--- title: "End of Windows 10: decide per device, migrate without downtime" description: "Windows 10 lost security updates on 14 October 2025. Upgrade, replace or ESU: how to decide for each device and migrate. No-obligation proposal from DataRoad." language: en url: https://www.dataroad-it.com/en/windows-10-end-of-support-migration-plan/ source: https://www.dataroad-it.com/en/windows-10-end-of-support-migration-plan/ publisher: DataRoad IT (DataRoad - IT Services and Consulting), Portugal --- > Windows 10 lost security updates on 14 October 2025. Upgrade, replace or ESU: how to decide for each device and migrate. No-obligation proposal from DataRoad. # End of Windows 10: decide per device, migrate without downtime At a glance For decision-makers short on time. - 01 Since 14 October 2025, Windows 10 no longer receives security patches at no cost. - 02 Each device has three routes: upgrade to Windows 11, replace it, or use ESU as a temporary bridge. - 03 One unpatched device on the network exposes the rest and complicates proof of GDPR compliance. - 04 Under IT Unlimited, migration to Windows 11 is included and done outside working hours. ### In this article A single unpatched Windows 10 laptop connected to the company network can be the door through which an attack reaches the entire estate. Since 14 October 2025, Microsoft has stopped publishing security updates for that system at no cost. Nothing seems to have changed, the machines boot and Office opens, and that is exactly why so many organisations have not yet acted. The right way out is an **IT estate management** decision, taken device by device: move to Windows 11, replace, or buy time with extended updates. ## What is the risk to the business if it does nothing? An end-of-life Windows 10 does not switch itself off or flood the screen with warnings. It simply stops receiving patches, features and technical support from Microsoft, and every flaw discovered from then on stays open. Attackers know exactly where to look. - **Chain exposure**: one unpatched workstation is enough to open the way to other devices on the network. - **Weakened compliance**: processing personal data on unsupported systems makes it hard to demonstrate "appropriate technical measures" under GDPR. ## What options are there for each device? | Option | Suitable when | Watch out for | | --- | --- | --- | | Move to Windows 11 | The hardware is compatible: a recent processor (generally Intel 8th generation or AMD Ryzen 2000 and later), TPM 2.0 and secure boot; this covers many laptops bought since 2019 | Older business software, printers without current drivers, card readers and barcode scanners | | Replace the device | Incompatible computers or those more than six years old | Avoid concentrating the spend in a single month; renew in stages | | Extended Security Updates (ESU) | Devices that cannot be touched yet, such as the PC controlling an industrial machine or running critical software with no Windows 11 version | Three years maximum, paid per device per year, with a price that doubles annually | ### Windows 11: pilot before roll-out On a compatible device with a valid Windows 10 licence, the upgrade carries no licence cost. Problems appear at the edges: applications and peripherals. Upgrade two or three workstations for users with different profiles first, let them work for a week, and only then move on to the rest. ### Replacement: phased and with standard models The usual order starts with devices handling sensitive information, such as the board, finance and HR, followed by the rest. It is the right moment to standardise models, which cuts support costs in the years that follow. Before any purchase, take an inventory: the [IT estate audit checklist](https://www.dataroad-it.com/en/it-estate-audit-checklist-8-blocks/) includes the devices and operating systems section ready to fill in. ### ESU: a bridging solution Buying ESU for the whole estate just to postpone the decision ends up costing more than a phased renewal. ## How do you decide, device by device? - **Compatible, under 5 years old** Migrate, after validating the business software. - **Compatible, over 5 years old** Migrate now and include replacement in the next budget. - **Not compatible** Replace; if that is not possible yet, one year of ESU with a set replacement date. - **Connected to specialist equipment** Place it on its own network segment, without internet access, and negotiate with the machine's manufacturer. ## Which mistakes cost the most? - **Keeping Windows 10 without ESU on the network**: with email and shared folders accessible. - **Thinking antivirus solves it**: it stops malicious files, but does not fix operating system flaws. - **Upgrading every workstation on the same day**: one problem then hits the whole company at once. ## What about servers, when do they expire? Windows Server 2016 goes out of support in January 2027; 2012 has been unsupported since 2023. For physical servers running these versions, the options are to replace, virtualise or move to the cloud, as we explain in [servers and virtualisation](https://www.dataroad-it.com/en/managed-servers-virtualisation-portugal/). ## How does DataRoad carry out the migration? Under [IT Unlimited](https://www.dataroad-it.com/en/managed-it-services/) contracts, the move to Windows 11 is part of the service, with no separate quote: - **Assessment**: the full estate, device by device. - **Pilot test**: critical software validated on one workstation before rolling out. - **Schedule**: upgrades carried out outside working hours. - **Close support**: help for users in the first few days. - **Renewal plan**: devices to be replaced, with set dates. - **Confirmation**: monitoring ensures no device has been forgotten; 24/7 monitoring only on the Premium 365 plan. ## Questions from managers ### Will Windows 10 computers stop working? No. They keep booting and running programs, but without patches they become steadily more vulnerable to attacks exploiting known flaws. ### With strong antivirus, can I stay on Windows 10? No. Antivirus reduces the risk, but does not close the vulnerabilities in the system itself. ### Does moving to Windows 11 require paying for a licence? No, on compatible devices with a licensed Windows 10; the real cost lies in migration time, testing and replacing incompatible hardware. ### How long does migration take for a company with 30 workstations? One to two weeks once the pilot is validated, outside working hours and without stopping operations; replacements depend on equipment delivery times. ## Next step: find out today how many devices are exposed We identify which devices migrate, which are replaced and in what order, and carry out the move without stopping the business. Discover our [remote, on-site and phone support](https://www.dataroad-it.com/en/managed-it-helpdesk-portugal/) and request a no-commitment proposal. **More than 10 workstations · support contract · remote, on-site and phone support.** Call **+351 211 459 950 *** or write to sales@dataroad.pt. **Call to a Portuguese landline.* Chosen by respected and international companies ★★★★★ 5,0 · 52 Google reviews ★★★★★ 5,0 · 52 Google reviews DataRoad ## Related articles [Managed IT and cybersecurityTeams on the move: securing laptops, phones and public Wi-FiThe real travel risk is an unencrypted lost laptop, not hotel Wi-Fi. With disk encryption, central management, MFA and a controlled connecti…12 October 2026 · 7 min read](https://www.dataroad-it.com/en/managed-cybersecurity-travelling-teams/)[Managed IT and cybersecurityExternal attack surface: what the internet sees of your companyAutomated attacks hunt for vulnerable versions, and company size is irrelevant. In 2025, CERT.PT recorded 3,864 incidents, 40% more than in …12 October 2026 · 5 min read](https://www.dataroad-it.com/en/external-attack-surface-managed-cybersecurity/)[Managed IT and cybersecurityNOC and managed cybersecurity: who watches your SME, and whenThe question is not whether you have a SOC: it is who receives the alert at 10 pm on a Saturday and what they do next. At DataRoad, nights, …12 October 2026 · 6 min read](https://www.dataroad-it.com/en/noc-managed-cybersecurity-sme/)[Managed IT and cybersecurityMicrosoft 365 security: the 10 controls that are yoursIn Microsoft 365, the platform is Microsoft's and the keys are yours. According to Microsoft, MFA and blocking legacy authentication stop mo…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/microsoft-365-managed-cybersecurity-shared-responsibility/)[Managed IT and cybersecurityGDPR and managed cybersecurity: 10 technical controls to proveWithout documented technical measures, a data breach turns from an IT incident into a problem with the regulator. Ten controls in three bloc…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/gdpr-managed-cybersecurity-10-technical-measures/)[Managed IT and cybersecurityExposed passwords: audit your domain and close the door in 5 daysThe risk is not the email appearing in a breach: it is the same password opening a work account. Change what is exposed, MFA on every accoun…12 October 2026 · 5 min read](https://www.dataroad-it.com/en/company-credentials-data-breach-check/)[Managed IT and cybersecurityAsset inventory: the basis of IT estate management and NIS2Without an asset inventory there is no planned renewal, no demonstrable security and no answer to CNCS. NIS2 entities must submit the list o…12 October 2026 · 7 min read](https://www.dataroad-it.com/en/it-asset-inventory-management-nis2/)[Managed IT and cybersecurityBreak-glass accounts in Microsoft 365: your company's insuranceA locked-out admin can leave email, Teams and files unmanaged for days. Break-glass accounts are the reserve administrator you only use when…12 October 2026 · 5 min read](https://www.dataroad-it.com/en/microsoft-365-break-glass-accounts/)[Managed IT and cybersecurityWindows 365 for business: when a cloud PC cuts costsA cloud PC pays off for consultants, seasonal staff, teams without an office and mixed Mac and Windows estates. For video, CAD or weak inter…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/windows-365-business-cloud-pc-costs/) Numbers you can verify **11** years in business **232** clients **< 10 min** average response time **15+** IT vendor certifications **10+** Countries with clients supported **5.0 ★** 52 Google reviews Transparency ## What many providers hide, we publish. [See plans and prices →](https://www.dataroad-it.com/it-unlimited/) - **Prices upfront** Essential from €395/month + VAT, Premium from €750 and Premium 365 from €1,200. - **No lock-in** Annual contract, no lock-in and no joining fees. - **Everything in writing** What is included, the scope and the price, before you sign. - **Support without counted hours** Remote and phone in every plan; on-site support from Premium. Partners and certifications DataRoad · Cloud and Microsoft 365 ## One StepAhead of IT. The right licences, MFA on every account and backups that actually restore. The cloud stops being an invoice and becomes a tool. - **0** DataRoad security incidents in 11 years - **M365** backed up off-site - **5 ★** on Google · 52 reviews We do **IT** right. DataRoad IT Unlimited ## Operational continuity is not luck. It is method and contract. IT Unlimited reduces risk and shows in writing what changed. [Request a proposal, no commitment →](https://www.dataroad-it.com/en/#contact)+351 211 459 950 **Call to a Portuguese landline · More than 10 workstations · support contract · remote, on-site and phone support[Not sure what you need? Talk to the assistant →](https://www.dataroad-it.com/en/#assistente) --- Versão HTML desta página: https://www.dataroad-it.com/en/windows-10-end-of-support-migration-plan/