What “end of support” means

Microsoft has stopped shipping free security patches for Windows 10. New vulnerabilities found from now on won’t be fixed, which makes those machines a soft target and can affect your cyber-insurance and compliance position.

Nothing switches off, which is why this gets ignored. The machines boot, the applications run, and there’s no visible symptom. The change is that the gap between “a flaw is discovered” and “your machine is protected” is now permanent. Every month that passes adds to the list of known ways in that will never be closed.

Two practical consequences tend to focus minds faster than the security argument:

Insurance and client questionnaires. Cyber insurers ask whether you run supported operating systems. So do the security questionnaires that larger clients send to their suppliers. Unsupported machines are an awkward answer, and in some cases a condition of cover.

Software support drops away too. Vendors follow Microsoft. Over time, browsers, accounting packages and line-of-business applications stop testing against Windows 10, then stop supporting it, then stop installing.

Your options

  • Upgrade eligible PCs to Windows 11 in place — free, and usually the simplest path
  • Replace hardware that doesn’t meet Windows 11 requirements (roughly pre-2018 machines)
  • Buy Extended Security Updates (ESU) as a short, paid bridge if you can’t move yet

Most offices end up with a mix of all three. Decide machine by machine; one policy for the whole office usually costs more.

On the in-place upgrade: it keeps files, applications and settings, and it is the least disruptive of the three options. Back up first anyway.

On replacement: the blocker is usually TPM 2.0 and the supported-CPU list rather than RAM or disk, which is why age is a rough guide but not a reliable one. Some 2017 machines qualify and some 2019 ones don’t. Check rather than assume.

On ESU: it has a hard end date, so use it for the one or two machines that can’t move yet, such as a PC attached to a piece of equipment or one running software with no current version. Paying for it across every machine just delays the same job.

How to plan the move

Start with an inventory: which machines can run Windows 11, which can’t, and what each person actually needs. Stagger the rollout so nobody loses a working day, and back up before every upgrade.

Do the inventory before you price anything. It almost always reshapes the budget, usually downwards — the assumption that “these are all old, we’ll need to replace the lot” is wrong more often than it’s right.

Then sequence deliberately:

Start with the least critical user. The first upgrade always surfaces something — a driver, a peripheral, a licence prompt. Find it on a machine where an hour’s disruption doesn’t matter.

Group by application, not by department. If one team runs specialised software, upgrade one of their machines and test properly before touching the rest.

Leave the hardest for last, with a plan. The machine attached to the old label printer or the practice-management system is the one that will take a full day. Know that in advance rather than discovering it on a Friday afternoon.

Don’t forget what leaves the building

Retired machines carry your data out the door. Wipe them properly — a quick format doesn’t count — or have them destroyed with a certificate if they held personal or client information. Data on a disposed device is still your responsibility.

Before a machine goes, check what else it was doing. Old PCs are often the only place a scanner is mapped, a licence is activated, or a spreadsheet lives.

A quick checklist

  • List every device and its Windows 11 eligibility
  • Confirm key apps are compatible
  • Back up, then upgrade in small batches
  • Retire or securely wipe machines you’re replacing

What Windows 11 changes for users

Not much. The Start menu moves to the centre, the settings app is rearranged, and right-click menus are reorganised. Most people are comfortable within a day.

If you’re running Microsoft 365, the applications are identical; the upgrade doesn’t touch them. Telling your team that beforehand removes most of the resistance.

In our experience the inventory usually shows fewer machines need replacing than the business expected, so do it before setting a budget.