The short answer: Windows 10 still runs, but it has not received operating-system security fixes since 14 October 2025—and neither antivirus software nor a new browser can patch a vulnerability in the kernel. Put every business workstation into one of three categories: upgrade to Windows 11 (free in licensing terms if the machine meets the requirements), paid ESU as a bridge with a fixed end date, or replacement. Most importantly, by August 2026, there is no longer such a thing as buying ESU „for a year": the first commercial year ends on 13 October 2026, and the years must be purchased cumulatively. Anyone starting now pays the full price for just a few weeks.
What the end of support does—and does not—mean
The computer did not shut down on 14 October 2025. The accounting software opens, the printer prints, and the user notices nothing. That is precisely why the issue was postponed for almost a year.
What has changed is that Windows 10 without ESU no longer receives security or quality updates, and Microsoft no longer provides standard technical support for it. Applications have their own, longer life cycles—Microsoft 365 Apps on Windows 10 are expected to receive security updates until 10 October 2028, while Edge, WebView2, and Defender definitions are covered for roughly the same period. This is the source of the most common misconception: „But it is still being updated." The software running on top is being updated. The kernel, drivers, network stack, printing subsystem, and authentication components are not.
The key point is that the exposure of such a machine increases over time. Newly discovered Windows 10 vulnerabilities may no longer be fixed without ESU, so the system does not remain in the state it was in on 13 October 2025. This is not an abrupt change but a slow, one-way deterioration that cannot be stopped from the outside.
If your company falls under NIS2, or more specifically under zákon č. 264/2025 Sb., an unpatched operating system on the network also represents a significant risk that is difficult to justify. It can only be defended through a documented risk assessment, compensating controls, and a deadline for removing the issue—not by saying that it still works for now.
Take inventory before buying laptops
The most expensive migration is the one where ten laptops are ordered before anyone discovers that three existing machines can move to Windows 11 for free, two merely need TPM enabled in UEFI, and one runs old measurement software that will not work on Windows 11 at all.
For up to ten workstations, a shared spreadsheet is enough. Above that, an export from Intune or a remote management tool makes sense. For each workstation, you need:
- the operating-system version (
winver—ESU requires 22H2, build 19045), - the exact processor model, not just „i5" (
Get-CimInstance Win32_Processor | Select-Object Name), - the TPM status (
tpm.msc—you are looking for „Specification Version 2.0", not 1.2), - the firmware mode (
msinfo32—the lines BIOS Mode: UEFI and Secure Boot State: On), - the encryption status and recovery-key location (
manage-bde -status), - the PC Health Check result, but only as a second opinion, not a final verdict,
- the battery condition on laptops (
powercfg /batteryreport—compare the design and full-charge capacities), - what runs on the workstation: accounting software, ERP, VPN, signing certificates, USB licence keys, printers, scanners, measurement and manufacturing software,
- data stored only locally, together with a backup that someone has successfully restored rather than merely confirmed exists.
The result should not be a simple „compatible: yes/no" column. Each workstation must be linked to a user, the criticality of their work, a possible downtime window, and the name of the person who will confirm after migration that their applications work. Without that final name, the migration will never truly be closed.
If you do not have the capacity to perform the inventory, we can handle it as a single engagement, including application testing and migration-wave planning. This falls under both ongoing business IT management and one-off computer servicing.
TPM is not the dividing line. The processor is
This is the most common source of both unnecessary purchases and unnecessary delays. Windows 11 requires a supported 64-bit processor, TPM 2.0, UEFI with Secure Boot capability, at least 4 GB of RAM, and 64 GB of storage. In practice, however, only a minority of machines fail because of TPM—TPM 2.0 has been common in corporate laptops since 2015. Most fail because of the supported processor list, which starts with Intel’s 8th generation (Coffee Lake) and, for AMD, roughly around the Ryzen 2000 series—although the series number alone is not decisive for AMD.
This means the dividing line can run straight through a single product family:
| Machine | Processor | Windows 11 |
|---|---|---|
| ThinkPad T460 / T470, T470s | Skylake / Kaby Lake (6th–7th gen) | no |
| ThinkPad T480 / T480s | Coffee Lake (8th gen) | yes |
| Dell Latitude 7480, OptiPlex 7040 / 7050 | 6th–7th gen | no |
| Dell Latitude 7490, OptiPlex 7060 | 8th gen | yes |
| HP EliteBook 840 G3 / G4 | 6th–7th gen | no |
| HP EliteBook 840 G5 | 8th gen | yes |
| AMD Ryzen 1000 (Summit Ridge) | Zen | no |
| AMD Ryzen 2000 | Zen+, but also original Zen (some models and APUs) | the exact model’s presence on Microsoft’s current list is decisive |
Consider what this means in practice: a ThinkPad T470 has TPM 2.0, UEFI, and Secure Boot—and it still does not qualify. It is not missing a chip; it is missing a line on the list. Adding RAM or replacing the drive will not fix that. Conversely, machines from 2018–2019 that may now seem obsolete often qualify without any problem and may need nothing more than an SSD and 16 GB of RAM.
Be particularly careful with AMD series numbers. The „Ryzen 2000" label does not guarantee support by itself—some models and APUs in that series still use the original Zen architecture and are not on the supported processor list. Check the exact model against Microsoft’s current list rather than treating the entire generation as supported.
There are a few Intel exceptions as well—Microsoft later added the Core i7-7820HQ in certain devices, for example—but it makes no sense to build a plan around exceptions. Base the decision on the exact processor model.
When TPM really appears to be missing, it is often just disabled
The second most common situation is a machine with a supported processor where tpm.msc reports that no compatible module was found. On desktops and more affordable systems, this almost always means that the firmware implementation is disabled in UEFI. On Intel systems it appears as PTT (Platform Trust Technology), while AMD calls it fTPM. Enabling it requires changing a single setting and restarting the machine.
Before changing that setting, verify the BitLocker recovery key. Changing TPM or Secure Boot settings, or updating the firmware, alters the measured platform state, and the system may request the recovery key at startup. If nobody has it, the computer and all its data are locked. The safe procedure is to suspend encryption temporarily before making the change (manage-bde -protectors -disable C: -RebootCount 1) and ensure that the key is stored in AD, Entra ID, or Intune—not on a piece of paper in a drawer. The appearance of this screen and what to do when you are already looking at it are covered in BitLocker suddenly asks for a recovery key.
One detail for AMD systems: enabling fTPM on older Ryzen processors used to cause periodic audio and video stuttering because of firmware-memory access. This is resolved by a UEFI update containing AGESA 1.2.0.7 or newer. If you are enabling fTPM on a machine with firmware from 2021, update the firmware at the same time.
Upgrading to Windows 11: what to test before deployment
The upgrade costs nothing in licensing terms if the machine has a legitimate, activated copy of Windows 10 and meets the requirements. What you pay for is the backup, preparation, labour, and testing—and those are the real costs.
Treat the installation minimums of 4 GB of RAM and 64 GB of storage for what they are: the threshold below which the installer refuses to continue. Running a browser with twenty tabs alongside Teams, accounting software, and PDFs requires 16 GB of RAM and an SSD with enough free space. A machine with 8 GB of RAM and a mechanical hard drive will not become faster after the upgrade—the user will simply be waiting against a newer background. You can determine whether the bottleneck is the operating system or the hardware before upgrading: measure disk and memory usage during that particular user’s normal work.
Before deploying throughout the company, test at least the following on one machine:
- accounting and ERP software, including report printing and exports,
- signing certificates and datová schránka, especially if the certificate is stored on a smart card or token,
- the VPN client—older clients rely on a virtual adapter driver that may behave differently on the new operating-system version,
- USB licence keys such as HASP—their drivers are often the oldest software in the company,
- printing and scanning, especially scanning to a shared folder.
The final item deserves its own paragraph because it surprises the most people. Newer Windows 11 versions require SMB signing and do not allow anonymous guest access to shared folders. Older multifunction printers that have scanned to a passwordless folder for years—or used the long-disabled SMBv1 protocol—will stop saving files after migration. It looks like a scanner fault, but the real cause is a stricter default configuration. The solution is updated multifunction-printer firmware, a dedicated password-protected service account, or scanning to email. This is not a fault that a restart will fix.
Two final points: if you still have 32-bit Windows 10, there is no in-place upgrade—Windows 11 is 64-bit only, so a clean installation and profile migration are required. After an upgrade, you normally have ten days to return to the previous system using the retained Windows.old folder. Schedule the pilot so that those ten days include at least one financial close or billing cycle. After that, the only way back is through a backup.
Do not force Windows 11 onto a machine by bypassing the processor or TPM checks. It is technically possible and may be a legitimate choice for a single home computer. In a business, however, it merely replaces one unsupported state with another: Microsoft does not guarantee updates for devices installed this way, and the decision is harder to justify in an audit than legitimate ESU with a fixed end date.
ESU: what you are buying and why it costs more than expected in August 2026
Microsoft lists a reference price for businesses of USD 61 per device for the first year, with the price doubling each subsequent year—to USD 122 in the second year and USD 244 in the third. The Czech price varies according to the exchange rate, tax, sales channel, and contract.
The dates and purchase rules, however, are crucial:
| Period | Reference price | |
|---|---|---|
| Year 1 | 15 Oct 2025 – 13 Oct 2026 | USD 61 |
| Year 2 | 14 Oct 2026 – 12 Oct 2027 | USD 122 |
| Year 3 | 13 Oct 2027 – 10 Oct 2028 | USD 244 |
The years are cumulative and indivisible. You cannot buy only the final two months, and you cannot skip a year—anyone who wants the second year must also have paid for the first. Translated into August 2026 terms: if a workstation must remain on Windows 10 beyond October, you are not buying one year. You are retroactively buying the first year, of which only a few weeks remain, plus the second year. That is USD 183 per device in total—roughly four thousand Czech crowns excluding VAT—for coverage until October 2027. For five workstations, that is already enough money to start addressing the hardware itself.
What you receive is critical and important security updates, nothing more. There are no new features, no non-security fixes, and no standard technical support for the operating system. Eligible systems are Windows 10 version 22H2 in the Pro edition when used commercially, as well as Enterprise and Education. Licences can be purchased from a single device upwards, and the key can be deployed either conventionally or through Intune.
Two common misconceptions about ESU:
- Consumer ESU is not a business plan. Consumer ESU for personal devices runs until 12 October 2027 after Microsoft extended it by one year on 25 June 2026. In the EEA, including the Czech Republic, users enrol through a Microsoft account—at no charge if they continue signing in to Windows with that account, although updates stop within 60 days if they do not, or for a one-time USD 30 fee when using a local account. It applies only to personal devices, not devices managed by an organisation, such as those joined to a domain or managed through MDM. The terms are available on Microsoft’s Extended Security Updates page.
- In some cases, you do not need to pay for ESU. Windows 10 virtual machines in Windows 365 or Azure Virtual Desktop, as well as workstations connecting to an actively licensed Cloud PC, include ESU under the specified conditions.
One note for companies with machines on production floors: if they run Windows 10 IoT Enterprise LTSC 2021, they are supported until 13 January 2032, so no action is required. If they run the standard Enterprise LTSC 2021, however, support ends on 12 January 2027—earlier than most people expect. Check which of these two versions is actually installed on the machining centre.
ESU buys time to remove a specific obstacle; it is not an alternative to making a decision. Unless the plan names the application, its owner, and the replacement date, „we will gain a year" will reliably turn into buying another year at twice the price.
When to replace a machine and what to check on a refurbished one
Replacement makes sense when the processor is not on the supported list, TPM 2.0 is missing with no option to enable it, or the manufacturer no longer provides firmware or drivers—or when those issues come with faulty cooling, a worn-out drive, cracked hinges, and a battery at the end of its life. A swollen battery is not an item for next year’s budget: disconnect the device from power, stop using it, and have the battery replaced.
A brand-new machine is not the only option. Refurbished ThinkPad T480 and T14 models, Dell Latitude 5490 and 7490 systems, or HP EliteBook 840 G5 and G6 laptops are sensible office choices, but the product-family name is not enough. Verify:
- the exact processor model and its presence on the Windows 11 supported list,
- the actual battery condition—design capacity versus full-charge capacity from
powercfg /batteryreport, not a verbal assurance that the „battery is OK", - the warranty in the Czech Republic and who actually handles claims,
- the operating-system edition: Windows 11 Pro for business management, not Home,
- compatibility with your existing docks.
The final point often creates the largest additional expense. Docking solutions from all major manufacturers have changed over the past several generations—from proprietary mechanical connectors to side-mounted and USB-C options—and device support varies by exact model. Do not assume a dock is compatible just because it is „for ThinkPads„ or „for Latitudes": check the exact dock model against the manufacturer’s official compatibility list for the machine you are buying. Before ordering ten laptops, budget for ten docks as well. For USB-C, verify what the particular cable and port actually support; the reasons why this is not straightforward are explained in why we do not like USB-C.
Ask for the quotation to list the computer, dock, data transfer, application installation, and warranty separately. Also ask what „NBD" means in practice: when the technician will respond, when the repair will begin, and whether you will receive a replacement machine while the device is being repaired.
Migration without unnecessary downtime
- Verify the backup with a test restore. Do not merely check that the backup task showed a green status—retrieve a specific file from a specific date. At the same time, export the BitLocker recovery keys and store them under the relevant device identifiers.
- Select a pilot workstation that uses the same applications and peripherals as the rest of the company but whose failure will not stop billing or production. Choosing the managing director’s computer as the pilot is a classic way to leave yourself with no route back.
- After the upgrade, go through the entire checklist: sign-in, email, accounting software, VPN, printing, scanning to a folder, shared drives, OneDrive, and the backup agent. Reaching the Windows 11 desktop is not a test.
- Let the pilot run for at least a week, ideally through a financial close—the ten-day rollback window exists for precisely this reason.
- Divide the remaining machines into smaller waves. Have a replacement machine ready for critical roles. If buying a spare to keep in a cupboard is not worthwhile, you can rent a business laptop for the migration period only.
- Record for every workstation the operating-system version, activation status, encryption status, application-test result, and rollback procedure. Without this record, you will not know which machines are complete, and nobody will be able to reconstruct the situation a month later.
Do not begin a company-wide migration on the evening before a financial close. As a rough guide, allow several hours of work and checks per workstation. Large amounts of local data, old user profiles, and specialised software can extend this considerably.
How to compare the real costs
Compare the full period through October 2028, not just the next invoice:
- Upgrade = technician labour + application testing + backup + user downtime. No licence cost.
- ESU = cumulative licences (USD 61 → 122 → 244 per device) + update management + the migration that will still be required later, only at a higher cost and under greater time pressure.
- Replacement = device + dock and accessories + data and application transfer + secure disposal of the old drive.
Ask the supplier for a workstation-by-workstation budget with a clearly described scope. A good deliverable includes an inventory, an upgrade/ESU/replacement decision for every machine, the pilot result, the status of backups and BitLocker keys, a list of unresolved exceptions, and a deadline for eliminating them. For retired computers, require a certificate of data erasure or physical destruction of the storage medium. A discarded drive containing accounting data is a data breach regardless of how old the computer was.
Workstations that must remain on Windows 10
Such systems do exist—a computer connected to a machine tool, measurement equipment, or an old laboratory card whose driver will never be ported to another platform. If you verify that it runs Windows 10 IoT Enterprise LTSC 2021, you are covered until 2032. In every other case, one simple rule applies: that computer may operate its machine and do nothing else.
In practice, this means placing it in its own network segment with no internet access and no access to company shared drives, providing no email or browser, accepting no user USB devices, using a local account instead of a domain account, and keeping a backup of the workstation beyond its reach. Unpatched Windows on an isolated machine is an accepted risk. Unpatched Windows on the same network as the accounting system is simply waiting for ransomware—and responsibility for that lies with you, not the manufacturer.
What to do by 13 October 2026
Roughly eight weeks remain, which is enough time for the plan:
- this week, complete the inventory and divide the workstations into the three categories,
- within two weeks, launch a Windows 11 pilot on one representative machine,
- in September, order the missing equipment and docks and schedule migration waves around financial closing periods,
- by early October, finish the machines that can be migrated and decide whether the remainder genuinely require both the first and second years of ESU,
- before 13 October, verify that the ESU keys are activated and that updates are actually being installed on the affected workstations. A paid licence without verified installation is not protection—it is merely an expense.
If you want to handle the inventory, application compatibility testing, and migration as a single project—or simply need a second opinion on which machines are worth retaining—get in touch. We provide both computer servicing and ongoing business IT management, including workstation-by-workstation budget preparation. Include the number of workstations, the applications you use, the number of sites, and your required completion date in the enquiry. That information makes it possible to prepare both a process and a price without purchasing equipment blindly.
Frequently asked questions
Will a business computer running Windows 10 stop working?
No. It will start, and its applications will continue to run. Without ESU, however, the operating system no longer receives security or quality updates, and standard support is unavailable. The risk does not rise all at once; it increases gradually. Newly discovered Windows 10 vulnerabilities may no longer receive fixes without ESU, so the machine’s exposure grows over time.
Is ESU free for businesses?
Not normally. Microsoft lists a reference price of USD 61 per device for the first year, doubling it for each subsequent year. ESU is free only in specific cases—for example, for workstations connecting to an actively licensed Cloud PC in Windows 365. The consumer ESU offer is not a substitute for a commercial licence and does not apply to domain-joined or MDM-managed computers.
Can we buy ESU only for the remaining months?
No. The years are sold as complete, cumulative periods. Purchasing in August 2026 means paying for the entire first year, which ends on 13 October 2026, as well as the entire second year if the workstation must remain in service beyond that date.
Can we bypass TPM and install Windows 11 manually?
Technically, yes, but the device will remain unsupported, and Microsoft does not guarantee that it will receive updates. First check whether TPM is merely disabled in UEFI—on Intel systems it is called PTT, while AMD calls it fTPM. This is the most common cause. If the machine genuinely lacks a supported processor, choose ESU with a fixed end date or replace the machine.
Are current Microsoft 365 applications and good antivirus software enough on Windows 10?
No. Microsoft 365 Apps on Windows 10 are expected to receive security updates until 10 October 2028, but those updates fix the applications, not the operating system. Antivirus software cannot repair a vulnerability in the kernel, a driver, or the network stack—it can, at best, detect exploitation after it has already begun.
How long does moving a small company to Windows 11 take?
Installation is the smaller part of the work. The actual duration depends on the number of workstations, the amount of local data, and the compatibility of accounting software, VPNs, printers, and peripherals. As a rough guide, allow several hours per workstation plus an additional week for the pilot, and migrate critical roles with a replacement computer ready.
Where to find us
ITHOPE is a company based in Brno, Czechia: we do data recovery from disks, RAID and NAS, PC and laptop service and IT for business, all in our own lab at Viniční 3587/216, 615 00 Brno.
Phone +420 775 556 063 (24/7 line). You can bring the device in person, or send it by courier (Zásilkovna, PPL).