Your branch devices keep working. Their security updates stop on four different dates.

The Long-Term Servicing Channel is a separate edition of Windows that receives monthly quality updates but no feature updates. New features arrive only in a new LTSC release every few years, if you choose to install one.

Microsoft is direct about who it is for. The Windows lifecycle FAQ states that the Long-Term Servicing Channel "is designed to be used only for specialized devices, for example, those that control medical equipment or automated teller machines (ATMs)." Microsoft names the ATM itself. That single sentence is why this page is written for credit unions, banks, and mortgage companies rather than for a general IT audience.

The overview article is equally direct about who it is not for. Microsoft writes that "the long-term servicing channel isn't intended for deployment on most or all the PCs in an organization" and that the LTSC edition "provides a deployment option for special-purpose devices and environments."

How LTSC gets into a financial institution without a decision

In our experience with regulated institutions, LTSC rarely arrives through an IT standard. It arrives inside a purchase. The ATM vendor ships a controller with an LTSC image because the machine has to boot the same way for a decade. The ITM arrives preconfigured. The check scanner comes with a locked-down workstation build from the vendor that supports it. A branch remodel adds two kiosks, and the kiosks come with an operating system nobody selected.

The result is a small population of devices on a different servicing clock from everything else in the building, frequently owned in the budget by operations or facilities rather than by IT, and usually excluded from the same reporting that covers staff laptops. That is a manageable situation as long as somebody knows the dates. The dates are the part that goes missing.

Why the table says one day and Microsoft's prose says another

The lifecycle listings carry an end-of-day timestamp, so they read one calendar day later than the date Microsoft writes out in sentences. Where Microsoft states a date in prose, that is the date to put in a project plan:

• October 13, 2026 for Windows 10 Enterprise 2016 LTSB and Windows 10 IoT Enterprise 2016 LTSB. Microsoft: "ESU extends the use of Windows 10 Enterprise 2016 LTSB and Windows 10 IoT Enterprise 2016 LTSB devices past the end of support date on October 13, 2026."
• January 12, 2027 for Windows 10 Enterprise LTSC 2021. Microsoft: "ESU extends the use of Windows 10 Enterprise LTSC 2021 devices past their applicable end of support date of January 12, 2027."

For the releases where Microsoft publishes no prose sentence, this page quotes the lifecycle listing exactly as Microsoft lists it and does not shift the date by a day on its own authority. If you are building a board timeline off the 2019 or the IoT rows, take those from the lifecycle page directly and note the timestamp convention beside them.

Windows 10 Enterprise LTSC 2019 carries an extended end date of 1/10/2029. Windows 10 Enterprise LTSC 2021 carries a mainstream end date of 1/13/2027 and no extended end date at all. The newer release runs out roughly two years sooner.

Put the two listings side by side and the reason is visible. LTSB 2016 and LTSC 2019 each have two phases: mainstream support, then a second block of extended support roughly five years long. Enterprise LTSC 2021 has one phase. The second block is not shortened on that listing, it is absent.

This is the part worth reading twice if you run a branch network. An institution that refreshed its teller workstation image from LTSC 2019 to LTSC 2021, doing the thing that looks like good hygiene, moved its own deadline forward by two years. Nothing on the device announced that. The build number went up.

Microsoft puts that sentence in the overview for a reason. There is no general rule you can apply to LTSC. Each release is looked up on its own.

The second thing the tables show

Windows 10 IoT Enterprise LTSC 2021 was released on the same day as Enterprise LTSC 2021, 11/16/2021, and carries the same mainstream end date of 1/13/2027. It also carries an extended end date of 1/14/2032, five years the Enterprise listing does not have.

The Windows 11 generation repeats the pattern. Windows 11 Enterprise LTSC 2024 is listed to 10/10/2029 with no extended end date. Windows 11 IoT Enterprise LTSC 2024 is listed to 10/10/2029 with an extended end date of 10/11/2034. So the edition chosen for a piece of replacement hardware in 2026 sets whether its next runway is about five years or about ten, and the two editions are one word apart on a purchase order.

Microsoft states this plainly in the Extended Security Updates guidance, in a one-line note that is easy to read past:

Read against the lifecycle tables, that note makes sense rather than being an inconsistency: IoT Enterprise LTSC 2021 does not need an Extended Security Updates purchase in January 2027, because its listing runs to 1/14/2032 on its own. The problem is operational. Both editions report as Windows 10 in most inventory tools, both sit in the same branch, and a bulk purchase made on the assumption that they are interchangeable buys coverage for devices that did not need it while leaving devices that did.

Where the difference actually bites

• Purchasing. One SKU does not cover both. The edition has to be read off each device before the order is placed, not inferred from the model number.
• Key distribution. For Windows 10 IoT Enterprise LTSB 2016, Microsoft says the activation key comes from somewhere else entirely: "For MAK keys for Windows 10 IoT Enterprise LTSB 2016, please contact your OEM partner." For an ATM fleet that means the hardware vendor, on the hardware vendor's timeline.
• Replacement planning. If a device is being replaced anyway, the edition on the replacement decides whether the institution is back in this conversation in 2029 or in 2034.

Microsoft publishes an Extended Security Updates program for Windows 10 Enterprise 2016 LTSB, Windows 10 IoT Enterprise 2016 LTSB, and Windows 10 Enterprise LTSC 2021, with three coverage years available for each.

This is worth saying clearly because the wider Windows 10 coverage says the opposite, and it was right when it was written. The mainstream Windows 10 Extended Security Updates program, the one attached to Windows 10 version 22H2, does not cover Long-Term Servicing Channel releases. Those releases have their own lifecycles and, now, their own Extended Security Updates track.

On September 8, 2026, Microsoft told partners that the Windows 10 Enterprise LTSC 2021 Extended Security Updates offers had reached the Cloud Solution Provider price list:

The announcement names the product as Windows 10 Enterprise LTSC 2021 ESU under product ID DG7GMGDZQ4KS. If your provider told you in August that there was nothing to buy for LTSC 2021, they were describing the price list accurately at the time. Ask again.

The branch network problem, and the path Microsoft publishes for it

Activation normally needs the device to reach Microsoft activation servers. Microsoft publishes the exact endpoints a client needs to reach, seven of them, spanning go.microsoft.com, login.live.com, and the activation and validation services. On an ATM or teller-device segment with tight egress filtering, that list is the conversation to have with whoever owns the firewall rules, and it is better had in advance than during a change window.

Where a device genuinely cannot reach those endpoints, Microsoft documents an offline path: generate an installation identifier on the device, take it to the Microsoft Product Activation portal from a machine that does have internet access, and apply the confirmation identifier that comes back. For larger numbers of disconnected devices, Microsoft points at the proxy activation scenario in the Volume Activation Management Tool. Neither path is exotic. Both need planning time that a January deadline does not leave much of.

Nothing on a teller station or an ATM controller changes visibly on the morning after its end-of-support date. The card reader still reads cards. The receipt printer still prints. No banner appears, no service degrades, and no ticket gets opened. What stops is the monthly quality update, which means that from that date forward every newly disclosed Windows vulnerability that would have been fixed simply stays open on that device for the rest of its working life.

The gap compounds in a way people underestimate. On a device that has not been enrolled in Extended Security Updates, a vulnerability disclosed eighteen months after end of support stays open for the rest of that machine’s working life, in a branch lobby, with a network path to the systems that matter. Enrolment changes that, for the releases where an offer exists and for as long as the purchased coverage years run. Security controls around the device reduce the exposure either way. They do not close it.

The slower problem: the frozen feature set

There is a second effect that arrives before the end-of-support date and gets blamed on other things. Microsoft describes it directly:

In practice that shows up as an agent that will not install, a management tool that drops the platform, or a security product whose newest version requires something the frozen build does not have. Two separate facts sit behind that. Microsoft’s equivalence table puts Windows 10 Enterprise LTSC 2021 at the same feature update as Windows 10 version 21H2, released 11/16/2021, so the feature set on that device is the one Windows had in late 2021 and will stay that way for the life of the release. Separately, the Windows lifecycle FAQ records that "Windows 10, version 22H2 is the last feature update released for Windows 10 and will be serviced with monthly updates through October 14, 2025 after which it is no longer supported." Those two statements are about different things, and neither one shortens the LTSC device’s own servicing runway: it keeps receiving monthly quality updates until its own end-of-support date. What it does not receive is any Windows feature added after 2021, and that is the thing a third-party installer checks for.

If your endpoint agent coverage report has a handful of stubbornly non-compliant machines that nobody can explain, check whether they are LTSC before you check anything else.

In the examinations we help institutions prepare for, the technology questioning tends to follow one sequence: show us the asset inventory, show us that it is complete, show us how you know when something on it goes out of support, and show us what you decided to do about the things that have. Unsupported software comes up because it is easy for an examiner to verify and hard for an institution to argue with.

LTSC devices fail that sequence in a specific way. They are frequently missing from the inventory the IT team hands over, because they were bought by another department and managed by a vendor. When they are present, they are often listed as "Windows 10" with no edition and no release, which cannot be mapped to a support date. And the end-of-support dates themselves are not the widely known Windows 10 dates, so a spreadsheet built from general Windows 10 guidance has the wrong deadline against them even when the devices are listed correctly.

What to have ready before the question is asked

• A device list that includes the specialized endpoints. ATMs, ITMs, kiosks, scanner stations, signature pads, and anything else with a Windows build behind it, whichever budget bought it. Device-management reporting will not produce this on its own, because the devices that matter most here are often the ones never enrolled in it.
• Edition and release for every Windows device, rather than the product family alone. "Windows 10" is not an answer. "Windows 10 IoT Enterprise LTSC 2021" is, because it maps to a date.
• The date each one is on, sourced to Microsoft. Not to a blog, not to a vendor summary, and not to a general Windows 10 article.
• A dated decision per device group. Extended Security Updates, upgrade, replace, or a documented exception with compensating controls. A decision with a date on it is what turns a finding into a plan.

Credit unions, banks, and mortgage companies that can produce those four things tend to have a short conversation about branch hardware. The ones that cannot tend to have a long one.

If you have already read our page on Windows 10 Extended Security Updates, this is the part it told you to look up separately. The neighbouring deadlines worth checking at the same time are Windows Server 2016 end of support, because the branch server room usually ages alongside the branch hardware, and Windows 11 version 24H2 end of servicing, which is the same class of mistake in a newer edition.

• Enable Extended Security Updates (ESU) for Windows 10 LTSB 2016 and Windows 10 Enterprise LTSC 2021, Microsoft Learn, page dated August 28, 2026. Source for the October 13, 2026 and January 12, 2027 end-of-support dates, the note that the Enterprise LTSC 2021 offer does not apply to IoT Enterprise LTSC 2021, the patch-level prerequisites, the Microsoft Entra ID role requirement, the Multiple Activation Key path, the OEM key note for IoT Enterprise LTSB 2016, the activation endpoint list, and the offline activation path.
• Microsoft Partner Center announcements, September 2026, item dated September 8, 2026. Source for the Windows 10 Enterprise LTSC 2021 Extended Security Updates Year 1 to 3 availability, the September 8 price list republish, and product ID DG7GMGDZQ4KS.
• Microsoft Lifecycle: Windows 10 Enterprise LTSC 2021. Source for the 11/16/2021 start date and the 1/13/2027 mainstream end date, with no extended end date listed.
• Microsoft Lifecycle: Windows 10 IoT Enterprise LTSC 2021. Source for the matching 11/16/2021 start date, the 1/13/2027 mainstream end date, and the 1/14/2032 extended end date.
• Microsoft Lifecycle: Windows 10 Enterprise LTSC 2019. Source for the 11/13/2018 start date, the 1/10/2024 mainstream end date, and the 1/10/2029 extended end date.
• Microsoft Lifecycle: Windows 10 2016 LTSB, editions: Enterprise. Source for the 8/2/2016 start date, the 10/13/2021 mainstream end date, and the 10/14/2026 extended end date.
• Microsoft Lifecycle: Windows 11 Enterprise LTSC 2024 and Windows 11 IoT Enterprise LTSC 2024. Source for the 10/10/2029 mainstream end dates and the 10/11/2034 extended end date on the IoT listing.
• Windows Enterprise LTSC overview, Microsoft Learn, page dated July 14, 2026. Source for the statement that LTSC is not intended for most PCs in an organization, the note on external tools dropping legacy support, the instruction to check each release individually, the exclusion of Microsoft Edge and in-box apps, and the release equivalence table.
• Microsoft Lifecycle FAQ for Windows. Source for the statement that LTSC is designed only for specialized devices such as those controlling medical equipment or ATMs, and for the Windows 10 version 22H2 servicing statement.

Two things deliberately absent from this page: a per-device price for Windows 10 Enterprise LTSC 2021 Extended Security Updates, because Microsoft published none in the documents above, and any coverage end date for Year 2 or Year 3 of that program, because Microsoft publishes the three programs without stating those dates. Arithmetic from January 12, 2027 would look authoritative and would not be Microsoft's.