The Windows 10 ESU Trap: Why Your Bill Just Doubled

A finance director we spoke to last month renewed her firm's Windows 10 security cover without reading the small print, assumed the price was fixed, and budgeted accordingly. Then October arrived. The per-device cost she'd penciled in at $61 had quietly become $122, and the invoice she was staring at was double what she'd signed off. Nobody had tricked her. The pricing had always worked this way. She just hadn't done the sums.

She isn't alone. The Windows 10 Extended Security Updates (ESU) programme is built on a doubling mechanism that catches people out precisely because it looks reasonable at first glance. Year 1 felt cheap. Year 2 doesn't. And if you drift into it without deciding, you'll pay more than a full Windows 11 migration would have cost in the first place.

What actually happened on 13 October 2026

Microsoft ended mainstream support for Windows 10 on 14 October 2025. If you wanted to keep receiving security patches after that date without upgrading, the ESU programme was the official route. For businesses, it's priced per device per year, and here's the part that trips people up: the price doubles each year.

• Year 1 (to 13 October 2026): $61 per device
• Year 2 (from 14 October 2026): $122 per device
• Year 3 (the final year): $244 per device

That Year 1 window has now closed. If your machines are still on Windows 10 and still enrolled, you're in Year 2 territory, paying $122 a device. There's no partial-year opt-out and no pro-rata refund if you migrate halfway through. You buy the year, you've bought the year.

Add it up across the full programme and a single device costs $61 + $122 + $244 = $427 over three years. For a 40-person office, that's north of $17,000 just to keep an operating system on life support that Microsoft has already told you is finished.

The auto-enrolment problem

The real trap isn't the price. It's the drift. Plenty of firms enrolled in Year 1 as a stopgap, fully intending to sort out Windows 11 'in the new year'. The new year came and went, the migration never got prioritised, and the renewal processed automatically. They're now paying double for a decision they never actively made.

If you're in this position, the first thing to do is check your enrolment status before any further charges land. Don't assume the renewal is one you consciously approved. We've seen businesses carrying ESU costs for devices that have since been retired or reassigned, simply because nobody reconciled the licence count against the actual hardware.

Running the real migration maths

Here's where it gets interesting, because the ESU figure only tells you half the story. The honest comparison is ESU-over-three-years versus the one-off cost of moving to Windows 11.

There are two migration scenarios, and which one applies to you depends entirely on your hardware.

Scenario A: Your machines meet the Windows 11 requirements. Windows 11 needs reasonably modern hardware, principally a TPM 2.0 chip and a supported processor. If your fleet was bought in the last four or five years, a good chunk of it probably qualifies. In this case, migration is largely a labour cost: the in-place upgrade itself, testing, application compatibility checks, and the time lost while it's happening. Budget roughly £40 to £80 per device in managed project time, depending on complexity. The Windows 11 upgrade itself is free for licensed Windows 10 machines.

Scenario B: Your machines don't qualify. Older devices need replacing. A decent business-grade laptop or desktop runs £500 to £900, and you'll add migration labour on top. This feels like the expensive option, but look at what you're comparing it against. Three years of ESU is $427 (around £335) per device for software support alone, and at the end of it you still own ageing hardware running an operating system with no future. For a bit more, you get new kit with a warranty, faster machines, and a platform that'll be supported for years.

The maths usually breaks one way. Paying ESU on hardware you'll eventually replace anyway is spending money twice.

The migrate-versus-pay decision matrix

Here's a straightforward way to work out where you stand. Go device by device, or by batch if your fleet is uniform.

| Your situation | The sensible move | |---|---| | Hardware is Windows 11-capable, in good condition | Migrate now. You're paying ESU for no reason. The upgrade is free and the labour cost is less than one year of Year 2 ESU. | | Hardware is older but still useful, due for replacement within 12 months | Migrate on your existing refresh cycle. Avoid Year 3 entirely. Don't buy another year of ESU for machines you're about to bin. | | Hardware is non-compliant, replacement budget not yet available | Pay ESU for one year only, with a firm migration date. Treat it as a bridge, not a destination. Set a hard deadline. | | A handful of machines run legacy software that won't move | Isolate and ESU those specific devices. Pay for the few that genuinely can't migrate, and move everything else. Don't licence the whole fleet to protect a corner of it. | | You're unsure which devices qualify | Audit first. You can't make this decision without knowing your hardware. Most firms are surprised by how many machines already qualify. |

The common thread: ESU is only ever a sensible purchase as a short, deliberate bridge for a specific, named reason. The moment it becomes a default renewal, you're losing money.

What to do this week

Three practical steps, none of which take long.

First, pull an accurate device inventory and mark each machine as Windows 11-capable or not. The free PC Health Check tool from Microsoft tells you per device, or your IT provider can run it across the fleet in an afternoon.

Second, reconcile your ESU licences against that inventory. Cancel cover on anything retired, reassigned, or already migrated. Businesses routinely find they're paying for ghosts.

Third, put a migration date in the calendar and work backwards from it. Even if you need one year of ESU as cover, knowing when the project completes stops you sleepwalking into Year 3 at $244 a device.

The firms getting burned by ESU aren't the ones who chose to pay. They're the ones who never chose at all. The doubling mechanism rewards decisiveness and punishes drift, and the difference between the two is a line in your budget that you either control or don't.

If you'd like a second pair of eyes on your fleet before the next renewal cycle, we run free Windows 11 readiness audits for Nottingham and East Midlands businesses. We'll tell you which machines qualify, what migration actually costs for your setup, and whether any ESU spend is genuinely justified. No sales pressure, just the maths.