The short answer: Windows 10 still works, but since 14 October 2025 it has no longer received operating system security fixes—neither antivirus software nor a new browser can patch a vulnerability in the kernel. Put every business workstation into one of three categories: upgrade to Windows 11 (free in licensing terms if the machine meets the requirements), paid ESU as a bridge with a firm end date, or replacement. Most importantly, in August 2026 there is no longer such a thing as ESU „for a year": the first commercial year ends on 13 October 2026, and the years must be purchased cumulatively. Anyone starting now therefore pays the full price for just a few weeks.
What end of support does and does not mean
The computer did not shut down on 14 October 2025. The accounting software opens, the printer prints, and the user notices nothing. That is exactly why the issue has been postponed for almost a year.
What has changed is that Windows 10 without ESU no longer receives security or quality updates, and Microsoft no longer provides standard technical support for it. Applications have their own, longer life cycles—Microsoft 365 Apps on Windows 10 are expected to receive security updates until 10 October 2028, while Edge, WebView2, and Defender definitions are covered for roughly the same period. This is the source of the most common misconception: „But it is still being updated." The applications are being updated. The kernel, drivers, network stack, printing subsystem, and authentication components are not.
The key point is that such a machine’s exposure increases over time. Newly discovered Windows 10 vulnerabilities may no longer be fixed without ESU, so the system does not remain in the state it was in on 13 October 2025. This is not an abrupt change but a slow, one-way deterioration that nobody can stop from the outside.
If your company falls under NIS2, or more specifically under zákon č. 264/2025 Sb., an unpatched operating system on the network is also a significant risk that is difficult to justify. It can only be defended through a documented risk assessment, compensating controls, and a deadline for resolving the situation—not by saying that it still works for now.
Start with an inventory, then buy laptops
The most expensive kind of migration is one where ten laptops are ordered before anyone discovers that three machines can be upgraded to Windows 11 for free, two only need TPM enabled in UEFI, and one runs old measurement software that will not work on Windows 11 at all.
For up to ten workstations, a shared spreadsheet is enough. Above that, an export from Intune or a remote management tool makes sense. For every workstation, you need:
- the operating system version (
winver—ESU requires 22H2, build 19045), - the exact processor model, not just „i5" (
Get-CimInstance Win32_Processor | Select-Object Name), - the TPM status (
tpm.msc—you are looking for „Specification Version 2.0," not 1.2), - the firmware mode (
msinfo32—the lines BIOS Mode: UEFI and Secure Boot State: On), - the encryption status and recovery key location (
manage-bde -status), - the PC Health Check result, but only as a second opinion, not a verdict,
- the battery condition on laptops (
powercfg /batteryreport—compare design capacity with full-charge capacity), - what runs on the workstation: accounting, ERP, VPN, signing certificates, USB licence dongles, printers, scanners, measurement and production software,
- data stored only locally, together with a backup whose recovery someone has actually tested rather than merely confirming that it exists.
The result should not be a simple „compatible: yes/no" column. Every workstation should be linked to a user, the criticality of their work, a possible downtime window, and the name of the person who will confirm after migration that their applications work. Without that final name, the migration is never truly complete.
If you do not have the capacity to carry out the inventory, we can handle it as a single project, including application testing and migration-wave planning. This falls under both ongoing business IT management and one-off computer servicing.
TPM is not the dividing line. The processor is
This is the most common cause of both unnecessary purchases and unnecessary delays. Windows 11 requires a supported 64-bit processor, TPM 2.0, UEFI with Secure Boot capability, at least 4 GB of RAM, and 64 GB of storage. In practice, however, only a minority of machines fail because of TPM—TPM 2.0 has been common in business laptops since 2015. They fail because of the supported processor list, which begins with Intel’s 8th generation (Coffee Lake) and, for AMD, roughly around the Ryzen 2000 series—although with AMD, the series number alone is not conclusive.
This means the dividing line runs through the middle of a single product generation:
| Machine | Processor | Windows 11 |
|---|---|---|
| ThinkPad T460 / T470, T470s | Skylake / Kaby Lake (6th–7th gen) | no |
| ThinkPad T480 / T480s | Coffee Lake (8th gen) | yes |
| Dell Latitude 7480, OptiPlex 7040 / 7050 | 6th–7th gen | no |
| Dell Latitude 7490, OptiPlex 7060 | 8th gen | yes |
| HP EliteBook 840 G3 / G4 | 6th–7th gen | no |
| HP EliteBook 840 G5 | 8th gen | yes |
| AMD Ryzen 1000 (Summit Ridge) | Zen | no |
| AMD Ryzen 2000 | Zen+, but also original Zen (some models and APUs) | depends on the exact model in Microsoft’s current list |
Notice what this means in practice: the ThinkPad T470 has TPM 2.0, UEFI, and Secure Boot—and still does not qualify. It is not missing a chip; it is missing a line in the list. Adding RAM or replacing the drive will not fix that. Conversely, machines from 2018–2019 that may now seem ready for retirement often qualify without difficulty and may need nothing more than an SSD and 16 GB of RAM.
Be particularly careful with AMD series numbers. The „Ryzen 2000" label does not guarantee support by itself—some models and APUs in this series still use the original Zen architecture and do not appear on the supported processor list. Check the specific model against Microsoft’s current list rather than treating the entire generation as supported.
A few Intel exceptions exist as well—Microsoft later added, for example, the Core i7-7820HQ in specific devices—but there is no point in planning around exceptions. Base your decision on the exact processor model.
When TPM really appears to be missing, it is usually disabled
The second most common situation is a machine with a supported processor where tpm.msc reports that no compatible module has been found. On desktops and less expensive systems, this almost always means that the firmware implementation is disabled in UEFI. On Intel systems it appears as PTT (Platform Trust Technology), while AMD calls it fTPM. Enabling it requires changing a single setting and restarting the machine.
Before touching that setting, verify the BitLocker recovery key. Changing TPM or Secure Boot settings, or updating the firmware, changes the platform’s measured state and may cause the system to request the key at startup. If nobody has it, the computer and all the data inside it will be locked. The safe approach is to suspend encryption temporarily before making the change (manage-bde -protectors -disable C: -RebootCount 1) and ensure that the key is stored in AD, Entra ID, or Intune—not on a piece of paper in a drawer. BitLocker suddenly asks for a recovery key explains what that screen looks like and what to do if you are already staring at it.
One detail concerning AMD: enabling fTPM on older Ryzen systems used to cause periodic audio and video stuttering because of access to firmware memory. This is resolved by a UEFI update containing AGESA 1.2.0.7 or later. If you are enabling fTPM on a machine with firmware from 2021, update the firmware at the same time.
Upgrading to Windows 11: what to test before going live
The upgrade itself carries no licence cost if the machine has a legitimate, activated copy of Windows 10 and meets the requirements. What you pay for is the backup, preparation, labour, and testing—and those are the real costs.
Treat the installation minimums of 4 GB of RAM and 64 GB of storage for what they are: the threshold below which the installer refuses to continue. To run a browser with twenty tabs alongside Teams, accounting software, and PDFs, you need 16 GB of RAM and an SSD with sufficient free space. A machine with 8 GB of RAM and a mechanical hard drive will not become faster after the upgrade—the user will simply be waiting against a newer background. You can determine before upgrading whether the slowdown is caused by the operating system or the hardware: measure disk and memory utilisation during that specific user’s normal work.
Before deploying across the company, test at least the following on one machine:
- accounting and ERP software, including printing reports and exporting data,
- signing certificates and datová schránka, especially if the certificate is stored on a smart card or token,
- the VPN client—older clients rely on a virtual adapter driver that may behave differently on the new operating system,
- USB licence dongles such as HASP—their drivers are often the oldest software in the company,
- printing and scanning, particularly scanning to a shared folder.
That final point deserves its own paragraph because it surprises the most people. Newer versions of Windows 11 require SMB signing and do not permit anonymous guest access to shared folders. Older multifunction printers that spent years scanning to a folder without a password or over the long-disabled SMBv1 protocol will stop saving files after migration. It looks like a broken scanner, but the real cause is a stricter default configuration. The solution is updated printer firmware, a dedicated password-protected service account, or scan-to-email. This is not a fault that a restart will fix.
Two final points: if you still have 32-bit Windows 10, an in-place upgrade is not available. Windows 11 is 64-bit only, so a clean installation with profile migration is required. After upgrading, you normally have ten days to return to the previous operating system using the preserved Windows.old folder. Schedule the pilot so those ten days include at least one month-end close or billing cycle. After that, you can only restore from a backup.
Do not force Windows 11 onto a machine by bypassing the processor or TPM checks. It is technically possible and may be a legitimate choice for a single home computer. In a business, however, it merely replaces one unsupported state with another: Microsoft does not guarantee updates for devices installed this way, and the situation is harder to explain during an audit than legitimate ESU with a firm end date.
ESU: what exactly you are buying and why it costs more than expected in August 2026
Microsoft lists a reference price for businesses of USD 61 per device for the first year, with the price doubling each subsequent year—to USD 122 in the second year and USD 244 in the third. The Czech price varies according to the exchange rate, tax, sales channel, and contract.
The dates and purchasing rules are what really matter:
| Period | Reference price | |
|---|---|---|
| Year 1 | 15 Oct 2025 – 13 Oct 2026 | USD 61 |
| Year 2 | 14 Oct 2026 – 12 Oct 2027 | USD 122 |
| Year 3 | 13 Oct 2027 – 10 Oct 2028 | USD 244 |
The years are cumulative and cannot be divided. You cannot buy only the final two months, and you cannot skip a year—anyone who wants the second year must also have paid for the first. In practical terms, in August 2026, if a workstation needs to remain on Windows 10 beyond October, you are not buying one year. You are buying the first year retrospectively, with only a few weeks remaining, plus the second year. That is USD 183 per device in total—roughly four thousand Czech crowns excluding VAT—for coverage until October 2027. For five workstations, that is enough money to start addressing the hardware itself.
What do you receive for the price? Critical and important security updates, and nothing more. No new features, no non-security fixes, and no standard technical support for the operating system. Eligible systems are Windows 10 version 22H2 in the Pro edition when commercially deployed, as well as Enterprise and Education. Licences can be purchased individually, and the key can be deployed either conventionally or through Intune.
Two common misconceptions about ESU:
- Consumer ESU is not a business plan. The consumer option—available free in exchange for backing up settings, through reward points, or for a small fee—ends on 13 October 2026, is tied to a personal Microsoft account, and does not apply to devices joined to a domain or managed through MDM.
- Sometimes you do not need to pay for ESU. Windows 10 virtual machines in Windows 365 or Azure Virtual Desktop, as well as workstations connecting to an actively licensed Cloud PC, include ESU under specified conditions.
One note for companies with production machines: if they run Windows 10 IoT Enterprise LTSC 2021, they are supported until 13 January 2032, so no action is currently required. If they run the standard Enterprise LTSC 2021, however, support ends on 12 January 2027—earlier than most people expect. Verify which of these two versions is actually installed on your machining centre.
ESU is paid time for removing a specific obstacle, not an alternative to making a decision. If there is no application name, responsible owner, and replacement date attached to it, „we will gain a year" will reliably turn into buying another year at twice the price.
When to replace a machine and what to check when buying refurbished
Replacement makes sense when the processor is not on the supported list, TPM 2.0 is missing and cannot be enabled, or the manufacturer no longer provides firmware or drivers—or when these issues are accompanied by faulty cooling, a worn-out drive, cracked hinges, and a battery at the end of its life. A swollen battery is not an item for next year’s budget: disconnect the device from power, stop using it, and have the battery replaced.
A new machine is not the only option. Refurbished ThinkPad T480 and T14 models, Dell Latitude 5490 and 7490 systems, or HP EliteBook 840 G5 and G6 laptops are sensible office choices, but the product family name alone is not enough. Check:
- the exact processor model and whether it appears on the Windows 11 supported list,
- the battery’s actual condition—design capacity versus full-charge capacity from
powercfg /batteryreport, not a vague claim that the „battery is OK," - the warranty in the Czech Republic and who will actually handle it,
- the operating system edition: Windows 11 Pro for business management, not Home,
- compatibility with your existing docks.
The final point often creates the greatest additional expense. Docking solutions from every major manufacturer have changed over the past several generations—from proprietary mechanical connectors to side-mounted and USB-C variants—and supported devices vary between individual models. Do not assume that a dock is compatible merely because it is „for ThinkPad„ or „for Latitude." Check the exact dock type against the manufacturer’s official list of supported devices for the model you are buying. Before ordering ten laptops, include ten docks in your calculations, and with USB-C verify exactly what the particular cable and port can do. The reasons this is not as straightforward as it seems are explained in why we do not like USB-C.
Ask for the quotation to separate the price of the computer, dock, data transfer, application installation, and warranty. Also ask what „NBD" actually means: when the technician will respond, when the repair will begin, and whether you will receive a replacement machine while yours is being repaired.
Migration without unnecessary downtime
- Verify the backup through a test restore. Do not merely check that the job showed a green status—retrieve a specific file from a specific date. At the same time, export the BitLocker recovery keys and store them by device identifier.
- Choose a pilot workstation that uses the same applications and peripherals as the rest of the company but whose failure will not stop billing or production. Using the managing director’s computer as the pilot is a classic way to leave yourself no easy route back.
- Run through the entire checklist after the upgrade: sign-in, email, accounting, VPN, printing, scanning to a folder, shared drives, OneDrive, and the backup agent. Seeing the Windows 11 desktop is not a test.
- Let the pilot run for at least a week, ideally through a month-end close—that is the whole point of the ten-day rollback window.
- Divide the remaining machines into smaller waves. Keep a spare machine ready for critical roles. If buying a backup laptop to leave in a cupboard does not make sense, you can rent a business laptop for the migration period only.
- Record for every workstation the operating system version, activation status, encryption status, application test result, and rollback procedure. Without this record, you will not know which machines are complete, and nobody will be able to reconstruct the situation a month later.
Do not begin a company-wide migration on the evening before month-end close. As a rough guide, allow several hours of work and checks per workstation. Large amounts of local data, old profiles, and specialised software can extend that time considerably.
How to compare the true costs
Compare the entire period through October 2028, not just the next invoice:
- Upgrade = technician’s labour + application testing + backup + user downtime. No licence cost.
- ESU = cumulative licences (USD 61 → 122 → 244 per device) + update management + the migration that will still be required later, only at greater cost and under greater time pressure.
- Replacement = device + dock and accessories + data and application migration + secure disposal of the old drive.
Ask the supplier for a workstation-by-workstation budget and a clearly described scope. A high-quality deliverable includes the inventory, an upgrade/ESU/replacement decision for every machine, the pilot result, the status of backups and BitLocker keys, a list of unresolved exceptions, and a deadline for resolving them. For retired computers, require a certificate of data erasure or physical destruction of the storage medium. A discarded drive containing accounting data is a data breach regardless of how old the computer was.
What about workstations that must remain on Windows 10?
They do exist—a computer attached to a machine tool, measurement equipment, or an old laboratory card whose driver will never be ported to another operating system. If you confirm that it runs Windows 10 IoT Enterprise LTSC 2021, you are covered until 2032. In every other case, a simple rule applies: that computer may operate its machine and do nothing else.
In practice, this means placing it in a separate network segment with no internet access and no access to company shared drives, with no email, no browser, no user-supplied USB devices, a local account instead of a domain account, and a backup stored beyond the machine’s reach. Unpatched Windows on an isolated machine is an accepted risk. Unpatched Windows on the same network as the accounting system is simply waiting for ransomware—and that becomes your responsibility, not the manufacturer’s.
What to do by 13 October 2026
Roughly eight weeks remain, which is enough time for the plan:
- this week, complete the inventory and divide the workstations into the three categories,
- within two weeks, launch a Windows 11 pilot on one representative machine,
- in September, order the required hardware and docks and schedule the migration waves to avoid month-end closes,
- by early October, finish the machines that can be migrated and decide whether the remainder genuinely require both the first and second ESU years,
- before 13 October, verify that the ESU keys are activated and that updates are actually being installed on the affected workstations. A paid licence without a verified installation is not protection; it is merely an expense.
If you want to handle the inventory, application compatibility testing, and migration as a single project—or simply need a second opinion on which machines are worth saving—get in touch. We provide both computer servicing and ongoing business IT management, including a workstation-by-workstation budget. In your enquiry, include the number of workstations, the applications you use, the number of locations, and the deadline. That gives us enough information to prepare both a process and a price without buying hardware blindly.
Frequently asked questions
Will a business computer running Windows 10 stop working?
No. It will start and its applications will continue to run. Without ESU, however, the operating system no longer receives security or quality updates, and standard support is no longer available. The risk does not increase all at once; it grows gradually. Newly discovered Windows 10 vulnerabilities may no longer receive fixes without ESU, so the machine’s exposure increases over time.
Is ESU free for businesses?
Generally, no. Microsoft lists a reference price of USD 61 per device for the first year, with the price doubling each subsequent year. ESU is free only in specific cases—for example, for workstations connecting to an actively licensed Cloud PC in Windows 365. The consumer ESU offer is not a substitute for a commercial licence and does not apply to domain-joined or MDM-managed computers.
Can we buy ESU only for the remaining months?
No. The years are sold whole and cumulatively. Buying in August 2026 means paying for the entire first year, which ends on 13 October 2026, as well as the entire second year if the workstation needs to remain in use beyond that date.
Can we bypass TPM and install Windows 11 manually?
Technically, yes, but the device will remain unsupported, and Microsoft does not guarantee updates for it. First check whether TPM is merely disabled in UEFI—as PTT on Intel systems or fTPM on AMD systems—which is the most common cause. If a supported processor is genuinely missing, choose ESU with a firm end date or replace the machine.
Are up-to-date Microsoft 365 and good antivirus software enough on Windows 10?
No. Microsoft 365 Apps on Windows 10 are expected to receive security updates until 10 October 2028, but those updates fix the applications, not the operating system. Antivirus software cannot repair a vulnerability in the kernel, a driver, or the network stack. At best, it may detect exploitation—and only once the attack is already running.
How long does it take a small business to migrate to Windows 11?
Installation is the smaller part of the job. The real factors are the number of workstations, the amount of local data, and the compatibility of accounting software, VPNs, printers, and peripherals. As a rough guide, allow several hours per workstation plus an additional week for the pilot, and migrate critical roles with a replacement computer ready.