The Windows 10 estate: year-two math

Windows 10 support ended October 14, 2025. If your fleet is still on it, you are in one of two situations, and only one of them is a plan.

Enterprise Extended Security Updates run three years, priced to escalate: the published pattern doubles the per-device cost each year. Year one was the cheap seat. Year two, starting this October, is where the spreadsheet starts arguing for hardware, and year three is priced to end the argument.

Run the actual numbers, per device class:

1. Count the Windows 10 boxes that cannot upgrade to 11 (hardware gate: TPM, CPU list). That subset is your real problem; the rest is a deployment project you have been deferring, which is different from a problem.
2. For the gated subset, compare three-year ESU total against replacement hardware amortized over the same window. With the doubling schedule, replacement wins earlier than most finance models expect. Show the crossover month.
3. Subtract the machines that should not exist: the kiosk nobody uses, the PC under the lab bench running one vendor tool. Retirement is cheaper than either column, and every estate we walk has more of these than the CMDB admits.

The trap to name out loud: ESU year one felt cheap, so the estate learned that staying put costs little. The schedule is designed to unteach that, one doubling at a time. Teams that treat ESU as a bridge with an exit date written down do fine. Teams that treat it as a subscription discover in year three that they have paid for the new hardware without receiving it.

October is the checkpoint. Walk in with the crossover math done.