to October 12, 2027 and Enterprise editions to October 10, 2028. One thing not to wait for is version 26H1. Microsoft scoped it to new devices arriving in early 2026 and states that it is not designed as a feature update for existing devices and is not offered as an in place update from 24H2 or 25H2. If the plan was to let the fleet roll forward onto 26H1 on its own, that plan does not exist.

There is a small mercy in the collision. Both halves are discovered by the same inventory pass, and for many institutions the same hardware refresh answers both questions at once. The machines still running Windows 10 in late 2026 are usually the oldest machines in the building, and the ones running Windows 11 Pro on an aging feature update are usually managed by the same team with the same tooling. One project, not two.

Long-Term Servicing Channel devices are outside the program entirely

Microsoft states that Windows 10 Long Term Servicing releases have their own lifecycles and are not covered by the Windows 10 Extended Security Updates program. This matters more in financial services than in most industries. Teller terminals, ATM controllers, kiosks, and other specialized endpoints are frequently built on Long-Term Servicing Channel images precisely because they are meant to sit still for years. If any of those exist in your estate, they are on their own separate lifecycle dates, they will not be fixed by an ESU purchase, and they need to be looked up individually rather than assumed into the fleet number.

Only limited ESU-specific support is included

Microsoft answers the question directly with a single word: no. The program covers license activation, installation, and possible regressions caused by the Extended Security Updates themselves, and nothing else. General support is not provided for a Windows version past its end of support date. New features, customer requested nonsecurity updates, and design change requests are all explicitly out of scope. An institution treating ESU as a way to keep a supported estate is misreading what it buys.

The device has to be prepared before a key will take

Enrollment is not simply a purchase. Devices must be running Windows 10 version 22H2 with update KB5066791 or later installed, and then the Extended Security Updates Licensing Preparation Package, KB5072653, installed after it. Order matters there. Each coverage year then has its own Multiple Activation Key and its own distinct activation identifier, so moving from Year 1 to Year 2 means installing a new key and running a fresh activation across every enrolled machine. It is a deployment task on a deadline, not a line item on a purchase order.

Only whole years, and only three of them

Coverage cannot be bought for part of a year. Enrolled devices in a commercial or educational organization can receive security updates for a maximum of three years past end of support, which puts the hard floor under all of this at October 10, 2028. Whatever an institution decides about Year 2, the calendar ends in the same place. Every path that involves keeping Windows 10 is a path to the same date, and the only variable is how much gets spent getting there.