Windows 10 ESU Year 1 Ends: What It Means for Your Apps

Direct Answer 

For organizations, Year 1 of commercial Windows 10 Extended Security Updates (ESU) covers October 15, 2025, to October 13, 2026. Devices that stay on Windows 10 need Year 2 coverage to keep receiving Windows security updates, and organizations that enroll later must also pay for the earlier year. ESU only covers Windows itself. Browsers, PDF readers, runtimes and other third-party applications on those devices still need their own patch process, and each vendor sets its own Windows 10 support policy.

Key Takeaways

• October 13, 2026 is both October’s Patch Tuesday and the end of commercial ESU Year 1
• Commercial ESU is purchased per device, per year, and coverage is cumulative.
• ESU delivers Windows security updates only, not third-party application updates.
• Windows 10 devices need separate tracking for OS coverage, application support and exit dates.

Key dates for commerical Windows 10 ESU

Date	What happens
October 14, 2026	Windows 10 reached end of support.
October 15, 2025 – October 13, 2026	ESU Year 1 coverage period.
October 14, 2026 – October 12, 2027	ESU Year 2 coverage period.
October 2028	End of ESU Year 3, the last possible coverage for Windows 10 security updates.

Consumer ESU has different terms from the commercial program. Check Microsoft’s consumer ESU page for the current consumer dates rather than applying the commercial timeline to personal devices.

What ESU covers, and what it does not  

ESU provides critical and important security updates, as defined by the Microsoft Security Response Center, for devices running Windows 10, version 22H2. It does not provide new features, non-security fixes or general technical support.

ESU also does not update software from other vendors. A Windows 10 device with ESU can be fully patched at the operating-system level while still running an outdated browser, PDF reader or Java runtime.

What late enrollment costs

Commercial ESU is priced per device, and the price increases each year. Coverage is cumulative: an organization that enrolls in Year 2 must also buy Year 1 before it receives current updates. If you still have Windows 10 devices without ESU, confirm pricing and enrollment steps with Microsoft or your licensing partner before October 13.

Why third-party applications are the hidden risk on Windows 10

• Separate lifecycles. Each software vendor decides how long it supports Windows 10, independent of Microsoft’s ESU program.
• Version drift. If a vendor stops supporting Windows 10, those devices may be limited to older application versions that no longer receive fixes.
• Mixed fleets. Running Windows 10 and Windows 11 side by side can mean more package variants, requirement rules and exceptions to manage.

A six-step plan around October 13

1. Export a list of every Windows 10 device with its owner, location and business purpose.
2. Decide per device: upgrade to Windows 11, replace the hardware, or cover it with ESU until a set exit date
3. Confirm ESU licensing and activation for every device you keep on Windows 10.
4. Check the Windows 10 support policy of your 20 most widely installed third-party applications.
5. Keep third-party patching running for Windows 10 devices, using separate groups or collections so you can target and report on them.
6. Report monthly on remaining Windows 10 devices, their ESU status and their application patch compliance.

Managing Windows 10 and Windows 11 side by side

In Intune, dynamic device groups based on operating-system version and app requirement rules help you target the right application versions. In Configuration Manager, collections based on operating-system version serve the same purpose. Keeping Windows 10 devices in clearly named groups also makes exceptions easier to audit.

How Easy2Patch helps

Easy2Patch publishes third-party application updates to Intune, Configuration Manager and WSUS, so the same catalog can serve Windows 10 and Windows 11 devices through the groups and collections you already use. Its CVE list helps you see which updates fix known vulnerabilities, which is useful when deciding what must reach Windows 10 devices first.

Frequently Asked Questions

When does Windows 10 ESU Year 1 end?

For commercial customers, Year 1 of Windows 10 Extended Security Updates ends on October 13, 2026, which is also October’s Patch Tuesday. Year 2 coverage runs until October 12, 2027, and Year 3 ends in October 2028, the last possible date for Windows 10 security updates. Consumer ESU terms differ, so check Microsoft’s consumer ESU page for current dates.

Does Windows 10 ESU patch third-party applications?

No. Windows 10 ESU delivers critical and important security updates for Windows 10, version 22H2, as defined by the Microsoft Security Response Center. It does not update applications from other vendors, such as Google Chrome, Zoom or Adobe Acrobat Reader. Those applications need to be patched through Intune, Configuration Manager, WSUS or another patching tool.

What happens if we enroll in ESU after October 13, 2026?

Commercial ESU coverage is cumulative, so an organization that enrolls during Year 2 must also purchase Year 1 before it receives current updates. That raises the cost per device compared with enrolling during Year 1. Confirm current pricing and enrollment rules with Microsoft or your licensing partner before you decide.

Can Intune manage Windows 10 devices enrolled in ESU?

Yes. Windows 10 devices enrolled in ESU can continue to be managed with Intune or Configuration Manager, so application deployment and third-party updates keep working through the same tools. Many teams place Windows 10 devices in separate groups or collections to track ESU status, target application versions that still support Windows 10 and report on the remaining fleet.

Conclusion

ESU buys time for Windows, not for the applications running on it. Use October 13 as a checkpoint: confirm which devices stay on Windows 10, secure their ESU coverage, and keep third-party applications on those devices patched until they are retired.