What end of support actually means
A Windows 10 computer doesn't stop working once support ends. It boots, opens files and connects to the internet exactly as it did the day before. What stops is the flow of monthly security updates that close newly found weaknesses. Every month after that, attackers learn about more flaws that will never be patched on those machines, so the risk grows steadily over time.
There are knock-on effects too. Software vendors gradually stop supporting their products on Windows 10, new printers and devices may not ship drivers for it, and Microsoft 365 apps on an unsupported system eventually fall outside Microsoft's support. Many cyber insurance policies and supplier security questionnaires now ask whether you run supported operating systems, and a yes is getting harder to give with Windows 10 in the office.
Check which computers can upgrade
Windows 11 has stricter hardware requirements than Windows 10. The computer needs a supported processor generation, TPM 2.0, Secure Boot capability and enough memory and storage. Broadly, many business PCs bought from around 2018 onwards meet the bar, and many older ones don't. The PC Health Check app from Microsoft will tell you for a single machine, and management tools such as Intune can report on the whole fleet at once.
Sometimes a computer fails the check only because TPM or Secure Boot is switched off in its firmware settings. A technician can turn those on and the machine becomes eligible. If the processor itself is too old, there is no supported upgrade path, and that device should be scheduled for replacement rather than forced onto Windows 11 with workarounds that leave it outside Microsoft's support.
Extended Security Updates as a bridge
Microsoft has offered paid Extended Security Updates for Windows 10 for a limited period after end of support, with the price rising each year. Some cloud and virtual desktop scenarios have had different terms. Because the rules and pricing have changed over time, check Microsoft's current terms before relying on them, and treat any extended update programme as a temporary measure while replacements arrive.
Extended updates are most useful for a specific machine you genuinely cannot change yet, such as a PC that drives a piece of lab or manufacturing equipment with software certified only on Windows 10. Even then, keep it off the general network where you can, restrict what it can reach, and set a firm date to retire it.
Planning the upgrade itself
For compatible computers, the in-place upgrade usually keeps files, apps and settings. Before you start, make sure files are backed up or synced to OneDrive, line-of-business software has been tested on Windows 11, and printer and scanner drivers are available. Upgrade one or two machines first, live with them for a week, then roll out to everyone else in batches outside busy periods.
For replacement machines, this is a chance to reset properly rather than carry years of clutter across. A new Windows 11 laptop enrolled through Autopilot and Intune, with files in OneDrive and SharePoint, can be productive within an hour of being unboxed. Plan the order so that staff on the oldest or least compatible hardware are replaced first.
Helping staff with the change
Windows 11 looks different enough to unsettle some users. The Start menu is centred by default, the right-click menu is shorter, and a few settings have moved. A short note explaining what changes, plus a few minutes showing people where their apps and files are, heads off a wave of support calls. The taskbar can be aligned to the left for people who prefer the old layout.
Finally, record what you've done. Note which machines are now on Windows 11, which have been replaced and which, if any, remain on Windows 10 under extended updates with their retirement date. If you're unsure where your office stands, a health check is a quick way to get a device-by-device list and a sensible order for the work.
Machines people forget about
The obvious laptops and desktops are usually found quickly. The ones that slip through are the PC in the warehouse that runs the label printer, the reception kiosk, the old desktop under a desk that hosts a shared folder, the computer attached to a CNC machine or medical device, and staff home computers used to access work email. Walk the office and ask each team what else is running Windows before you declare the job finished.
Virtual machines and servers count too. A Windows 10 virtual machine used for an old accounting package, or a jump box someone set up years ago, is just as exposed as a physical PC. List them alongside everything else, decide whether each one is still needed, and either upgrade it, replace it or switch it off.
In short
- Windows 10 stopped getting free security updates in October 2025.
- Check every PC with PC Health Check or your management tool.
- Enable TPM and Secure Boot before writing off a machine.
- Use paid extended updates only as a short, documented bridge.
- Pilot the upgrade on a few machines, then roll out in batches.