Windows 10 ESU cost in year two and three, and when paying it beats replacing

The price, from Microsoft, and the two rules that change it

Microsoft Learn states the commercial Extended Security Updates price plainly: $61 per device for year one, and the price doubles every consecutive year for a maximum of three years. Microsoft prints only the $61 base; the year two price of $122 and the year three price of $244 follow from the doubling rule, and reseller listings for the year two commercial SKU match that figure. Across three years a device costs $427.

The second rule matters more for anyone deciding today. ESUs are cumulative. In Microsoft's words, if you decide to purchase the program in year two, you have to pay for year one too. A commercial device with no ESU today therefore costs $183 to cover now, not $122. The Partner Center page adds the dates: year one ran from 15 October 2025 to 13 October 2026, year two runs from 14 October 2026 to 12 October 2027, and year three runs from 13 October 2027 to 10 October 2028, after which commercial coverage ends.

What ESU covers, and what it never will

ESU delivers critical and important security updates only. There are no feature updates, no non-security fixes and no general technical support; Microsoft supports only ESU activation, installation and regressions. The prerequisites on the Enable ESU page are Windows 10 version 22H2 with the October 2025 cumulative update (KB5066791) or later, then the ESU licensing preparation package (KB5072653). Long-term servicing editions have their own lifecycle and are outside the Windows 10 ESU program.

A related date that often gets missed: Microsoft 365 Apps on Windows 10 continue to receive security updates until 10 October 2028, but feature updates stop and devices stay on version 2608. An ESU device is therefore a frozen device, patched but not improved, for as long as you keep it.

Buying it, and the cumulative trap

Commercial ESU comes through two channels. Volume Licensing customers receive multiple activation keys in the Microsoft 365 admin center, visible to the Product Key Reader or Volume Licensing Administrator roles, and activate devices with the year-specific activation IDs listed on the Enable ESU page. Cloud Solution Provider customers buy perpetual SKUs per year, available since 1 September 2025, and Microsoft tells partners that once the year two coverage dates are current they should purchase both year one and year two for a device. The minimum purchase is one license, so a fleet can cover ten devices as easily as ten thousand.

For 300 commercial Windows 10 devices with no previously purchased ESU and no included entitlement, enrollment during year two costs $54,900: 300 times $183. If year one is already licensed, the additional year-two cost is $36,600: 300 times $122. Compare the applicable cost with upgrading or replacing those devices before the next planned refresh.

Devices that get ESU at no extra cost

Before you count your Windows 10 devices, remove the ones Microsoft covers for free. The ESU page lists Windows 10 virtual machines in Windows 365, Azure Virtual Desktop, Azure VMs, Azure Dedicated Host, Azure VMware Solution, Nutanix Cloud Clusters on Azure, Azure Local, Azure Stack Hub and Azure Stack Edge. It also entitles Windows 10 endpoints connecting to Windows 365 Cloud PCs to ESU for up to three years with an active Windows 365 license. A thin client that only ever opens a Cloud PC is not an ESU cost.

Keep the consumer program out of your spreadsheet. Microsoft extended consumer ESU for Home and Pro devices to 12 October 2027, with free, rewards-points and $30 options, but its page states that the consumer program cannot be used in commercial scenarios and is not offered to domain-joined, Entra-joined or MDM-enrolled devices. Many articles still quote consumer dates for commercial fleets. They are two separate programs.

A per-device rule: upgrade, ESU, or replace

Sort every Windows 10 device into three groups using data you already have. The Windows feature update device readiness report in Intune, under Reports, Device management, Windows updates, Reports, then Windows Feature Update Device Readiness Report, marks each device Low, Medium or High risk, or Replace device when it is not capable of upgrading, and lists the reason code: processor family, memory, BIOS, TPM, drive size or Secure Boot. Configuration Manager fleets get the same facts from the processor, TPM and BIOS inventory views.

• Upgrade in place when the device meets the Windows 11 requirements and its other signals are clean. It costs nothing in hardware, and the device keeps earning its keep until its class life says otherwise.
• Pay ESU when the device cannot take Windows 11 but is otherwise healthy and sits in a replace or right-size cohort scheduled for a later quarter. The $183 buys an orderly replacement instead of an emergency one, and it is still far below a new device at 2026 prices.
• Replace now when the device cannot take Windows 11 and the reliability or performance signals also agree, or when it has no redeploy target and its class life is spent. Paying $183 to keep a machine that is already generating tickets only adds a line to the cost of doing nothing.
• Retire devices that no longer need to remain in service. If a device remains on Windows 10 until a later quarter, include ESU coverage for that period in the comparison.

What the math looks like on a fleet

In our sample report, a fictional fleet of 7,400 devices still has 580 on Windows 10. The report shows that 324 of them can upgrade in place this quarter and the rest sit in the replace or right-size queue. Covering the whole group with ESU today would cost 580 times $183, or $106,140, and the report lists that as the cost of doing nothing on the Windows 10 line, next to the count of aging devices the calendar would have kept.

That is the shape of the decision for every fleet: upgrade the ready devices for nothing, pay ESU for the few that need a planned exit, and spend the hardware budget on the devices whose signals agree. The initial report produces the three groups and the ESU figure for your own fleet from an export, and the verdicts page explains how Windows 11 readiness is weighted against the other four signals.

Common questions