If your company bought a year of Windows 10 security updates last fall, that year just ran out. Here's what it means for the laptops in your job trailers and the PCs running Sage back at the office.
A year ago, Microsoft ended support for Windows 10. Most construction companies we talk to didn't replace every machine. Instead, many paid for Microsoft's Extended Security Updates (ESU) to keep older PCs patched while they figured out a plan.
That bridge just hit its first toll booth. Year one of business ESU coverage ended with the October 13, 2026 Patch Tuesday updates. Year two doesn't renew on its own, and it costs twice as much.
If you still have Windows 10 machines on the network, now is the time to decide what to do with each one.
What changed this week
Business ESU is sold one year at a time, and the price doubles each year. Year one covered security updates through October 13, 2026. A PC that isn't licensed for year two gets no more Windows security patches starting this month.
| ESU year | Coverage ends | Price per PC |
|---|---|---|
| Year 1 | October 13, 2026 | $61 |
| Year 2 | October 12, 2027 | $122 |
| Year 3 (final) | October 10, 2028 | $244 |
A few details catch people off guard:
- Nothing renews automatically. Year two is a new purchase, and the new key has to be activated on every machine.
- The years are cumulative. If you skipped year one, you have to pay for it before you can buy year two.
- It's patches only. ESU doesn't include new features, technical support, or fixes for problems that aren't security-related.
- Windows 10 keeps running. Nothing shuts off. The PC just stops getting fixes, and every new vulnerability stays open.
Run the math across a fleet. Ten Windows 10 laptops cost $1,220 for year two alone, and $3,660 to cover years two and three together. That's real money toward replacing the machines instead.
Why construction firms have more Windows 10 than they think
In most offices, Windows 10 is gone from the front desk. It's hiding in the machines nobody thinks of as "the computers." On a typical construction network, we usually find it on:
- Job trailer laptops that get passed between supers and rarely come back to the office for updates
- The plotter or large-format printer PC, kept on Windows 10 because the driver works and nobody wants to touch it
- Estimating and takeoff workstations running older software that was never tested on Windows 11
- Time clock and badge kiosks at the yard or shop
- The accounting PC that still runs Sage locally, or the old server it talks to
These are exactly the wrong machines to leave unpatched. Field laptops connect over hotspots and job-site Wi-Fi you don't control. Many of them log into your accounting system, your project files, and email. An attacker only needs one weak device to get a foothold, and from there your payroll, vendor payments and bid data are on the same network.
There's a business side too. Many cyber insurance applications now ask whether you run unsupported operating systems. And new plotters and peripherals are being released with Windows 11 drivers first, so the "don't touch it" PC gets harder to keep working every month.
A practical plan for the next 90 days
You don't need to replace everything this week. You do need to know what you have and make a decision for each machine.
- Take inventory. List every Windows device, including the ones in trailers, shops and yards. Note the Windows version, age, who uses it, and what software it runs.
- Sort each machine into one of three buckets.
- Upgrade: hardware that meets Windows 11 requirements. The upgrade itself is free.
- Replace: machines too old for Windows 11. Paying ESU on these just delays a purchase you'll make anyway.
- Bridge: the few machines with a real reason to wait, such as specialty software. Buy ESU year two for these only, and put a retirement date on each one.
- Check your Windows 11 machines, too. Windows 11 version 24H2 (Home and Pro) also reached end of support on October 13, 2026. Make sure those PCs have moved to a newer version.
- Plan around year-end. Upgrade field laptops now. Leave the accounting PC and anything tied to payroll alone until after your year-end close, then schedule it for January.
- Get Sage off the desk. If Sage still lives on a local PC or an aging server, that machine becomes a single point of failure every time it needs an update. Hosting Sage in the cloud takes it off your hardware entirely, and Windows 10 virtual machines in Microsoft's cloud services (like Windows 365 and Azure Virtual Desktop) receive ESU at no extra cost.
Not sure what's still running Windows 10?
We help construction companies find the forgotten machines, sort out what to upgrade, replace or bridge, and time the work so it never lands on top of year-end close. If Sage is part of the picture, we can show you what it looks like hosted in the cloud instead of on a PC that needs babysitting.
