{"id":29909,"date":"2026-08-14T01:19:23","date_gmt":"2026-08-14T01:19:23","guid":{"rendered":"https:\/\/www.insentragroup.com\/au\/?p=29909"},"modified":"2026-08-19T14:25:27","modified_gmt":"2026-08-19T14:25:27","slug":"windows-10-esu-is-about-to-double-in-price-before-you-renew-ask-what-its-actually-buying-you","status":"publish","type":"post","link":"https:\/\/www.insentragroup.com\/au\/insights\/geek-speak\/modern-workplace\/windows-10-esu-is-about-to-double-in-price-before-you-renew-ask-what-its-actually-buying-you\/","title":{"rendered":"Windows 10 ESU is about to double in price. Before you renew, ask what it’s actually buying you."},"content":{"rendered":"\n

Year One of Extended Security Updates bought breathing room. Year Two doubles the cost without changing the strategy. Here’s what’s changing, what you’re actually paying for, and how to break the ESU renewal cycle for good.<\/p>\n\n\n\n

14 October 2026<\/strong><\/td>Windows 10 ESU Year One coverage ends and Year Two pricing begins: US$122 per device, double Year One’s US$61. Organisations that skipped Year One can still enrol in Year Two, but only by also paying for Year One retroactively.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

The Situation<\/h2>\n\n\n\n

Windows 10, meaning the Home, Pro, Enterprise, and Education editions running across most general-purpose EUC fleets, reached end of support on 14 October 2025<\/strong>. A large number of organisations weren’t ready to move the whole estate to Windows 11 by that date, so they did the sensible thing: they bought a year of Extended Security Updates (ESU) as a bridge and kept moving.<\/p>\n\n\n\n

That bridge now has its own expiry date. Year One coverage runs out on 13 October 2026, and Year Two takes effect the next day at double the price<\/strong>. The ESU licensing model is also cumulative: organisations that didn’t enrol in Year One can’t simply buy Year Two. They have to purchase both years, retroactively, to bring devices into compliance.<\/p>\n\n\n\n

Cost trajectory<\/h2>\n\n\n\n

Year One’s US$61 per device becomes US$122 in Year Two, then US$244 in Year Three, for a maximum three-year cost of US$427 per device. The structure is deliberate: it gets more expensive the longer migration is delayed.<\/p>\n\n\n\n

Hardware ceiling<\/h2>\n\n\n\n

A meaningful share of the fleet still on Windows 10 lacks the TPM 2.0 module or other baseline specs Windows 11 requires, so ESU is often being bought for devices that couldn’t take a straightforward in-place upgrade anyway.<\/p>\n\n\n\n

What ESU actually buys<\/h2>\n\n\n\n

ESU delivers critical and important security patches only. There are no feature updates, no non-security fixes, and no bundled technical support beyond a separate Microsoft support plan. It holds the current level of risk in place rather than reducing it.<\/p>\n\n\n\n

Already covered, without knowing it<\/h2>\n\n\n\n

Windows 10 sessions already running through Windows 365 Cloud PC or Azure Virtual Desktop have ESU included at no extra per-device charge, automatically. Any existing workload running that way has, in effect, already solved this renewal decision, even if that hasn’t been recognised yet. This applies to sessions already in place, though: Microsoft has been retiring the ability to provision new Windows 10 images through both services, so it isn’t a lever for standing up fresh Windows 10 workloads going forward.<\/p>\n\n\n\n

A one-year licence, side by side<\/h2>\n\n\n\n

Street pricing for a one-year IGEL OS Standard subscription runs from roughly US$109 to US$116 per device, in the same range as the US$122 Microsoft is charging for Year Two ESU alone. The difference is what that year buys: ESU is a countdown that doubles in cost again by Year Three and still only defers the underlying problem. An IGEL subscription is a flat, recurring platform licence that takes the exposed Windows attack surface off the device for as long as it’s renewed. It isn’t a fee for permission to stay exposed a little longer.<\/p>\n\n\n\n

The better path<\/h2>\n\n\n\n

The default response to a Year Two renewal notice is to pay it, then face the same choice again next year at double the cost, or scramble a hardware refresh across every device the TPM 2.0 requirement rules out. Both are reasonable if the device genuinely needs a full local Windows install. Many EUC endpoints don’t. A large share exist to display a workspace, a browser-based line-of-business app, or a hosted session. For those devices, the more useful question isn’t which year of ESU to buy, but whether the endpoint needs to run Windows locally at all.<\/p>\n\n\n\n

IGEL OS 12<\/strong>\u00a0replaces the local operating system with a secure, lightweight, Linux-based OS built to do one thing well: give the user what they need however it’s best delivered. In order of preference, that means: running the required applications directly on the endpoint; securely connecting to a hosted Windows service such as a virtual desktop, DaaS, or cloud workspace (Citrix, VMware Horizon, Microsoft AVD, Windows 365, among them) where a hosted session is genuinely required; and, where neither of those fits, containing the Windows dependency itself rather than exposing it to the hardware. Where an existing hosted Windows 10 session is already in place, the ESU inclusion noted above already applies. For a new deployment, the hosted instance would typically be provisioned on Windows 11 rather than Windows 10, since Microsoft has retired new Windows 10 provisioning through these services, so the ESU question doesn’t arise there either. Either way, the endpoint itself carries no local Windows install to patch.<\/p>\n\n\n\n

That third option matters for the line-of-business applications that are the real reason many fleets are still on Windows 10 in the first place: software that hasn’t been rebuilt for Windows 11, isn’t a candidate for full VDI, but still has to run. The IGEL Managed Hypervisor<\/strong> lets that Windows 10 application keep running exactly as it does today, inside a contained, centrally managed Windows virtual machine on the endpoint itself, delivered to the user seamlessly through IGEL’s Published Apps model rather than as a separate desktop to switch into. The underlying IGEL OS 12 layer stays isolated from that Windows instance, so a vulnerability or failure inside it doesn’t reach the hardware or the network beyond it, and the VM can be reset to a known-good state on every restart. Whichever of the three models applies, the endpoint itself no longer carries an exposed Windows attack surface, so the ESU renewal cycle stops being an endpoint-level decision entirely.<\/p>\n\n\n\n

This also removes the hardware ceiling from the impact cards above. IGEL OS has a far smaller compute footprint than Windows, so devices facing retirement purely because they lack TPM 2.0 or another Windows 11 prerequisite can often be repurposed and kept in service, extending their useful life instead of forcing a refresh driven by a licensing requirement rather than actual hardware failure.<\/p>\n\n\n\n

The opportunity<\/h2>\n\n\n\n

A Year Two renewal notice is usually treated as routine: the same line item, twice the invoice. Treated as a decision point instead, it’s the moment to move the eligible share of the fleet onto IGEL OS 12 and stop the renewal cycle for good: run applications natively where possible, route true desktop needs to a hosted Windows service, and contain anything still tied to Windows 10 itself inside a managed hypervisor rather than on the bare endpoint. Note that the base IGEL OS subscription used for the cost comparison above covers native and hosted delivery; the Managed Hypervisor is a licensed add-on on top of it, so get a quote for that specific mix from an IGEL partner before budgeting.<\/p>\n\n\n\n

What needs to happen<\/h2>\n\n\n\n
1<\/strong> <\/td>Segment the fleet before renewing anything<\/strong>
Split devices still on Windows 10 into those that genuinely need a local Windows install and those that only display an application or a hosted session. Only the first group actually needs an ESU decision.<\/td>		NOW<\/strong><\/td><\/tr>
2<\/strong><\/td>Confirm real Year Two cost exposure<\/strong>
Check which devices have valid Year One coverage and which don’t, work out the true retroactive cost for any that were missed, then model the full three-year exposure if nothing changes.<\/td>		NOW<\/strong><\/td><\/tr>
3<\/strong><\/td>Inventory what’s already covered<\/strong>
Identify sessions already delivered via Windows 365 Cloud PC or Azure Virtual Desktop. These already include ESU and shouldn’t be double-counted in the renewal budget.<\/td>		NOW<\/strong><\/td><\/tr>
4<\/strong><\/td>Pilot IGEL OS 12 on eligible endpoints<\/strong>
Convert a representative batch of devices identified in step one, connect them to the native applications or hosted services they need, and validate performance and user experience before scaling.<\/td>		PLAN<\/strong><\/td><\/tr>
5<\/strong><\/td>Pilot the Managed Hypervisor for stubborn Windows 10 apps<\/strong>
For the applications that are the actual reason a device is still on Windows 10, test the IGEL Managed Hypervisor on a small group first, and confirm the app runs as expected via Published Apps before relying on it fleet-wide.<\/td>		PLAN<\/strong><\/td><\/tr>
6<\/strong><\/td>Route the rest to a hosted Windows service<\/strong>
For endpoints that still need a full Windows desktop but not locally, connect them through VDI, DaaS, or a cloud workspace instead of renewing ESU on the physical device itself.<\/td>		PLAN<\/strong><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Bottom line<\/h2>\n\n\n\n

For devices that genuinely require a local Windows 10 installation, Year Two of ESU remains a defensible spend. But treated as a blanket renewal rather than a considered decision, it’s a cost that doubles again by Year Three, for a risk position that never actually improves, only gets billed at a higher rate. For everything else, that spend is a choice, not a necessity: IGEL OS 12, whether running applications natively, connecting to hosted Windows services, or containing legacy Windows 10 apps in the Managed Hypervisor, costs roughly the same as a single year of ESU and ends the renewal question rather than deferring it again. The organisations that get ahead of this aren’t the ones who renew fastest. They’re the ones who use the Year Two notice as the trigger to ask which devices need to be on this treadmill at all.<\/p>\n\n\n\n

Key facts at a glance<\/h2>\n\n\n\n
\u00b7<\/strong> Windows 10 support ended 14 October 2025
\u00b7<\/strong> Full 3-year ESU exposure: up to US$427\/device
\u00b7<\/strong> Some Windows 365\/AVD sessions may already be covered, check before renewing
\u00b7<\/strong> IGEL OS 12 ends the renewal cycle, including a secure option for legacy Windows 10 apps<\/td>		\u00b7<\/strong> Year Two renewal doubles to US$122\/device from 14 October 2026
\u00b7<\/strong> ESU buys time only: patches, not new features or support
\u00b7<\/strong> IGEL OS 12: about US$109 to US$116\/device, similar cost to Year Two ESU<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Ready to Break the ESU Renewal Cycle?<\/h2>\n\n\n\n

Don\u2019t let Year Two become another costly renewal. Contact us today<\/strong><\/a> to assess your Windows 10 fleet, identify where IGEL OS 12 can help, and explore a smarter path beyond ESU renewals.<\/p>\n","protected":false},"excerpt":{"rendered":"

Year One of Extended Security Updates bought breathing room. Year Two doubles the cost without changing the strategy. Here’s what’s changing, what you’re actually paying for, and how to break the ESU renewal cycle for good. 14 October 2026 Windows 10 ESU Year One coverage ends and Year Two pricing begins: US$122 per device, double… Continue reading Windows 10 ESU is about to double in price. Before you renew, ask what it’s actually buying you.<\/span><\/a><\/p>\n","protected":false},"author":161,"featured_media":29925,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"content-type":"","footnotes":""},"categories":[19],"tags":[],"class_list":["post-29909","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-modern-workplace","entry"],"_links":{"self":[{"href":"https:\/\/www.insentragroup.com\/au\/wp-json\/wp\/v2\/posts\/29909","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.insentragroup.com\/au\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.insentragroup.com\/au\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.insentragroup.com\/au\/wp-json\/wp\/v2\/users\/161"}],"replies":[{"embeddable":true,"href":"https:\/\/www.insentragroup.com\/au\/wp-json\/wp\/v2\/comments?post=29909"}],"version-history":[{"count":6,"href":"https:\/\/www.insentragroup.com\/au\/wp-json\/wp\/v2\/posts\/29909\/revisions"}],"predecessor-version":[{"id":30007,"href":"https:\/\/www.insentragroup.com\/au\/wp-json\/wp\/v2\/posts\/29909\/revisions\/30007"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.insentragroup.com\/au\/wp-json\/wp\/v2\/media\/29925"}],"wp:attachment":[{"href":"https:\/\/www.insentragroup.com\/au\/wp-json\/wp\/v2\/media?parent=29909"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.insentragroup.com\/au\/wp-json\/wp\/v2\/categories?post=29909"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.insentragroup.com\/au\/wp-json\/wp\/v2\/tags?post=29909"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}