Windows 10 After ESU: 4 Paths, Risks and Deadlines
Quick Answer
ESU over: four real paths for a Windows 10 PC in 2026 – upgrade to 11, replace, IoT Enterprise LTSC (patched into 2032), or isolate offline.
- • After ESU ends, Windows 10 keeps booting, activating and running apps — it just stops receiving security patches.
- • Path 1 (upgrade) is free on qualifying hardware: a Pro license carries no per-device upgrade fee.
- • Path 3 is the only sanctioned way to keep Windows 10 binaries patched: IoT Enterprise LTSC 2021, supported until January 13, 2032.
- • Path 4 (offline isolation) is a risk-reduction tactic, not a support program — use it for single-purpose machines only.
01What stops when ESU ends — and what keeps working
The Extended Security Updates program exists for one thing: security-only cumulative updates for Windows 10 22H2. When a device’s ESU coverage lapses — consumer coverage tops out around October 2027 for those who enrolled before the deadline, business ESU can run to October 2028 via volume licensing (see the business ESU/MAK guide) — that patch stream simply stops.
What keeps working: the OS boots, your license stays activated forever (activation is not time-limited), apps install, and browsers keep updating themselves. What changes: every second Tuesday stops bringing OS-level fixes, so known vulnerabilities discovered after the cutoff stay open permanently. Antivirus signatures and browser patches reduce exposure at the edges, but they cannot patch the kernel, drivers or system services. For any machine that touches the internet, that is the whole risk story in one sentence.
02Path 1: Upgrade to Windows 11 on qualifying hardware
This is the default answer for machines that pass the check: TPM 2.0, a supported 64-bit CPU and Secure Boot. The upgrade itself is free — a Windows 10 Pro key carries over, no per-device upgrade fee, and the settings, apps and files migrate in place. If you are still weighing the two systems side by side, the day-to-day differences are smaller than the spec sheet suggests — the linked comparison below covers them.
The decision hinge is hardware age, not willingness: a 2019-or-newer machine usually passes; a 2015-era desktop usually does not. If the check fails, resist the registry-workaround rabbit hole — unsupported installs sit outside Microsoft’s update guarantee, which re-creates the exact no-patches problem you are trying to escape. Buying a new key for an eligible machine costs little: our Windows 11 Pro key buying guide explains license channels and typical pricing.
03Path 2: Replace the machine on its normal cycle
If the hardware fails the Windows 11 check, replacement is the honest answer — and it does not have to happen overnight. ESU (where enrolled) or a short isolation period buys time to budget the purchase. When you buy, note the license situation: a PC that ships with Windows 11 Home can be stepped up to Pro with a single Pro key later, so the cheap-Home-then-upgrade route is legitimate and common.
Data migration is the friction point people underestimate: sign in with the same Microsoft account on the new machine to carry your settings and (for digital-license machines) tie the license to the account first — our consumer ESU enrollment guide walks through the account-binding step, which matters before any hardware change.
04Path 3: Windows 10 IoT Enterprise LTSC 2021 — patched into 2032
This is the little-known escape hatch. Windows 10 IoT Enterprise LTSC 2021 is still Windows 10 — same kernel, same driver model, same apps run on it — but its lifecycle is set by the IoT channel: Microsoft’s lifecycle page lists support until January 13, 2032. For fixed-purpose machines — POS terminals, industrial controllers, lab instruments, digital signage — it is the only sanctioned way to keep running Windows 10 binaries with patches for years more.
The trade-offs are real: LTSC ships without the Store and most inbox apps, it is sold through volume licensing rather than retail, and moving an existing installation means a clean install (there is no in-place conversion from Pro). Our LTSC vs regular Windows comparison details who loses and who wins on that trade. If the use case is a kiosk or a machine that must not change, the entry Windows 10 IoT Enterprise 2021 license is the path to evaluate.
05Path 4: Isolate and freeze — the last resort
Some machines have no upgrade lane (vendor-locked instruments, legacy OT hardware) and no budget line this year. The honest fallback is isolation: keep the machine off the open internet, block inbound traffic at the firewall, remove or never install browsers and email clients, and pin it to one job. An unpatched OS that never touches an untrusted network is a far smaller target — most real-world compromises of end-of-life systems start in a browser tab.
Be clear about what this is: a risk-reduction tactic, not a support program. It works for a dedicated print server in a back office; it does not work for the family PC everyone browses from. Budget a real path for anything user-facing.
06Quick answers before you decide
Can I still buy a Windows 10 key in 2026? Yes — keys still activate and licenses stay valid indefinitely; retail channels (including our Windows 10 Pro listing) continue to serve machines that must stay on 10 for LTSC-style or offline roles. Does Office keep working? The apps run, but Office 2021 reached its own end of support on October 13, 2026 — plan the Office side separately (an Office 2026 or Microsoft 365 plan, per our Office 2021 install guide). Which path for a 2016 laptop used daily? Path 2 — it fails the 11 check, and a daily browsing machine is exactly what isolation cannot protect.
FAQ
Can I keep using Windows 10 after ESU ends?
Yes. The system keeps booting, activating and running software indefinitely – what ends is the monthly security-patch stream. The practical question is exposure: an internet-connected daily-driver is a different risk than an offline single-purpose box.
Is my Windows 10 license still valid after the deadline?
Yes. Activation is not time-limited – your key or digital license stays valid and the machine stays activated. ESU coverage is a separate product; ending it never deactivates Windows.
What is the safest way to stay on Windows 10 after ESU?
Windows 10 IoT Enterprise LTSC 2021 – the IoT-channel edition Microsoft supports until January 13, 2032. It is still Windows 10, patched for years, but requires a clean install and volume-licensing sourcing.
Does Office 2021 still get updates on Windows 10?
No – Office 2021 reached end of support on October 13, 2026, independent of the Windows 10 ESU timeline. The apps keep running, but for patches you plan the Office side separately (Office 2026 or Microsoft 365).
External References
- • Microsoft — Windows 10 end of support and ESU
- • Microsoft Learn — Windows 10 Extended Security Updates program
- • Microsoft Support — consumer ESU FAQ
- • Microsoft Learn — lifecycle: Windows 10 IoT Enterprise LTSC 2021 (to Jan 2032)
- • Microsoft Learn — lifecycle: Windows 10 Enterprise LTSC 2021 (to Jan 2027)
KeyStarter is a Microsoft legitimate reseller/Distributor. This article was compiled with AI assistance for research and drafting and has been editorially reviewed. Prices shown at checkout reflect dealer quotes, not Microsoft official pricing.