On October 13, 2026, the first commercial year of Extended Security Updates (ESU) for Windows 10 comes to an end. The regular end of support for the operating system was exactly one year ago: since October 14, 2025, businesses have received security updates for Windows 10 only if they pay for them (devices running LTSC versions are a special case, more on that below). From October 14, 2026, this protection continues only if the second ESU year is licensed for the device in question. This article puts into context what Microsoft has published on dates, prices and exceptions, where devices running Windows 10 IoT Enterprise LTSC follow their own path, and how you, as the operator of a rugged device fleet, can arrive at a well-founded decision. There is no reason to panic: Microsoft itself states that Windows 10 PCs keep working. What is called for is a clean inventory, because specialist software, long service lives and approvals make migrations slower with rugged devices than in the office.
The Extended Security Updates lifecycle overview (last updated by Microsoft on August 24, 2026) gives the following key dates for Windows 10:
According to Microsoft, the Enterprise, Education and Pro editions in commercial use are eligible. The technical prerequisite is Windows 10 version 22H2; in addition, Microsoft requires two specific preparatory updates, which are named in the guide to ESU activation. As to scope: ESU delivers security updates that Microsoft rates as “critical” or “important”. New features, non-security updates and general technical support are not included; support is available only for license activation, installation and possible errors of the ESU updates themselves. Microsoft explicitly describes the program as a paid last resort and as a time-limited bridge, not as a permanent solution.
The Microsoft page on the ESU program (as of November 17, 2025) states the list price for businesses: 61 US dollars per device for the first year, available through the Microsoft volume licensing program. The price doubles every following year, for a maximum of three years. This works out at 122 US dollars for year 2 and 244 US dollars for year 3; covering all three years comes to 427 US dollars per device. These totals are our own calculation based on the Microsoft figure, not Microsoft numbers. They are also Microsoft’s list prices in US dollars and not RobustBook prices; clarify euro amounts and terms with your licensing partner.
More important than the individual sum is the rule behind it: ESU is cumulative. Microsoft states that ESU is available only by the year and that anyone joining in year 2 must also pay for year 1. So if you have not licensed a single device so far and now want to “bridge” your fleet with ESU, you pay the sum of both years for year 2. The bridge thus becomes more expensive with every year, while the number of devices it still carries should ideally fall. For the decision this means: ESU pays off where a device will be replaced or converted in the foreseeable future anyway, and less where it is meant to keep running unchanged for three years.
Of practical relevance for field use: the license is activated with a key that authorized users can view in the Microsoft 365 admin center. According to Microsoft, devices that have no internet access or no access to the Microsoft activation servers can be activated through a manual procedure using an Installation ID and a Confirmation ID, which Microsoft describes as activation by phone; for large numbers of devices without internet access, Microsoft additionally describes proxy activation with the Volume Activation Management Tool. You should clarify this in advance, because many rugged devices run in networks that are cut off from the internet.
Alongside the commercial program, Microsoft offers an ESU program for consumers, whose end the Microsoft page gives as October 12, 2027. It is considerably cheaper: free with settings sync enabled, for 1000 Microsoft Rewards points, or for a one-time 30 US dollars; one license covers up to ten devices. For businesses it is nevertheless not an option, because Microsoft excludes participation as soon as a device belongs to an Active Directory domain or Microsoft Entra, is managed through an MDM solution or runs in kiosk mode. That typically applies to managed company devices. The consumer program is therefore not suitable as a shortcut for company fleets; it matters here only as a point of contrast.
Some rugged devices are not delivered with Windows 10 Pro but with Windows 10 IoT Enterprise in the Long-Term Servicing Channel (LTSC). A different calculation applies to these devices. In its ESU guide, Microsoft makes clear that Windows 10 versions in the Long-Term Servicing Channel have their own lifecycles and are not covered by the Windows 10 ESU program. So you cannot buy an ESU license for such a device, but you do not need one either, as long as its own timeframe is running.
For Windows 10 IoT Enterprise LTSC 2021, the Microsoft lifecycle page gives the following dates: start on November 16, 2021, end of mainstream support on January 13, 2027, end of extended support on January 14, 2032. What this means is governed by the Fixed Lifecycle Policy: during mainstream support, security updates, non-security updates and change requests are possible. During extended support, security updates continue at no extra cost, but there are no more non-security updates and no more design or feature changes. In practice this means: January 13, 2027 is a cut in the scope of service for LTSC 2021 devices, but not the end of security updates. According to Microsoft, that end falls in January 2032.
The exact designation on the device matters. “IoT Enterprise” alone does not automatically mean “LTSC 2021”. Our own product pages already show the range: the Fieldbook P80 lists “Windows 10 IoT Enterprise SAC”, the datasheet of the Durabook S15 names “Windows 10/11 LTSC Enterprise (depending on processor)” as a downgrade option, and the RuggON Vulcan 10X lists “Windows 10 / Windows 11 IoT Enterprise”. Which variant is installed on a particular device and which lifecycle applies to it, you read off the device and the licensing documentation, not from the product family.
A third track concerns embedded products. In its lifecycle overview, Microsoft notes that Extended Security Updates for selected embedded products are obtained through the device manufacturers (OEMs). Whether this applies to your device, which variant is meant and on what terms it is offered can only be asked of the respective device manufacturer. We deliberately make no statement on this here, nor on which manufacturer offers anything of the kind.
The decision is made per device, not per fleet. For that you need a list with a few, but reliable, data points:
The minimum requirements are on the Microsoft page “Windows 11 requirements” (last updated in July 2026). For the check itself, Microsoft names the PC Health Check app for Windows 10 Home, Pro and Pro for Workstations; users of Enterprise and Education editions should, according to Microsoft, rely on their IT administration. For organizations, Microsoft points to reports in its own management tools such as Endpoint analytics. In addition, Microsoft writes in its processor notes that you can have the device manufacturer confirm which Windows is available on a particular device. This inquiry to the manufacturer is a sensible additional route alongside checking on the device.
On software: Microsoft states that the application compatibility of Windows 10 is preserved in Windows 11, and cites Windows 10 compatibility rates of over 99.7 percent for businesses, including specialist applications. For eligible customers with more than 150 devices, the App Assure service is free of charge according to Microsoft; it is meant to help resolve compatibility problems. That is a manufacturer statement about the platform. It does not replace sign-off by the software vendor if its application is certified only for certain Windows versions. For measurement, diagnostic and industry-specific software, this sign-off can be the real bottleneck.
After the inventory, you assign each device to one of three paths.
Devices that meet the requirements can be updated to Windows 11; Microsoft names tools such as Windows Autopatch and Microsoft Intune for this. Plan a pilot group that tests drivers, peripherals (scanners, radio modules, card readers) and the specialist software in real use. An upgrade is particularly worthwhile for newer devices whose service life is still long. For the Durabook S15AB, for example, the product page states “Windows 10 Pro (upgrade to Windows 11 possible)”; whether that holds for a specific device in your fleet is decided by the check in step 2.
The bridge to October 12, 2027 suits devices that will be replaced soon, whose specialist software is still waiting for approval for Windows 11, or whose replacement is tied to a fixed maintenance date. It is not a strategy but a gain in time: the price doubles, year 3 only runs until October 10, 2028, and Microsoft expects the devices to be migrated within that time. Document for each device what the time is being used for, otherwise the same decision will be back in a year.
Devices that cannot run Windows 11 or are at the end of their service life belong in replacement planning. Rugged devices add three particularities. First, they often stay in use considerably longer than office PCs, so a replacement has to pay off over a long service life and the question about the next generation of the operating system should be asked at the same time. Second, many devices carry specialist software that must be tested or re-approved before the change. Third, an Ex approval is as a rule tied to a particular device configuration. Whether a different operating system or a hardware swap affects the approval, clarify with the device manufacturer and, where applicable, the responsible body before you change anything. Background on this is offered by our article on ATEX and explosion protection for devices. As an example: the product pages of the Getac ATEX EX80 and the Getac X500 state “Windows 10 Pro”. For such devices you should get the answer not from a blog article but from the manufacturer.
If you are replacing devices anyway, you can include devices with an NPU in the selection. An NPU is not a Windows 11 requirement, since Microsoft’s minimum requirements do not mention it. What the “Copilot+ PC” device class brings and where its limits lie is covered in the article Copilot+ PC and NPU. For tablets, a replacement also often raises the fundamental question of whether Windows or Android is the better platform; there is a separate article on that: Windows or Android for a rugged tablet.
The following models list Windows 11 as the operating system on their product pages. This is a selection, not a recommendation for a particular use; the configuration depends on software, environment and approval.
Among the tablets, the Durabook models R11, R11L, R8 and U11I also list Windows 11 Professional. Operating system, processor and security features can be set side by side in the laptop comparison table and the tablet comparison table. We do not give prices here; you can get a quote on request.
No. Microsoft states that Windows 10 PCs keep working. Without security updates, that is without an ESU license for the device in question, the security risk does rise, however, and Microsoft recommends moving to Windows 11. Whether and for how long an unpatched device is tolerable in your network is a matter for your own risk assessment and your security policies.
No. The program is cumulative: according to Microsoft, anyone joining in year 2 must also pay for year 1. Partial periods within a year are not available either.
No. Microsoft excludes Long-Term Servicing versions from the Windows 10 ESU program and gives them their own lifecycles. For LTSC 2021, mainstream support ends on January 13, 2027 and extended support on January 14, 2032. For embedded products, Microsoft refers to the device manufacturers for ESU; direct the question of whether and how this works for your device to the manufacturer.
Not for managed company devices. Microsoft excludes devices that belong to a domain or Microsoft Entra, are managed through MDM or run in kiosk mode. For such devices, the commercial program remains.
October 13, 2026 is a deadline, but not an abyss. Anyone operating Windows 10 devices in business use has three documented paths: upgrading to Windows 11, ESU year 2 and later year 3 as a time-limited bridge, or replacement with new hardware. Devices with Windows 10 IoT Enterprise LTSC run on a track of their own with their own dates, and for embedded ESU the device manufacturer is responsible. The first step is the same in every case: take inventory of edition, version, processor and TPM, clarify the software sign-off and decide for each device whether it is to be upgraded, bridged or replaced. If you need support selecting suitable devices along the way, the RobustBook team will gladly help.