What end of support means
Windows 10 still starts up and runs, but Microsoft no longer fixes security holes in it for free. Each month, new vulnerabilities are found and patched in Windows 11 that stay open on Windows 10. Attackers know this and look for unpatched systems.
It also affects compliance. Cyber-insurance questionnaires and audits commonly ask whether every computer runs a supported, patched operating system.
Extended Security Updates: buying time
Microsoft sells Extended Security Updates (ESU) for business PCs on Windows 10 for up to three years after end of support, and the price doubles each year. ESU is security fixes only, with no new features. It makes sense for a handful of machines that can’t move yet, such as a PC running equipment software, not as a plan for the whole office.
Upgrade or replace?
Windows 11 needs TPM 2.0 and a supported processor, generally Intel 8th generation or AMD Ryzen 2000 series and newer. For each PC we check:
- Does it meet Windows 11’s requirements? If so, a free in-place upgrade.
- Is it more than about five years old or out of warranty? Replacing it is usually better value.
- Is it running Windows Home? Business PCs should move to Windows 11 Pro.
- Does any software need testing on Windows 11 first?
Use the move to fix management
A Windows 11 refresh is a good moment to bring every PC under Intune. New PCs set themselves up with Autopilot, BitLocker is enforced from day one and updates are managed centrally from then on, so the next Windows change is routine instead of a project.