Windows 10 reached end of support on 14 October 2025. Most organisations moved the bulk of their fleet in time, or close to it. Nearly all of them also have a tail of devices that didn’t move, and plenty bought a year of Extended Security Updates to cover them.
That first year runs out in October. Year two costs more per device than year one, and year three costs more again, so now is a good moment to ask a slightly uncomfortable question: are those devices still on Windows 10 for a reason, or out of habit?
Who’s still on it
When we look at the stragglers in an estate, they tend to fall into a few groups.
Hardware that can’t run Windows 11. Older processors, or no TPM 2.0. Some of these really are stuck. Some aren’t (more on that below).
Machines tied to one application. Lab instruments, shop-floor terminals, a medical device workstation, a line-of-business app the vendor has never certified on Windows 11. These are often the most important devices in the building and the least looked at.
Shared and kiosk machines. Meeting room PCs, reception, the warehouse terminal. Nobody’s name is on them, so nobody chases them.
Devices nobody can find. Spare laptops in a cupboard, machines belonging to people on long leave, a contractor’s device that still has access. They’re still on Windows 10 mostly because nobody has touched them.
People who asked to wait. Often senior, always busy, and promised “after quarter end” three quarter-ends ago.
Check the “incompatible” ones again
A fair number of machines that fail the Windows 11 check aren’t really incompatible. They have a TPM that’s switched off in the firmware, or Secure Boot disabled. Turning those on is a settings change, not a hardware purchase. It’s worth a proper look before anything gets written off, both for the budget and because a working laptop in a recycling bin isn’t anyone’s idea of sustainable IT.
Decide per group, not per device
For each group, pick one of five answers and write down who decided:
- Upgrade it. Most of the “asked to wait” and “nobody touched it” groups belong here.
- Replace it. Genuinely old hardware. Refurbish or recycle it properly rather than letting it sit in a cupboard for another year.
- Isolate it. For the machines tied to one application: take them off email and general browsing, put them on their own network segment, and limit who can log in.
- Retire it. Some of what you find will turn out not to be needed at all.
- Renew the extended updates, deliberately. For devices with a real reason and a real exit date. Year two of ESU should be a short list with names next to it, not a default.
Make the next one easier
The devices that didn’t move are a good map of where your estate is weakest: the things nobody owns, the apps nobody tested, the hardware nobody tracked. Fix the ownership now and the next migration (there’s always a next one) gets shorter.
Where Nanoheal fits
If you run Nanoheal, the same agent that fixes issues also handles software distribution and patch install, with rollback, which helps when you’re moving a group at a time. Windows and macOS have the same feature set, which matters if some of your Windows 10 tail is moving to Mac instead. See the compliance and governance page for how deployments are staged.