Windows 10 ESU Year 2: What Auditors Accept After October 13

Year Two of Windows 10 ESU costs twice what Year One did. Before you renew, know how an auditor will read each option and what evidence it needs.

October 13 is a renewal decision, not a deadline

Windows 10 left support on October 14, 2025. Organizations that kept Windows 10 machines running bought a year of Extended Security Updates as a bridge. That first year of commercial coverage runs through October 13, 2026, according to MSPs tracking the program. Confirm the exact date on your own volume licensing agreement.

So this week, every organization with Windows 10 devices still in service makes a choice, whether it means to or not:

• Pay for Year Two and keep those devices patched for another year.
• Migrate to Windows 11, new hardware, or a cloud desktop.
• Carry the risk on devices that will stop receiving security fixes.

All three can be defensible in an audit. Only one can be done without evidence, and that is the one auditors write up.

What does Windows 10 ESU Year 2 actually cost?

Windows 10 ESU Year 2 costs $122 per device, twice the $61 Year One price, and Year Three doubles again to $244. Payment is cumulative: an organization that skipped Year One and enrolls now pays for both years, $183 per device. Microsoft sells ESU only in whole years, for a maximum of three.

Those terms come straight from Microsoft's ESU program page. The math gets real quickly. A fleet with 400 Windows 10 devices still in service pays $48,800 for Year Two alone. If those devices skipped Year One, the bill is $73,200.

There is one significant exception. ESU is included at no extra cost for Windows 10 running in Windows 365, Azure Virtual Desktop, and Azure virtual machines. If the machines that can't move to Windows 11 are really just running an application, a cloud desktop may cost less than another year of ESU.

What ESU covers, and what it doesn't

ESU is narrower than many teams assume. Per Microsoft, it delivers critical and important security updates only. It does not include:

• New features or non-security fixes
• Design change requests
• General technical support, beyond help with installing and activating ESU itself

It also requires Windows 10 version 22H2. A device on an older release can't receive ESU updates even if a license was bought for it.

That narrowness matters in an audit. A vulnerability rated moderate or low that never gets fixed is still a known vulnerability on a device you chose to keep. Your exception record should say so, rather than implying that ESU means "fully patched".

How auditors read each choice

None of the major frameworks names Windows 10. They don't need to. Each one treats end of life software as a vulnerability you must manage, and each already has a control that an unsupported operating system lands in.

• SOC 2, CC7.1 (detection and monitoring of vulnerabilities): expects a process that finds vulnerable components, including software past end of life.
• ISO 27001:2022, Annex A 8.8 (management of technical vulnerabilities): expects timely information about vulnerabilities, evaluated exposure, and appropriate measures.
• PCI DSS 4.0, Requirement 12.3.4 (reviewed at least every 12 months): expects analysis of vendor support and a senior-management-approved plan for end-of-life technology.
• NIST SP 800-53, SA-22 (unsupported system components): expects you to replace the component or arrange continued support, using isolation to reduce the risk.

Read against those controls, the three choices look like this:

• Paying for ESU is continued vendor support, which is exactly what SA-22 and PCI DSS 12.3.4 ask for. It holds up only if you can show which devices are enrolled and that the updates are actually installing.
• Migrating is the cleanest answer. It needs a dated plan, progress against it, and a device inventory proving which machines are done.
• Carrying the risk is a documented exception. An auditor will want a named owner, an expiry date, compensating controls such as network isolation, and a retirement plan. An undocumented Windows 10 device is not an exception. It is a finding.

The evidence an auditor will ask for

Whichever path you take, the questions converge on one thing: proof about each device, not a statement about the fleet.

1. A current inventory of every Windows 10 device, with its build, owner, and location. "About 400 machines" is not an inventory.
2. ESU status per device: enrolled or not, and the date its last security update installed.
3. An exception register for every device that is neither enrolled nor migrated, with a risk owner, a compensating control, and a date the exception ends.
4. A migration plan with dates and an approver. PCI DSS asks for senior-management approval explicitly.
5. Proof that all of the above held for the whole audit period, not just on the day the auditor asked.

The last item is where most teams struggle. A spreadsheet built for the audit shows one moment. A SOC 2 Type II audit covers a period, so the question becomes whether your devices stayed in the state the spreadsheet claims. That is the gap we describe in compliance evidence, not a fire drill.

The trap: enrolled is not the same as patched

ESU is activated with a license key on each device. That activation is an administrative fact. It says nothing about whether the monthly updates have installed since.

Devices fall out of patching quietly. They go offline for weeks, their update service breaks, or they were never moved to version 22H2. Each one still shows up as "covered" in a license count, while it is effectively unsupported.

The check that matters is per device and recent: the date of the last security update actually installed, compared with Microsoft's monthly release. A device more than a cycle behind is unsupported in practice, whatever the license says.

This is why supportability has to be checked continuously, on the device itself. As we argued in supportability, not age, what matters is not how old a system is but whether it still receives fixes today. A posture check that ran once is a statement about the past, and your device posture check expires sooner than most audit evidence assumes.

A decision framework for this week

Sort your remaining Windows 10 devices into three groups before October 13:

• Can migrate within 90 days: let ESU lapse only if the migration date is firm, and record the gap as a short exception with an owner.
• Must keep running for a year or more: buy Year Two, then verify that updates actually install on each device, every month.
• Runs one application that can't move: price a cloud desktop with free ESU against Year Two, and isolate the device from the network if it stays.

Then make the record continuous: device by device, which ones are supported, which are excepted, and which are drifting.

The takeaway

• Windows 10 ESU Year 2 costs $122 per device, and payment is cumulative if you skipped Year One.
• ESU covers critical and important security updates only. Record what it doesn't cover.
• SOC 2, ISO 27001, PCI DSS, and NIST SP 800-53 all expect either vendor support or a documented, approved exception.
• Enrolled is not patched. Prove, per device, that updates are installing.
• An undocumented Windows 10 device is the one outcome that is always a finding.

See your own exposure first: scan 10 devices free and get an end-of-life verdict for each one in under an hour.