For: anyone still running a Windows 10 PC, wondering "I heard support ended — is it OK to just keep using it? There's some extension option too, right?" Here's the honest answer. No attack steps — just what the risk actually is, and how to move safely.
Scope and verification: regular 22H2 and consumer ESU
This article covers Windows 10 Home, Pro, Pro Education and Pro for Workstations version 22H2 and consumer ESU. LTSC/IoT lifecycles and commercial ESU have different dates and conditions. Official guidance checked on October 16, 2026 lists consumer ESU through October 12, 2027, with automatic continuation for existing enrollees. Check enrollment and update history in Settings → Update & Security → Windows Update, recheck official guidance, and prioritize migration.
This site's view: antivirus doesn't fix OS vulnerabilities
"I've got security software, so I'm fine" is a common belief — and a mistaken one. Antivirus watches for suspicious files and behavior; it cannot fix vulnerabilities in the OS itself (kernel, drivers, network handling). OS patches are the main line of defense and AV is only a supplement. Once OS fixes stop, the OS vulnerabilities remain no matter what other software you install. That's the real danger of an out-of-support OS.
What ended, and when
2025-10-14
Regular 22H2 support ended. Regular Home/Pro-family security updates ended; eligible devices enrolled in consumer ESU can receive covered updates.2026-10-16
Official guidance checked. Consumer ESU is listed through October 12, 2027, with automatic continuation for existing enrollees. We corrected the earlier claim that all updates stop from October 14, 2026.2027-10-12
Current consumer ESU end date. Finish migration within this window, recheck future official conditions, and do not apply this date to LTSC/IoT or commercial programs.
Why it's dangerous to keep using it
"It still runs, and nothing has happened so far" is the feeling most likely to mislead you. The danger doesn't arrive as a "break"; it arrives as unfixed vulnerabilities slowly adding up.
Concretely, here's what happens.
Without regular updates, vulnerabilities can remain unpatched
Attackers prioritize EOL machines
Other software drops support one by one
Antivirus can't protect against OS vulnerabilities
What the extension (consumer ESU) really is
ESU (Extended Security Updates) reduces risk while you migrate. Official guidance checked on October 16, 2026 lists consumer coverage through October 12, 2027, with automatic continuation for existing enrollees. It covers Critical/Important security updates, without feature updates, other fixes or technical support.
The Japanese official page lists these three enrollment routes. Compare your region's conditions, the information synced, and the cost before choosing.
No additional charge: sync PC settings
Redeem Microsoft Rewards points
Paid: one-time $30 equivalent plus tax
Free enrollment conditions and routes vary by country or region
EEA (European Economic Area) guidance offers a no-additional-charge route subject to conditions such as remaining signed in with a Microsoft account. Our earlier descriptions of an unconditional free first year in the EEA and Japan being excluded from free enrollment were inaccurate. Japan also has a no-additional-charge settings-sync route. Check your region's official guidance and enrollment screen. Commercial ESU is a separate program; these consumer dates and conditions must not be reused for it.
Check eligibility and excluded devices first
The editions above must run 22H2 with the latest Windows updates and the ESU Licensing Preparation Package, KB5126256. Enrollment requires an administrator Microsoft account that is not a child account.
Consumer ESU cannot be used commercially, or on kiosk devices, Active Directory/Entra joined devices, or devices enrolled in MDM. Entra registered devices are an exception; registered differs from joined. If an ESU license already exists, check its enrollment state. Consult your administrator for organizational devices.
What to do
The key is to use ESU for time and finish migrating within that window.
Do nothing, keep using it
- regular updates are unavailable, leaving unpatched vulnerabilities
- as an EOL machine, it becomes more likely to be targeted
- other software drops support, shrinking what you can safely do
- check work insurance and compliance requirements against the specific contract or policy
Migrate (with ESU in the meantime)
- Windows 11 means patches arrive again
- even on unsupported hardware, ESU secures time to migrate
- old machines can keep getting updates on Linux
- migration becomes a planned task with a deadline
First, check whether you can move to Windows 11
If the hardware won't qualify, enroll in ESU first for more time
If you just want to keep using old hardware, Linux is an option
Take interim measures until you've migrated
How this site thinks about it
On handling out-of-support environments, this site applies the same principle laid out in "the practice of vulnerability response" — an end-of-life machine gets isolated before it gets removed. If you genuinely must keep an old Windows 10 box around, the worst thing is to use it as your everyday main machine, permanently connected to the internet. Conversely, isolating it (taking it off the network, narrowing its purpose, keeping no important data on it) reduces the paths an attacker can use to reach it. If you can't fix the vulnerabilities, limit what can reach them. Isolation is an interim measure during migration and does not guarantee safety. Consider removable media and remaining connections too, and prioritize moving to an environment that receives updates.
The real goal remains: move to an OS that still gets updates before the ESU window closes.
Limited correction and sources: October 16, 2026
We aligned consumer ESU dates, automatic continuation, eligibility and regional routes with official guidance, correcting the earlier one-year limit, complete update cutoff from October 14, 2026, and free-enrollment geography. We also qualified claims of permanent non-fixing, universal insurance/policy failure and guaranteed safety through isolation. This date applies to these corrections; it does not indicate a new verification of every claim or source in this article.