AboutFree templates
End of support · Windows

Windows 10 end of support: upgrade to Windows 11 or enrol in ESU

Windows 10 stopped receiving regular security updates on 14 October 2025. This guide covers Windows 11 readiness, the ESU programs and how to upgrade at scale.

Updated 6 phases20 detailed steps10 official sources
Start the planTemplates (5)PDF runbook
Start here

What should you do now Windows 10 support has ended?

Short answer

Windows 10 support ended on 14 October 2025, so PCs still on it no longer get security updates unless they are enrolled in ESU (Extended Security Updates, a paid yearly extension). This is an upgrade project, not a data move.

  • Recommended route: Upgrade eligible PCs in place with Intune, replace the rest with Autopilot
  • Order: Cover the risk first, then upgrade: find every Windows 10 PC, protect the ones that must wait with ESU, then upgrade or replace the rest in rings.
  • 6 phases: Find Windows 10 PCs, Check the hardware, Cover PCs that must wait, Upgrade in place, Reimage or replace and Retire old PCs.
  • You're done when: Every Windows 10 PC left is on your ESU or LTSC list with a replacement date.

The recommended route upgrades PCs that meet the Windows 11 hardware rules in place, reimages or replaces the rest with Windows Autopilot (Microsoft's service that sets up a PC from the cloud at first start), and buys ESU only for PCs that cannot move in time. Business ESU is bought per PC, per year, through Microsoft Volume Licensing (licences bought through a Microsoft licensing partner; the minimum order is one licence). The time is set by your pilot testing and by how quickly you can replace PCs that fail the hardware check.

Recommended routeUpgrade eligible PCs in place with Intune, replace the rest with Autopilot

Users keep their apps and files on PCs that can run Windows 11, and replacement PCs arrive with a clean, standard build.

Other options and when to use them
  • Extended Security Updates for organisations: Some PCs cannot be upgraded or replaced in time. Bought per PC, per year, through Microsoft Volume Licensing, for up to three years after end of support.
  • Consumer ESU: A home PC that is not joined to a domain or Entra ID and not managed by Intune or another MDM service. Coverage runs to 12 October 2027.
  • Move users to Windows 365 or Azure Virtual Desktop: You already use or plan cloud desktops. ESU is included at no extra cost there.
Tools for this plan
Not sure which route?Answer 6 quick questionsAre you ready?22-question readiness checkPlan your datesDated countdown you can add to your calendarTell your staffStaff guide and ready-to-send emailsNew to the jargon?Plain-English migration glossary
Order to migrate in, and why

Cover the risk first, then upgrade: find every Windows 10 PC, protect the ones that must wait with ESU, then upgrade or replace the rest in rings. User files are backed up before any PC is upgraded or wiped, and old PCs are only retired once their replacements work.

  1. Inventory every Windows 10 PC and update each to version 22H2ESU only covers 22H2, and the inventory is the list every later step works from.
  2. Hardware check, and firmware fixes for TPM, Secure Boot and disk layoutMany PCs that report "not capable" only need a setting changed, which shrinks the replacement and ESU lists.
  3. ESU for PCs that cannot move soonSupport has already ended, so these PCs miss every monthly security fix until they are enrolled.
  4. OneDrive Known Folder Move turned on for every userIt backs up Desktop, Documents and Pictures before any upgrade or reset, and needs a few weeks to finish.
  5. Pilot ring: one PC per department and hardware modelShows which apps, drivers and agents fail on Windows 11 while only a few people are affected, and the 10-day undo window is still open.
  6. Broad upgrade rings for capable PCsOnce the pilot signs off, rings spread the risk and the help desk load.
  7. Reimage or replace PCs that cannot upgrade, using AutopilotThese take the longest because of ordering and set-up, and each one shortens your ESU list.
  8. Retire old PCs and record drive disposalA wipe or drive destruction cannot be undone, so it waits until the replacement is working and the data is checked.
Settings checklist: decide these before you copy

Built-in and third-party tools treat these differently. Tick each one off once you have decided.

Download this checklist (Excel)
  • How each tool handles it
    Built-in methodBusiness ESU needs Windows 10, version 22H2, on Pro, Enterprise or Education in commercial use. Windows 10 LTSB and LTSC releases are not covered by ESU and have their own end dates.

    Tip: List LTSC PCs (kiosk, medical and industrial builds) separately and check each on the Microsoft Lifecycle site.

    Microsoft Learn: Enable Windows 10 Extended Security Updates
  • How each tool handles it
    Built-in methodWindows 11 needs TPM 2.0 (a security chip), UEFI with Secure Boot, an approved processor, 4 GB of memory and 64 GB of storage. Many PCs fail only because TPM or Secure Boot is switched off, or the disk uses the old MBR layout.

    Tip: Turn on firmware TPM, convert the disk with MBR2GPT and enable Secure Boot before marking a PC for replacement.

    Microsoft Support: Windows 11 system requirements
  • How each tool handles it
    Built-in methodIn the Endpoint analytics Work from anywhere report, Unknown usually means the PC has not reported for 29 days.

    Tip: Find or remove these PCs before you size ESU or replacement orders.

    Microsoft Learn: Work from anywhere report (Endpoint analytics)
  • How each tool handles it
    Built-in methodAn in-place upgrade keeps apps, settings and files. A reimage or replacement starts clean, and Autopilot sets the PC up from Intune at first start.

    Tip: Record one path and one date for every PC in your inventory.

    Microsoft Learn: Overview of Windows Autopilot
  • How each tool handles it
    Built-in methodBought per PC, per year, through Microsoft Volume Licensing, for up to three years after end of support. You cannot buy part of a year, and years are cumulative: a PC that joins in Year Two also pays for Year One. Windows 10 in Windows 365, Azure Virtual Desktop and Azure virtual machines gets ESU at no extra cost.

    Tip: Ask your Microsoft partner for a Volume Licensing quote. Exclude cloud desktops from the count.

    Microsoft Learn: Extended Security Updates for Windows 10
  • How each tool handles it
    Built-in methodEach PC needs KB5066791 or later, then the ESU Licensing Preparation Package KB5072653. You install the MAK (Multiple Activation Key) from the Microsoft 365 admin center with slmgr, then activate the activation ID for each program year. Online activation needs the licensing addresses Microsoft lists to be reachable.

    Tip: Allow the activation addresses through your proxy first, and use phone or VAMT proxy activation for PCs with no internet.

    Microsoft Learn: Enable Windows 10 Extended Security Updates
  • How each tool handles it
    Built-in methodConsumer ESU runs to 12 October 2027. Enrolment is free when you back up PC settings with Windows Backup, or uses Microsoft Rewards points or a one-time purchase. It is not offered to PCs joined to an Active Directory domain or Entra ID, enrolled in MDM (such as Intune), or in kiosk mode. PCs that are only Entra registered (a work account added to a personal PC) can still use it.

    Tip: Treat any PC your business manages as a business ESU PC.

    Microsoft: Windows 10 Extended Security Updates (consumer)
  • How each tool handles it
    Built-in methodA Windows 10 PC that cannot run Windows 11 but is targeted by an Intune Windows 11 policy stops getting Windows 10 feature updates. The policy has an option to install the latest Windows 10 update on those PCs instead, which cannot be changed after the policy is created.

    Tip: Exclude Not capable PCs from the group, or tick the option when you create the policy.

    Microsoft Learn: Upgrade to Windows 11 with Intune
  • How each tool handles it
    Built-in methodNot stated in Microsoft's documentation which of your own apps, VPN clients or security agents work on Windows 11: test them in your pilot. A failing app can hold back PCs.
    Microsoft FastTrack App AssureMicrosoft engineers help fix app compatibility issues, including in-house apps. Part of FastTrack for eligible plans.

    Tip: Cover every department and hardware model in the pilot, and keep affected PCs on ESU while a vendor fixes their app.

    Microsoft Learn: Feature update policy for Windows in Intune
  • How each tool handles it
    Built-in methodGoing back to Windows 10 works only while Windows.old remains, usually 10 days.

    Tip: Check pilot PCs straight after upgrade, and use Settings > System > Recovery > Go back if needed.

    Microsoft Learn: Upgrade to Windows 11 with Intune
  • How each tool handles it
    Built-in methodA reset removes local files. OneDrive Known Folder Move protects only Desktop, Documents and Pictures, and only once they show as backed up.
    User State Migration Tool (USMT)Captures and restores the wider user profile and settings. Not supported for Entra joined PCs, so use it for domain joined refreshes.

    Tip: Turn on Known Folder Move by policy weeks ahead, and ask users to move other files into OneDrive.

  • How each tool handles it
    Built-in methodRetiring or wiping a PC in Intune and deleting its Autopilot registration does not remove its Active Directory computer account or sanitise its drive.

    Tip: Keep a record or certificate of destruction for each serial number, with the approver.

The plan, phase by phase
  1. 1

    Find Windows 10 PCs

    Watch out: Windows 10 LTSB and LTSC releases are not covered by the Windows 10 ESU program.

    Ways around it

    • Check each LTSC release's own end of support date on the Microsoft Lifecycle site.
    Show the detailed steps (2) →
  2. 2

    Check the hardware

    Watch out: Many PCs reported as not capable only have TPM or Secure Boot switched off, or a legacy-boot disk.

    Ways around it

    • Turn on firmware TPM, convert the disk with MBR2GPT and enable Secure Boot before marking a PC for replacement.

    Watch out: Readiness status Unknown usually means the PC has not reported for 29 days.

    Ways around it

    • Find or remove these PCs before you size ESU or replacement orders.
    Show the detailed steps (3) →
  3. 3

    Cover PCs that must wait

    Before the next monthly security release

    Watch out: Business ESU only: years are cumulative, so a PC that joins in Year Two (the current ESU year) also pays for Year One.

    Ways around it

    • Set a replacement date per PC so you do not roll into Year Three by default.

    Watch out: Online activation fails if the proxy blocks Microsoft's activation and licensing addresses.

    Ways around it

    • Allow the endpoints Microsoft lists, or use phone or VAMT proxy activation for offline PCs.
    Show the detailed steps (5) →
  4. 4

    Upgrade in place

    Watch out: A PC that cannot run Windows 11 but is targeted by the policy stops getting Windows 10 feature updates.

    Ways around it

    • Tick the option to install the latest Windows 10 update on incapable PCs, or exclude them from the group. The option cannot be changed later.

    Watch out: A business app that fails on Windows 11 can hold PCs back.

    Ways around it

    • Ask the vendor for a fix, or cover the affected PCs with ESU while you wait.

    Tools that can do it

    Watch out: Going back to Windows 10 works only for a limited time, usually 10 days, while Windows.old remains.

    Ways around it

    • Check pilot PCs straight after upgrade, and use Settings > System > Recovery > Go back if needed.
    Show the detailed steps (3) →
  5. 5

    Reimage or replace

    Watch out: A reset removes local files, and Known Folder Move only protects the folders it redirects.

    Ways around it

    • Ask users to move other files into OneDrive, and only wipe once folders show as backed up.

    Tools that can do it

    • User State Migration Tool (USMT)Captures and restores the wider user profile and settings. Not supported for Entra joined PCs, so use it for domain joined refreshes.
    Show the detailed steps (3) →
  6. 6

    Retire old PCs

    Watch out: Wipes, resets and drive sanitisation cannot be undone.

    Ways around it

    • Log the backup check and an approver for each PC before you wipe it.
    Show the detailed steps (2) →
You are finished when
  • Every Windows 10 PC left is on your ESU or LTSC list with a replacement date.
  • ESU PCs show Licensed in slmgr /dlv and install the latest monthly security update.
  • Upgraded PCs show your Windows 11 version in the Feature Updates report, with apps signed off.
  • Retired PCs are gone from Intune, Autopilot and Active Directory, with a disposal record each.

Tools named in this plan are independent third-party products, not endorsed by the platform vendor and not paid placements. Check the tool's own documentation and run a pilot first.

Click by click

What does each step involve?

Open a part when you reach it in the plan. Each step says where to go, what to do and what you should see.

About this migrationWhat it covers, limits at a glance

Windows 10 reached end of support on 14 October 2025. PCs still work, but without ESU they no longer receive security updates. The long-term fix is Windows 11, either on existing hardware that meets the requirements or on replacement PCs.

ESU buys time for PCs that cannot be upgraded or replaced yet. It is sold by year and does not include new features or general support. This guide describes how the programs work, not prices; check Microsoft's current pricing.

End of support14 October 2025 (Windows 10, version 22H2 is the last version)
Business ESUUp to three years, bought by year, cumulative
Consumer ESUCoverage to 12 October 2027
No-extra-cost ESUWindows 10 VMs in Windows 365, Azure Virtual Desktop, Azure VMs and some Azure-hosted platforms
Hardware gateTPM 2.0, UEFI with Secure Boot, approved CPU, 4 GB RAM, 64 GB storage
1What you need before step one
NeedDetailsWhere to get it
Intune Administrator (managed fleets)To view Endpoint analytics, create feature update policies and manage Autopilot.Microsoft Intune admin center, https://intune.microsoft.com
Product Key Reader or VL AdministratorTo view the business ESU MAK in the Microsoft 365 admin center.Microsoft 365 admin center, https://admin.microsoft.com
Local admin on each PCTo run PC Health Check, the TPM checks and the slmgr commands.Your desktop team
RSAT Active Directory module (no Intune)For the Get-ADComputer inventory query.Windows: Settings > System > Optional features
PC Health Check appFor checking single PCs.https://aka.ms/GetPCHealthCheckApp
ESU licences (if needed)Business ESU through Volume Licensing, or consumer ESU enrolled on the PC.Your licensing partner or Microsoft; check current pricing
OneDrive Known Folder MoveUser files backed up before any reset or replacement.OneDrive sync app or your Intune OneDrive policy
2Inventory Windows 10 devices2 steps
  1. 1

    List devices and versions

    Where: Microsoft Intune admin center > Devices > Windows (filter by OS version). Without Intune: PowerShell with the RSAT Active Directory module

    In Intune, filter devices by OS version and export the list. Without Intune, query Active Directory for Windows 10 computer accounts.

    Get-ADComputer -Filter 'OperatingSystem -like "Windows 10*"' -Properties OperatingSystem,OperatingSystemVersion,LastLogonDate | Select-Object Name,OperatingSystemVersion,LastLogonDate | Export-Csv .\win10-devices.csv -NoTypeInformation
    You should see: A list of every Windows 10 device with its build number (22H2 is build 19045).
  2. 2

    Confirm version 22H2

    Where: PowerShell on the PC, or the OS version column in Intune

    ESU requires Windows 10, version 22H2. Upgrade any older builds to 22H2 first.

    Get-ComputerInfo -Property OsName,OSDisplayVersion,OsBuildNumber
    You should see: OSDisplayVersion shows 22H2 and OsBuildNumber shows 19045.
3Check Windows 11 hardware readiness3 steps

Microsoft lists these minimum requirements: a 1 GHz or faster processor with two or more cores on the approved CPU list, 4 GB RAM, 64 GB or larger storage, UEFI firmware that is Secure Boot capable, TPM 2.0, a DirectX 12 compatible graphics card with a WDDM 2.0 driver, and a display of 720p or higher. Windows 11 Home needs internet access and a Microsoft account during setup.

  1. 1

    Single PCs: PC Health Check

    Where: The PC: install from https://aka.ms/GetPCHealthCheckApp, then Start > PC Health Check

    Open PC Health Check and select Check now. It shows whether the PC meets the requirements and what to fix.

    You should see: Either a message that the PC meets the Windows 11 requirements, or a list of the requirements it fails (for example TPM or Secure Boot).
  2. 2

    Fleets: Endpoint analytics

    Where: Microsoft Intune admin center > Reports > Endpoint analytics > Work from anywhere > Windows tab

    For Intune-managed or co-managed devices, open the Work from anywhere report. Select the Windows score category for the top blockers, then the Windows tab for readiness per device. Devices must have sent endpoint analytics data in the last 29 days.

    You should see: Each device shows a Windows 11 readiness status (Capable, Not capable, Upgraded or Unknown) and, for Not capable, the Windows 11 readiness reason.
  3. 3

    Check TPM and Secure Boot locally

    Where: Elevated PowerShell on the PC, then the PC's firmware setup if a setting is off

    Many failures are settings, not hardware. TPM or Secure Boot may simply be disabled in firmware.

    Get-Tpm
Confirm-SecureBootUEFI
    You should see: Get-Tpm shows TpmPresent and TpmReady as True, and Confirm-SecureBootUEFI returns True.
Classify each device. Sort devices into: ready now, ready after a firmware change, needs replacement, or needs ESU while waiting for replacement.
4ESU for organisations5 steps
ESU program yearActivation ID
Year 1f520e45e-7413-4a34-a497-d2765967d094
Year 21043add5-23b1-4afb-9a0f-64343c8f3f8d
Year 383d49986-add3-41d7-ba33-87c7bfb5c0fb
  1. 1

    Know the structure

    Where: Microsoft Learn: Extended Security Updates for Windows 10, and your Licensing assessment template

    Business ESU is bought per year for up to three years after end of support, starting from Year One in November 2025. You cannot buy part of a year, and the years are cumulative: joining in Year Two means paying for Year One too. The minimum purchase is one licence. Eligible editions are Enterprise, Education and Pro in commercial use.

    You should see: The licensing assessment lists how many devices need ESU and for which years.
  2. 2

    Check for no-extra-cost coverage

    Where: Your device inventory, filtered for virtual machines and Windows 365 users

    Microsoft includes ESU at no additional cost for Windows 10 VMs in Windows 365, Azure Virtual Desktop, Azure VMs, Azure Dedicated Host, Azure VMware Solution, Nutanix Cloud Clusters on Azure, Azure Local, Azure Stack Hub and Azure Stack Edge. Windows 10 devices connecting to Windows 365 Cloud PCs are also entitled to ESU with an active Windows 365 licence.

    You should see: Devices covered at no extra cost are removed from the ESU purchase count.
  3. 3

    Install prerequisites

    Where: Windows Update on each device, or your update tool (Intune, Configuration Manager or WSUS)

    Devices need Windows 10, version 22H2 with KB5066791 or later, then the ESU Licensing Preparation Package KB5072653, installed after KB5066791.

    Get-HotFix -Id KB5072653
    You should see: Get-HotFix returns KB5072653 as installed.
  4. 4

    Get the ESU key

    Where: Microsoft 365 admin center > Billing > Your products > Volume licensing tab > View contracts > the License ID > More actions > View product keys

    Sign in with an account that has the Product Key Reader or VL Administrator role, open the contract the ESU licences are under and copy the ESU MAK.

    You should see: The Product keys page lists the Windows 10 ESU MAK for your contract.
  5. 5

    Install and activate the ESU key

    Where: Elevated Command Prompt on each device (or a script deployed by your management tool)

    Install the MAK, then activate with the activation ID for the program year (table below). Devices without internet access can use phone activation or VAMT proxy activation.

    slmgr.vbs /ipk <ESU MAK>
slmgr.vbs /ato f520e45e-7413-4a34-a497-d2765967d094
slmgr.vbs /dlv
    You should see: slmgr /dlv shows the ESU program name with License Status: Licensed.
LTSB and LTSC are separate. Windows 10 LTSB and LTSC releases are not covered by the Windows 10 ESU program and follow their own lifecycle.
5ESU for home and very small businesses2 steps
  1. 1

    Enrolment options

    Where: The PC: Settings &gt; Update &amp; Security &gt; Windows Update &gt; Enroll now

    Select Enroll now and sign in with a Microsoft account if you use a local account. Microsoft offers three ways to enrol a home PC: back up PC settings with Windows Backup, redeem Microsoft Rewards points, or make a one-time purchase. Coverage runs to 12 October 2027. To add another PC, select Enroll now on that PC with the same Microsoft account and choose Add device.

    You should see: Windows Update shows the PC is enrolled in Extended Security Updates.
  2. 2

    Requirements

    Where: The PC: Settings &gt; System &gt; About (edition and version) and Settings &gt; Accounts (account type)

    The PC must run Windows 10, version 22H2 (Home, Pro, Pro Education or Workstations), have the latest updates including the licensing preparation package Microsoft names on its ESU page, and be enrolled with a Microsoft account that has administrator rights. Child accounts are not eligible. One ESU licence can be used on up to 10 devices.

    You should see: The Enroll now link appears in Windows Update. If it does not, one of these requirements is not met.
6Upgrade in place with Intune3 steps
  1. 1

    Create a feature update policy

    Where: Microsoft Intune admin center &gt; Devices &gt; Windows &gt; Windows updates &gt; Feature updates &gt; Create profile

    On Deployment settings enter a name and choose a Windows 11 version under Feature update to deploy. Set Rollout options, select Next, assign device groups, then Create on Review + create. Submitting the policy accepts the Windows 11 licence terms on behalf of the organisation.

    You should see: The policy appears in the Feature updates list with its assignments.
  2. 2

    Decide what happens to ineligible PCs

    Where: Same Create profile page &gt; Deployment settings

    Tick When a device isn't capable of running Windows 11, install the latest Windows 10 feature update if you want one policy for all devices. This setting cannot be changed on an existing policy; to change it, delete the policy and create a new one.

    You should see: The checkbox shows as set in the policy properties.
  3. 3

    Pilot, then ring out

    Where: Intune admin center: the policy &gt; Properties &gt; Assignments &gt; Edit; then Reports &gt; Windows Updates &gt; Reports tab &gt; Feature Updates report

    Assign to a pilot group, check application compatibility and help desk calls, then widen the assignment in rings. Generate the Feature Updates report for the policy to track progress.

    You should see: Pilot devices show as updated in the report, and devices waiting to install show OfferReady.
Ineligible devices stop getting Windows 10 updates. Microsoft notes that if a Windows 10 device that cannot run Windows 11 is targeted with a Windows 11 update, it is not offered further Windows 10 feature updates automatically. Move it to a Windows 10 policy.
7Reimage or replace with Autopilot3 steps

A clean Windows 11 install removes years of drift. Autopilot transforms the OEM Windows installation into a business-ready state with Entra ID join, Intune enrolment, apps and policies, so you do not maintain custom images.

  1. 1

    Register existing devices

    Where: Elevated PowerShell on each device, then Intune admin center &gt; Devices &gt; Windows &gt; Enrollment &gt; Windows Autopilot &gt; Devices &gt; Import

    Collect the hardware hash from existing PCs and import it into Intune, or ask your reseller to register new PCs for you. Full steps: export an Autopilot hardware hash.

    Install-Script -Name Get-WindowsAutopilotInfo -Force
Get-WindowsAutopilotInfo -OutputFile C:\Temp\autopilot.csv
    You should see: The device appears in the Windows Autopilot devices list with a profile assigned.
  2. 2

    Back up user data

    Where: OneDrive sync app on each PC (OneDrive icon &gt; Settings &gt; Sync and back up &gt; Manage back up), or your Intune OneDrive policy

    Make sure Known Folder Move to OneDrive is on and synced for Desktop, Documents and Pictures before wiping any device.

    You should see: The OneDrive icon shows files are up to date, and the folders show as backed up.
  3. 3

    Reset or install Windows 11

    Where: Intune admin center &gt; Devices &gt; All devices &gt; the device &gt; Wipe, or Windows 11 installation media on the device

    Install Windows 11 or reset the device. At the out-of-box experience Autopilot applies your profile. Use Autopilot Reset to repurpose devices later.

    You should see: The device shows your organisation's sign-in page during setup and enrols in Intune as a Windows 11 device.
8Retire and dispose of old PCs2 steps
  1. 1

    Remove from management

    Where: Intune admin center &gt; Devices &gt; All devices &gt; the device &gt; Retire or Wipe; Windows Autopilot devices list; Active Directory (PowerShell)

    Retire or wipe the device in Intune, delete the Autopilot registration if it will not be reused, and remove the computer object from Active Directory.

    Remove-ADComputer -Identity PC-0123 -Confirm:$false
    You should see: The device no longer appears in Intune, the Autopilot list or Active Directory.
  2. 2

    Sanitise storage

    Where: The PC before it leaves your control (Settings &gt; Update &amp; Security &gt; Recovery &gt; Reset this PC &gt; Remove everything), or your disposal provider

    Wipe or destroy drives before disposal and keep a record for compliance. If you use a disposal provider, get a certificate of destruction listing each serial number.

    You should see: A disposal record with the device serial number, method and date.
Worth knowing

What can go wrong, and how do you avoid it?

The detail behind the plan: options compared, and what experienced engineers check first. Tap any item.

Compare all the ways to do this4 options
Not sure which? Answer 6 quick questionsOur decision helper recommends an approach and tells you why.Start →

Upgrade in place to Windows 11 with Intune

Low effort

Best for: PCs that meet the Windows 11 hardware requirements

  • Users keep their apps, settings and files
  • An Intune feature update policy rolls it out in rings
  • Years of configuration drift come along with it
  • Ineligible PCs must not be targeted by the policy
Read more →

Reimage or replace with Windows Autopilot

High effort

Best for: PCs due for replacement, or fleets moving to Entra join and Intune

  • A clean Windows 11 install with no custom image to maintain
  • Devices arrive Entra joined and enrolled in Intune with apps and policies
  • User data must be backed up first, for example with OneDrive Known Folder Move
  • Hardware replacement takes budget and lead time
Read more →

Extended Security Updates for PCs that cannot move yet

Low effort

Best for: PCs that cannot upgrade or be replaced in time, such as those running line-of-business apps not yet tested

  • Security updates continue for up to three years for organisations
  • Buys time without changing the PC
  • Bought by year and cumulative: joining late still costs the earlier years
  • No new features or general support, and LTSB and LTSC releases are not covered
Read more →

Move users to Windows 365 or Azure Virtual Desktop

Medium effort

Best for: Organisations already using or planning cloud desktops

  • ESU is included at no additional cost for Windows 10 VMs on these platforms
  • Windows 10 devices connecting to Windows 365 Cloud PCs are also entitled to ESU with an active Windows 365 licence
  • A new desktop platform to design, license and support
  • A stopgap for the local Windows 10 PC unless it is replaced later
Read more →
Our advice

Check hardware readiness first: many PCs that report as not capable only need TPM or Secure Boot turned on in firmware. Upgrade eligible PCs in place, reimage or replace the rest with Autopilot, and buy ESU only for the PCs that cannot move in time. Check whether any Windows 10 desktops already qualify for ESU at no extra cost before you buy it.

Joining business ESU late still costs the earlier yearsCost lever

Microsoft sells business ESU by year and the years are cumulative: a device that joins in Year Two must also pay for Year One.

What to do

Count which devices truly cannot be upgraded or replaced, buy ESU only for those, and set a replacement date for each so you do not roll into Year Three by default. Check the vendor's current pricing.

Microsoft Learn: Extended Security Updates for Windows 10
Many "not capable" PCs only need a firmware changeCost lever

TPM 2.0 and Secure Boot are often present but switched off, or the disk is still MBR with legacy boot. Replacing these PCs wastes money.

What to do

Check the Windows 11 readiness reason in Endpoint analytics, then on a sample run Get-Tpm and Confirm-SecureBootUEFI. Enable firmware TPM, convert the disk with MBR2GPT and enable Secure Boot before you mark a PC for replacement.

Microsoft Learn: Work from anywhere report
Unknown readiness usually means inactive devicesCost lever

Microsoft says devices with readiness status Unknown are mostly inactive, meaning they have not sent endpoint analytics data in the past 29 days.

What to do

Treat Unknown as a prompt to find the device: it may be retired, in a drawer or not enrolled properly. Clean these up before you size ESU or replacement orders.

Microsoft Learn: Work from anywhere report
Do not target ineligible PCs with a Windows 11 policyReduces risk

Microsoft notes that a Windows 10 device that cannot run Windows 11, targeted with a Windows 11 update, is not offered further Windows 10 feature updates automatically.

What to do

Either tick the option to install the latest Windows 10 feature update on incapable devices when you create the policy, or exclude Not capable devices from the Windows 11 policy group.

Microsoft Learn: Upgrade to Windows 11 with Intune
Install ESU prerequisites in the right orderSaves time

Microsoft requires KB5066791 or later, then the ESU Licensing Preparation Package KB5072653 installed after it. Activation fails on devices that are missing either.

What to do

Deploy the updates through your normal update ring first, check with Get-HotFix, and only then push the slmgr activation script.

Microsoft Learn: Enable Windows 10 Extended Security Updates
Allow the activation endpoints through your proxySaves time

Microsoft lists a set of activation and licensing URLs (such as activation.sls.microsoft.com and validation-v2.sls.microsoft.com) that devices must reach to activate the ESU key online.

What to do

Allow the endpoints Microsoft lists before deployment. For offline devices plan phone activation or VAMT proxy activation instead.

Microsoft Learn: Enable Windows 10 Extended Security Updates
Check virtual desktops before buying ESUCost lever

Microsoft includes ESU at no additional cost for Windows 10 in Windows 365, Azure Virtual Desktop, Azure VMs and several Azure-hosted platforms.

What to do

Exclude these machines from the ESU purchase. For PCs that cannot be replaced in time, consider whether users could work from a Cloud PC instead.

Microsoft Learn: Extended Security Updates for Windows 10
Back up user data before any resetUser impact

Reimaging or replacing a PC removes local files. Desktop and Documents folders that were never synced are the most common complaint after a refresh.

What to do

Turn on OneDrive Known Folder Move by policy weeks before the refresh, check sync health per device, and only wipe once the folders show as backed up.

Tools that can get around this

Known Folder Move only protects the folders it redirects. USMT captures the wider user state (profile folders, document files elsewhere on fixed drives, mapped drives and printers, certificates and app settings) before the reset and restores it into the new Windows installation.

Third-party tools, not endorsed by the platform vendor. Confirm in the tool's documentation and run a pilot first.
Test line-of-business apps in a pilot ringUser impact

Old drivers, VPN clients, security agents and line-of-business apps are the usual reasons an in-place upgrade fails or a help desk queue spikes.

What to do

Assign the feature update policy to a pilot group that covers each department and hardware model, collect app owner sign-off, then widen the rings.

Tools that can get around this

When a business-critical app fails on Windows 11 in the pilot and the vendor or developer cannot fix it, Microsoft's App Assure engineers help remediate the issue, including for in-house line-of-business and ISV apps, instead of leaving the device on Windows 10.

  • Microsoft FastTrack App AssureRemediates app compatibility issues on Windows 10 and Windows 11 for customer-developed, ISV and Microsoft apps. Part of the FastTrack benefit for eligible Microsoft 365 and Windows plans; request help at aka.ms/appassurerequest.
Third-party tools, not endorsed by the platform vendor. Confirm in the tool's documentation and run a pilot first.
Windows 10 LTSC devices follow a different clockCompliance

Microsoft says Windows 10 LTSB and LTSC releases are not covered by the Windows 10 ESU program and have their own lifecycle dates.

What to do

Separate LTSC devices (kiosks, medical and industrial PCs) in the inventory and check each release's own end of support date on the Microsoft Lifecycle site.

Microsoft Learn: Enable Windows 10 Extended Security Updates
Finish safely

How do you check it worked, or roll back?

Full validation checklist8 checks

Run these before you declare the migration complete. Record the results in the data validation report.

CheckHow to checkWhat good looks like
No unplanned Windows 10 devices remain

In the Microsoft Intune admin center go to Devices > Windows, filter by OS version and export. Without Intune, rerun the Get-ADComputer -Filter 'OperatingSystem -like "Windows 10*"' query from Step 1.

Every Windows 10 device left is on your ESU list or the LTSC list, with a replacement date; Unknown devices have been found or removed.
Upgraded devices are on Windows 11

In the Intune admin center open Reports > Windows Updates and generate the Feature Updates report for your policy. On a sample PC run Get-ComputerInfo -Property OsName,OSDisplayVersion,OsBuildNumber.

Devices in the policy show the Windows 11 version you chose; failures and Not capable devices are listed with an action.
ESU is installed and activated where you bought it

On each ESU device run Get-HotFix -Id KB5072653, then slmgr.vbs /dlv in an elevated Command Prompt and look for the ESU entry.

The preparation package is installed and the ESU licence shows License Status: Licensed for the current program year.
ESU devices receive security updates

After the next monthly security release, check Windows Update history on a sample of ESU devices, or the update report in your management tool.

ESU devices install the latest Windows 10 security update without errors.
User data and OneDrive sync survived the upgrade or reset

On a sample of upgraded and reimaged PCs, sign in as the user, open OneDrive (icon > Settings > Sync and back up > Manage back up) and open files from Desktop and Documents.

Desktop, Documents and Pictures show as backed up, files open, and OneDrive shows no sync errors.
Apps, Outlook and Teams work on Windows 11

On pilot devices from each department and hardware model, open Outlook, Teams and each line-of-business app, print to a network printer and connect to VPN if used.

Every app opens and works, and app owners sign off the pilot ring before rings widen.
Devices are compliant and managed

In the Intune admin center open Devices > Monitor > Device compliance, and on a sample PC check Settings > Accounts > Access work or school.

Upgraded and Autopilot devices show Compliant and are connected to the organisation; Conditional Access lets users sign in.
Retired PCs are gone from every system

Check the retired device list against Intune > Devices > All devices, the Windows Autopilot devices list and Active Directory, and match serial numbers against the disposal certificate.

No retired PC appears in Intune, Autopilot or AD, and every serial number is on a certificate of destruction or sanitisation record.
Rollback planIf it goes wrong

Roll back if

  • A line-of-business app or device driver fails on Windows 11 in the pilot ring and the vendor has no fix in time
  • Help desk calls from a ring exceed what you agreed in the pilot test plan
  • ESU activation fails across many devices
  • A reimaged device is missing user data that was not in OneDrive

Point of no return

An in-place upgrade can be undone on the device for a limited time: Microsoft says usually 10 days, and only while the Windows.old folder is still there. After that, going back to Windows 10 means a clean install. A wipe, reset or Autopilot reimage cannot be undone, and any data not backed up to OneDrive is lost. A sanitised or destroyed drive cannot be recovered.

  1. 1

    Stop the rollout

    Where: Microsoft Intune admin center > Devices > Windows > Windows updates > Feature updates > the policy > Properties > Assignments > Edit

    Remove the wider rings from the assignment so no more devices upgrade, and keep the pilot group while you investigate.

    You should see: The Feature Updates report shows no new devices starting the upgrade.
  2. 2

    Go back to Windows 10 on an affected PC

    Where: The PC: Settings > System > Recovery > Go back

    Within the go-back period, select Go back and follow the prompts. Remove any user accounts added after the upgrade first. Microsoft says apps and drivers installed after the upgrade, and settings changes, are removed.

    You should see: The PC restarts on Windows 10 and Get-ComputerInfo -Property OsName,OSDisplayVersion shows Windows 10, version 22H2.
  3. 3

    Keep reverted PCs off Windows 11

    Where: Microsoft Intune admin center > Groups, then the feature update policy assignments

    Add reverted devices to a group excluded from the Windows 11 policy, and assign them to a Windows 10 feature update or ESU plan until the blocker is fixed.

    You should see: Reverted devices do not receive the Windows 11 upgrade again.
  4. 4

    Cover reverted PCs with ESU

    Where: Elevated Command Prompt on each reverted device

    Check the prerequisites with Get-HotFix -Id KB5072653, then install and activate the ESU key with slmgr.vbs /ipk and slmgr.vbs /ato as in the ESU section. Make sure your ESU licence count includes these devices.

    You should see: slmgr.vbs /dlv shows the ESU licence as Licensed.
  5. 5

    Restore data after a reset

    Where: OneDrive on the web (https://onedrive.com), Settings > Restore your OneDrive

    If a reset device is missing files, check the user's OneDrive and use Restore your OneDrive to an earlier point if files were deleted or changed by the sync.

    You should see: The user's files are back in Desktop, Documents and Pictures.
  6. 6

    Record what cannot be undone

    Where: Your Rollback plan and Decommission checklist

    Note that wipes, resets, Autopilot reimages and drive sanitisation are one-way, and that the go-back option ends after the period Microsoft states. Only wipe a device after OneDrive shows its folders as backed up.

    You should see: Each wipe and disposal is logged with the backup check and approver.

Agree the triggers and who decides before the go / no-go meeting. Use the rollback plan template.

Common problems and fixes5 errors
PC Health Check: "This PC doesn't currently meet Windows 11 system requirements" (TPM)

Cause: TPM is disabled in firmware or the device only has TPM 1.2.

Fix: Enable TPM (Intel PTT or AMD fTPM) in firmware; replace the device if only TPM 1.2 is present.

PC Health Check fails on Secure Boot

Cause: The PC boots in legacy BIOS mode or Secure Boot is turned off.

Fix: Convert the disk to GPT (MBR2GPT), switch firmware to UEFI and enable Secure Boot.

slmgr /ato returns an activation error for the ESU key

Cause: Prerequisite updates are missing or the device cannot reach the activation endpoints.

Fix: Install KB5066791 or later and KB5072653, allow access to the activation and validation endpoints, then retry or use phone activation.

Device targeted by Windows 11 policy stays on an old Windows 10 build

Cause: The device cannot run Windows 11 and is not offered Windows 10 feature updates while targeted.

Fix: Remove it from the Windows 11 policy and assign a Windows 10 feature update policy.

Consumer ESU enrolment option not shown

Cause: The PC is not on 22H2, is missing updates, or is signed in with a child or non-admin account.

Fix: Install the latest updates and enrol with an adult Microsoft account that has administrator rights.

Search the full error library →

FAQ

Frequently asked questions

Does Windows 10 stop working after end of support?

No. It keeps running, but without ESU it no longer receives security updates, which increases risk over time.

How long can businesses buy Windows 10 ESU?

Up to three years after end of support, bought one year at a time. Years are cumulative, so starting late means paying for earlier years.

Is ESU free in Azure Virtual Desktop and Windows 365?

Yes. Microsoft provides ESU at no additional cost for Windows 10 VMs in Windows 365, Azure Virtual Desktop and Azure VMs, among other platforms.

How do I check if a PC can run Windows 11?

Run PC Health Check on the PC, or use the Work from anywhere report in Endpoint analytics for managed fleets.

Should I upgrade in place or reimage?

In-place upgrade is faster and keeps apps and data. Reimaging with Autopilot gives a clean, standard build and suits devices with a messy history.

Does ESU cover Windows 10 LTSC?

No. LTSB and LTSC releases are not covered by the Windows 10 ESU program and have their own support dates.

Sources

Official sources

10 official pages this guide is based on

Vendors change limits and features, so confirm details on the source before you rely on them. Last checked 4 Nov 2026.

Microsoft Learn: Extended Security Updates for Windows 10Microsoft Learn: Enable Windows 10 Extended Security UpdatesMicrosoft Lifecycle FAQ: Extended Security UpdatesMicrosoft: Windows 10 Consumer Extended Security UpdatesMicrosoft Support: Windows 11 system requirementsMicrosoft Support: How to use the PC Health Check appMicrosoft Learn: Upgrade to Windows 11 with IntuneMicrosoft Learn: Overview of Windows AutopilotMicrosoft Learn: Work from anywhere report (Endpoint analytics)Microsoft Learn: Feature update policy for Windows in Intune