Is Windows 10 Still Safe? When Its Security Updates Really Stop

Windows 10 is reasonably safe to use only while it still receives security updates, and for most people that now depends on which Extended Security Updates (ESU) program the machine is in. Microsoft extended the consumer program to 12 October 2027, while the commercial program's first paid year ended on 13 October 2026, so a work PC that was not renewed for Year Two stopped getting fixes this month. A Windows 10 PC with no ESU coverage has received no operating system security fixes since 14 October 2025.

Key takeaways

• Windows 10 reached end of support on 14 October 2025, according to Microsoft. Without ESU, a Windows 10 PC gets no operating system security updates after that date.
• Consumer ESU (personal devices on Windows 10 version 22H2) now runs to 12 October 2027. Microsoft changed this in June 2026; the earlier end date was 13 October 2026.
• Commercial ESU is sold one year at a time. Microsoft's lifecycle table lists the Year One end as 13 October 2026, Year Two as 12 October 2027 and Year Three as 10 October 2028.
• The consumer extension does not cover work devices. Microsoft excludes domain joined, Microsoft Entra joined, MDM enrolled and kiosk mode devices from the consumer program.
• ESU delivers only Critical and Important security updates. No new features, no non-security fixes, no general technical support.
• Some Microsoft software on Windows 10 has its own, longer timeline: Microsoft 365 Apps security updates to 10 October 2028, Edge and WebView2 updates until at least October 2028, and Defender Antivirus security intelligence until at least October 2028. None of these patch the operating system itself.
• Machines that cannot move to Windows 11 need a written decision: buy the next ESU year, move to a long term servicing edition, or isolate the machine and record the exception.

The date confusion, resolved

Two Microsoft programs share a name, overlap on two dates, and one changed mid year. Here is every date in one place, each from Microsoft's own pages.

A note on the LTSC rows: Microsoft's lifecycle pages print these cutoffs as timestamps (for example "1/13/2027 6:59:59 AM") and state that support dates are shown in Pacific Time. Read them as "mid January 2027" and "mid January 2032" and check the live page before you put a hard date in a contract.

Consumer ESU: now 12 October 2027

Microsoft's consumer ESU page says enrollment is open any time until the program ends on 12 October 2027, and that devices enrolled before then keep coverage through that date with no further action. The Windows Experience Blog post that originally announced the consumer program carries an editor's note dated 25 June 2026 saying coverage for personal use devices is "now available through Oct. 12, 2027."

There was no separate announcement. Help Net Security, reporting on 26 June 2026, noted that the change showed up as edits to Microsoft's ESU documentation and that editor's note, and gave the earlier consumer end date as 13 October 2026. That quiet edit is the root of most of the confusion: anything written or cached before late June 2026 still says 13 October 2026 for home users.

Consumer eligibility, per Microsoft's page:

• Windows 10, version 22H2, in the Home, Professional, Pro Education or Workstations edition.
• The latest Windows update installed, plus the ESU licensing preparation package that Microsoft names on the page.
• Sign in with a Microsoft account that is an administrator and not a child account. The license is tied to that account.
• One license covers up to 10 devices.
• Three ways to enroll: free by syncing PC settings with Windows Backup, by redeeming 1,000 Microsoft Rewards points, or a one-time payment of 30 US dollars (or local equivalent) plus tax.

Microsoft says enrollment options and timing may vary by region, such as the European Economic Area, without giving those terms on that page. In the EEA, read the terms shown in your own Settings app.

Commercial ESU: three yearly end dates

The commercial program is a different product with different rules. Microsoft's ESU page on Learn says organizations buy it through volume licensing at 61 US dollars per device for Year One, and that the price doubles every consecutive year for a maximum of three years. By that rule Year Two costs 122 dollars and Year Three 244 dollars per device, though your contract price is what counts.

Three details trip people up:

1. It is cumulative. Microsoft says that if you buy in Year Two you must also pay for Year One. You cannot skip ahead.
2. It is bought by the year. No partial periods, so no six month top-up to get you past a hardware delivery date.
3. Each year has its own end date. The ESU lifecycle FAQ lists Windows 10 ESU as starting 14 October 2025, with Year One ending 13 October 2026, Year Two 12 October 2027 and Year Three 10 October 2028.

Microsoft also lists ESU at no additional cost for Windows 10 virtual machines in Windows 365, Azure Virtual Desktop, Azure virtual machines and several Azure platforms, and for Windows 10 devices connecting to Windows 365 Cloud PCs with an active subscription.

Why so many pages still say 13 October 2026

Put the two programs side by side and the confusion makes sense:

• Until June 2026, consumer ESU and commercial Year One both ended on 13 October 2026. Guides merged them into one date.
• After June 2026, consumer ESU and commercial Year Two both end on 12 October 2027. Guides are now merging those, which leads business owners to believe their work PCs are covered to 2027 when they only paid for Year One.
• Microsoft's own community Q&A threads reflect the drift. Answers in one thread still treat 13 October 2026 as the consumer end date, and two answers in another contradict each other on whether organizations can go past October 2026. The authoritative answer lives on the consumer ESU page and the lifecycle FAQ, not in forum replies.

The practical rule: the date that applies to a machine depends on how that machine is licensed and managed, not on who uses it. A laptop a sole trader owns, signs into with a personal Microsoft account and does not enroll in any management tool can use the consumer program. The same model of laptop joined to a company domain cannot.

Does the consumer extension cover work devices?

No. Microsoft's consumer ESU page says the program is not available for devices in kiosk mode, devices joined to an Active Directory domain, devices joined to Microsoft Entra or enrolled in MDM, or devices that already have an ESU license. Microsoft's end of support page adds that devices managed by an organization or enrolled in enterprise licensing programs are not eligible, and points commercial customers to the commercial program on Learn.

One nuance: Microsoft says Entra registered devices are eligible. Registered is the lighter "add a work account to a personal device" state, not a full join. If you are unsure which state a machine is in, the dsregcmd /status check in the next section tells you.

So business PCs joined to a domain or Entra, or enrolled in Intune or another MDM, need commercial ESU or nothing, and shared kiosk PCs are excluded by name. Microsoft also states the consumer program cannot be used in commercial scenarios.

Am I enrolled? How to check, step by step

You need three answers for each machine: which Windows 10 version and edition it runs, how it is joined or managed, and whether an ESU license is actually active.

Step 1: confirm the version and build

ESU only applies to version 22H2. Open an elevated Command Prompt or PowerShell window and run:

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v DisplayVersion
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuild
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v EditionID

Windows 10 version 22H2 reports DisplayVersion as 22H2 and a CurrentBuild of 19045. If you see an older display version, the machine has to be updated to 22H2 before any ESU program applies. You can also run winver for a quick visual check.

Step 2: check how the device is joined or managed

dsregcmd /status

Look at AzureAdJoined, DomainJoined and WorkplaceJoined in the Device State section, and for an MDM URL further down. If DomainJoined or AzureAdJoined is YES, or an MDM enrollment is present, the consumer program is off the table and the commercial program is the route.

Step 3a: check consumer enrollment

For a personal device, open Settings, then Update & Security, then Windows Update. Microsoft's consumer page says enrollment uses the built-in tool in Settings and that you can enroll until the program ends. If the device is eligible and not enrolled, that page offers enrollment. If it is enrolled, the same page shows its ESU status instead of the offer. Take a screenshot for your records; that is the simplest evidence a home user or a sole trader can keep.

Step 3b: check commercial activation

For organization licensed devices, Microsoft documents activation with slmgr.vbs and a Multiple Activation Key (MAK) from the Microsoft 365 admin center. The documented check is:

slmgr.vbs /dlv

Microsoft says the output shows the name of the ESU program and a License Status of Licensed. If you only see Year One, the device stopped being covered when Year One ended on 13 October 2026.

Microsoft's activation steps, for reference, are to install the MAK and then activate it with the activation ID for the year you bought:

slmgr.vbs /ipk <ESU MAK>
slmgr.vbs /ato <Activation ID>
slmgr.vbs /dlv

The activation IDs Microsoft lists are:

Microsoft notes the IDs are the same across all eligible editions and devices. Its commercial prerequisites are version 22H2 with KB5066791 or later, followed by the ESU Licensing Preparation Package KB5072653, plus administrative rights. Devices without internet access can be activated by phone with slmgr.vbs /dti and slmgr.vbs /atp, and large disconnected fleets through the Volume Activation Management Tool, per the same page.

Step 4: check that updates are actually landing

A license is not a patch. Confirm the machine is installing the monthly updates:

Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 HotFixID, Description, InstalledOn

If the newest entry is months old, something is wrong regardless of license state: a paused Windows Update policy, a broken update service, a metered connection, or a WSUS server that has not approved the ESU updates.

Step 5: collect it for every machine

For a handful of PCs, a short script run on each machine and appended to a shared CSV is enough to build an inventory you can hand to an auditor or insurer:

$cv  = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
$esu = Get-CimInstance -ClassName SoftwareLicensingProduct -Filter "Name like '%ESU%'" |
       Where-Object { $_.LicenseStatus -eq 1 } |
       Select-Object -ExpandProperty Name
$last = Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 1

[pscustomobject]@{
  Computer       = $env:COMPUTERNAME
  Edition        = $cv.EditionID
  DisplayVersion = $cv.DisplayVersion
  Build          = "$($cv.CurrentBuild).$($cv.UBR)"
  EsuLicenses    = ($esu -join '; ')
  LastUpdate     = $last.InstalledOn
  Checked        = (Get-Date).ToString('yyyy-MM-dd')
} | Export-Csv -Path '\\fileserver\it\win10-inventory.csv' -Append -NoTypeInformation

Two caveats. First, the SoftwareLicensingProduct query reflects key based activation, which is how the commercial MAK works; a consumer enrollment tied to a Microsoft account may not appear there, so use the Settings check for personal devices. Second, the exact product names Windows reports can vary, which is why the filter is a loose match on "ESU". Treat slmgr.vbs /dlv as the documented source of truth and the script as a convenience for collecting many machines at once.

What ESU patches, and what it does not

Microsoft's ESU page on Learn is specific: the program delivers critical and important security updates, as rated by the Microsoft Security Response Center, through an annual subscription. It does not include new features, customer requested non-security updates or design change requests. General support is not provided; ESU support covers only license activation, installation and regressions caused by the ESU updates themselves, and only for organizations with an active support plan.

The ESU lifecycle FAQ adds two lines worth reading twice. It calls ESU a "last resort paid option" and says the program does not extend the product's lifecycle. It also says updates are distributed "if and when available", which means Microsoft is not promising a fix for every flaw found during the ESU period.

Here is how the pieces fit on a Windows 10 22H2 PC today:

The Edge, Microsoft 365 and Defender rows cause the most false comfort. A patched browser and fresh antivirus definitions on top of an unpatched kernel and network stack do not add up to a patched machine. Microsoft's Microsoft 365 Apps page says Windows 10 devices should move to Windows 11, and that support for problems seen only on Windows 10 will be steered toward an upgrade.

Microsoft 365 Apps also have a quieter cut off: Microsoft says devices on Windows 10 get feature updates and Copilot support (where eligible) only until Version 2608 ships, and then stay on 2608 receiving only security updates until 10 October 2028.

How risky is an unpatched Windows 10 machine?

"Safe" is not a property of an operating system. It is a property of a machine, its exposure, and what an attacker gains by compromising it. That said, a Windows 10 PC with no ESU is in a worse position every month, for a mechanical reason.

Windows 10 and Windows 11 share a large amount of code. Every month, Microsoft fixes security bugs in Windows 11 and in ESU covered Windows 10. When a fix ships, its existence is public, and the patch itself can be compared against the unpatched files to work out what changed. For a machine still covered, that is fine; it gets the same fix. For an uncovered Windows 10 machine, each monthly release adds to a list of flaws that are known to exist in shared code and will never be fixed on that machine. The gap only grows.

How much that matters depends on exposure:

• Home PC, one user, browser and email. Attacks mostly arrive through the browser, attachments and downloads. Current Edge and Defender builds help, but code that gets in by any route can then use unpatched operating system flaws to take full control. The free consumer ESU route removes most of this risk until October 2027.
• Office PC on a shared network with file shares and a domain. This is the worst case. One compromised unpatched machine on a flat office network is a foothold for moving to servers and other PCs. Ransomware crews look for exactly this kind of weak link.
• Isolated machine running one application with no internet access. Much lower day to day risk, provided the isolation is real and checked. The risk shifts to whatever does connect to it: USB drives, a maintenance laptop, a vendor's remote access tool.

CISA's list of bad practices puts this bluntly. It names use of unsupported or end of life software in service of critical infrastructure as dangerous and calls it "especially egregious in technologies accessible from the Internet." You do not need to run a power grid for that logic to apply to an internet facing Windows 10 box running remote desktop.

An uncovered Windows 10 machine is not instantly compromised, but it has lost the one control that fixes known flaws, so every other control around it has to work harder.

Machines that cannot be upgraded: kiosks, lab PCs and controllers

Every office has a few machines that cannot simply be moved to Windows 11: a lab PC tied to an instrument with a Windows 10 only driver, a point of sale terminal, a CNC or building controller, a reception kiosk, an old PC that fails Windows 11's hardware requirements. Our separate post on Windows 10 end of support for machines, kiosks and controllers goes deeper on these; here is the decision in brief.

First, check whether it is really "Windows 10". Many embedded and kiosk devices run a long term servicing edition, not the regular release, and those have their own lifecycle. Microsoft's ESU enablement page says Windows 10 LTSB and LTSC releases are not covered by the Windows 10 ESU program because they have their own lifecycles. The lifecycle pages show Windows 10 Enterprise LTSC 2021 with mainstream support ending in January 2027 and no extended end date listed, and Windows 10 IoT Enterprise LTSC 2021 with extended support running to January 2032. If reg query ... /v EditionID returns an LTSC or IoT edition, look up that edition's own lifecycle page instead of applying the ESU dates.

Second, if it is regular Windows 10 22H2 and must stay, buy commercial ESU for it while you still can and plan its replacement before Year Three ends on 10 October 2028. Remember the consumer program excludes kiosk mode devices by name.

Third, if ESU is not an option or has run out, isolate it. That means more than unplugging the network cable for an afternoon:

• Put the machine on its own network segment or VLAN with firewall rules that allow only the specific traffic it needs, in both directions.
• Remove internet access, email and general web browsing. If it needs a vendor update, bring it in on checked media.
• Block inbound file sharing and remote desktop unless strictly required. On the machine itself, for example:

New-NetFirewallRule -DisplayName "Block inbound SMB" -Direction Inbound -Protocol TCP -LocalPort 445 -Action Block
New-NetFirewallRule -DisplayName "Block inbound RDP" -Direction Inbound -Protocol TCP -LocalPort 3389 -Action Block

• Use a standard user account day to day, control removable media, and keep a tested image so the machine can be rebuilt quickly.
• Write down the owner, why it cannot be upgraded, the compensating controls and a review date.

Note what the ESU FAQ says about one popular shortcut. In its Windows Server section, Microsoft states that third party application control solutions are not a replacement for product security fixes. Application allow listing on a kiosk is a good extra layer; it is not a substitute for patches, and an auditor is likely to read it the same way.

How auditors, insurers and customers treat Windows 10 after ESU

Compliance owners keep getting the same question in questionnaires: "Do you run unsupported or end of life software?" With Windows 10, the honest answer depends on ESU, and it is worth getting the wording right. Our post on how to answer "do you run unsupported or end-of-life software?" covers the general case.

A covered Windows 10 machine receives vendor security updates under a paid or enrolled program, which most assessors accept for patching purposes if you can show the license and recent updates. Microsoft says ESU does not extend the product lifecycle, so describe it exactly that way: past end of support, still patched.

An uncovered Windows 10 machine is unsupported, full stop. How each framework handles that:

• PCI DSS. Requirement 6.3.3 requires security patches for critical vulnerabilities to be installed within one month of release, with other patches on a schedule the organization sets. Some summaries of version 4.0 extend the one month window to high risk vulnerabilities too, while summaries of version 4.0.1 limit it to critical ones, so check the exact version your assessor applies. An uncovered Windows 10 machine in scope for cardholder data cannot meet that, because no patches are released for it. PCI DSS v4 also has a separate requirement (12.3.4) about reviewing hardware and software technologies, including plans for those reaching end of life. Expect an assessor to ask for that plan.
• SOC 2 and ISO 27001. Neither names operating systems, but both test vulnerability management. An unpatched OS in scope usually surfaces as an exception unless it sits in the risk register with a treatment decision, an owner, compensating controls and a remediation date. Auditors look for the decision, not perfection.
• Cyber insurance and customer questionnaires. Answer accurately, separate "Windows 10 with ESU" from "Windows 10 without ESU", give counts, describe any isolation, and give the date you will be off Windows 10.

The common thread is evidence. An inventory with license state, last patch date and a named owner for each exception turns an awkward question into a short, defensible answer.

Upgrade, replace or isolate: deciding per machine

Do not make one decision for the whole fleet. Make it per machine, using a handful of facts you already collected in the inventory step.

Microsoft's end of support page says the upgrade from Windows 10 to Windows 11 is free for the equivalent edition, and that eligible PCs see the upgrade offer on the Windows Update page in Settings. Two quick hardware checks you can run before that offer appears are Get-Tpm and Confirm-SecureBootUEFI in an elevated PowerShell window; Windows 11's published requirements include a TPM 2.0 and Secure Boot capable firmware, among others, so read Microsoft's full requirements page for your model before deciding.

A step by step plan for a small business

1. Inventory and classify. Run the Step 5 script on every Windows PC, then add owner, location and purpose. Separate personal devices from business devices.
2. Fix the urgent ones first. Any business owned Windows 10 PC with only Year One coverage stopped receiving fixes after 13 October 2026. Decide this week: buy Year Two, upgrade, or isolate, starting with anything internet facing or holding sensitive data.
3. Upgrade what can be upgraded, budget for the rest. With the ESU price doubling each year, replacement usually beats Year Three.
4. Write down the exceptions for kiosks, lab PCs and controllers, each with an owner and a review date.
5. Verify monthly. After each Patch Tuesday, re-run the inventory and check that LastUpdate moved forward on every covered machine, then update questionnaire and insurance answers with the real counts.

Where Safeguard fits, and where it does not

Safeguard's fit with this question is indirect, and it is better to say so plainly. Safeguard does not patch Windows, does not enroll machines in ESU, does not manage endpoints and is not endpoint protection. If your only problem is Windows 10 PCs, the work above is the work, and it happens in Windows Update, your licensing portal and your network.

Where Safeguard helps is the same problem one layer up. An unsupported operating system on a desk is easy to see. An unsupported runtime inside an application you ship, or an old base image under a container, is much harder to see, and auditors ask about it in the same breath. Our post on SA-22 and unsupported components explains why.

What Safeguard does there, using capabilities that are generally available today:

• SBOM and dependency scanning of repositories, container images and SBOM files, from the CLI (safeguard scan --dir ., safeguard scan --image <name>, safeguard scan --sbom <file>), with results written as JSON under ./output. You see the exact runtime, base image and library versions you build and ship, which you can compare with each project's support policy.
• Vulnerability matching and reachability analysis, so findings in components you actually call rank above findings in code you never reach.
• A cross project view of which projects contain a given component and version, which is the software equivalent of "which of our PCs still run Windows 10". The SBOM incident response post shows that flow.
• Policies and gates evaluated in the platform, so a version you have decided to retire does not come back in next week's build.
• The compliance and GRC workspace, with risks, evidence and questionnaires, where you can record an exception for a system you cannot upgrade yet (including a Windows 10 kiosk), attach the inventory as evidence, assign an owner and set a review date. That is record keeping, not patching, but it is the part auditors ask for.
• The Safeguard CLI assistant, which can edit code and run commands with your approval (permission modes are set with /permissions), for example to help adapt an inventory script. See our post on the Safeguard CLI as a security aware coding assistant.

What none of this does: fix a Windows 10 vulnerability, extend Microsoft's support, or make an unsupported PC safe. Those are Microsoft's and your decisions.

Fix it without waiting for upstream

Windows 10 itself can only be fixed by Microsoft. The software you build and run on top of it is different: when an open source component in your application or container is vulnerable or abandoned, you do not have to wait for anyone's release schedule.

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

Common mistakes

• Using the consumer date for business PCs. The 12 October 2027 consumer date does not apply to domain joined, Entra joined, MDM enrolled or kiosk devices. A business that bought only commercial Year One lost coverage after 13 October 2026.
• Reading an old guide. Anything written before late June 2026 likely gives 13 October 2026 as the consumer end. Check Microsoft's consumer ESU page directly.
• Treating Edge, Microsoft 365 or Defender updates as OS patches. They keep updating into 2028 without ESU, but none of them fix the operating system.
• Enrolling a device that is not on 22H2. ESU applies only to version 22H2. Update first.
• Assuming a license means updates are installing. Check the latest installed update date, not just slmgr.vbs /dlv.
• Calling a machine "isolated" without testing it. Confirm from another device that blocked ports really are blocked, and that the machine cannot reach the internet.
• Applying ESU dates to LTSC or IoT editions. Those follow their own lifecycle pages and are not part of ESU.
• Skipping the paperwork. An undocumented Windows 10 exception looks like neglect to an auditor. The same machine with an owner, compensating controls and a review date looks like a decision.

FAQ

When do Windows 10 security updates really stop?

It depends on the program. Without ESU, they stopped on 14 October 2025. With consumer ESU, they continue until 12 October 2027. With commercial ESU, they continue to the end of the last year you bought: 13 October 2026 for Year One, 12 October 2027 for Year Two, or 10 October 2028 for Year Three.

Did Microsoft extend Windows 10 free security updates to 2027?

Yes, for personal devices. Microsoft's consumer ESU page now says the program ends on 12 October 2027, and a Windows Experience Blog editor's note dated 25 June 2026 records the extra year. The free enrollment routes, syncing settings with Windows Backup or redeeming 1,000 Rewards points, still apply.

Is 13 October 2026 the end of Windows 10 ESU?

Only for commercial ESU Year One. For home users it was the original end date, but Microsoft moved the consumer end date to 12 October 2027. If a guide tells a home user 13 October 2026, it is out of date.

Can I use the free consumer ESU on my work computer?

Not if the computer is joined to an Active Directory domain or to Microsoft Entra, enrolled in MDM, or running in kiosk mode. Microsoft excludes those devices and says the consumer program cannot be used in commercial scenarios. Organizations use the paid commercial program instead.

How do I know if my Windows 10 PC is enrolled in ESU?

For a personal PC, open Settings, Update & Security, Windows Update and check the ESU status shown there. For an organization licensed PC, run slmgr.vbs /dlv in an elevated Command Prompt; Microsoft says an activated device shows the ESU program name with a License Status of Licensed.

Is it safe to keep using Windows 10 without updates?

It is risky, and the risk grows each month as new Windows fixes reveal flaws that will never be fixed on that machine. A fully isolated single purpose machine is far lower risk than an office PC used for email and browsing. If you must keep one, isolate it and document the decision.

Does Microsoft Defender still protect Windows 10?

Microsoft says it will keep providing security intelligence updates for Defender Antivirus on Windows 10 through at least October 2028. Those are malware definitions. They help detect known threats; they do not fix vulnerabilities in Windows itself.

Will Microsoft 365 and Edge keep working on Windows 10?

Yes. Microsoft 365 Apps get security updates until 10 October 2028 (features freeze at Version 2608), and Edge and WebView2 update on 22H2 until at least October 2028, without ESU.

How much does Windows 10 ESU cost for businesses?

Microsoft lists 61 US dollars per device for Year One through volume licensing, doubling each consecutive year for up to three years, and the purchase is cumulative. ESU is included at no additional cost for Windows 10 virtual machines in Windows 365, Azure Virtual Desktop and several Azure platforms.

See how Safeguard would help

The first demo is a real Safeguard CLI session: install, open the terminal with safeguard, ask it to fix the lodash CVE in a repository, and watch it read the advisory, ask before each command, move package.json to lodash 4.17.21, run npm install and npm test with approval and push nothing. The same approve every step flow applies if you ask it to help adapt an inventory script.

Click through it at your own pace, or open it full screen.

The second demo sets up the local runner on your own machine. You approve the runner with its device code, then scan from the terminal. This is the starting point for finding unsupported runtimes, base images and libraries in the code and images you build, the software side of the Windows 10 question.

Click through it at your own pace, or open it full screen.

The third demo connects Claude to the Safeguard MCP server with OAuth and lets you choose which tools Claude can use. Once connected, you can ask about findings and projects in plain language, which helps when a questionnaire asks what unsupported components you ship and you need the answer from your own data.

Click through it at your own pace, or open it full screen.

To try it on your own code, download Safeguard and follow the CLI documentation.

Quick check

Sources

• Microsoft: Windows 10 Consumer Extended Security Updates (ESU) program
• Microsoft: End of support for Windows 10
• Microsoft Learn: Extended Security Updates (ESU) program for Windows 10
• Microsoft Learn: Enable Windows 10 Extended Security Updates (ESU)
• Microsoft Learn: Product Lifecycle FAQ, Extended Security Updates
• Microsoft Learn: Windows 10 end of support and Microsoft 365 Apps
• Microsoft Learn: Microsoft Edge supported operating systems
• Microsoft Learn: Windows 10 Enterprise LTSC 2021 lifecycle
• Microsoft Learn: Windows 10 IoT Enterprise LTSC 2021 lifecycle
• Windows Experience Blog: Stay secure with Windows 11, Copilot+ PCs and Windows 365 before support ends for Windows 10 (editor's note 25 June 2026)
• Windows Experience Blog: How to prepare for Windows 10 end of support by moving to Windows 11 today
• Microsoft Q&A: Windows ESU, does enrollment end on 13 Oct 2026?
• Microsoft Q&A: Windows 10 ESU beyond October 2026
• Microsoft Q&A: Defender security intelligence updates on Windows 10
• Help Net Security: Microsoft gives Windows 10 users an unexpected extra year of free security updates
• CISA: Bad Practices
• TrustedSec: PCI DSS vulnerability management, part 3

Last reviewed: 23 October 2026. Microsoft has changed these dates before; check the linked Microsoft pages for the latest terms.