Windows 10 ended support a year ago: what to do with PCs that cannot run Windows 11
- windows-10
- windows-11
- security
- cyber-essentials
Microsoft ended mainstream support for Windows 10 in October 2025, and the one-year consumer Extended Security Updates (ESU) grace period expires this week. If you still run Windows 10 at home or in a small business, you have three realistic choices: upgrade eligible hardware to Windows 11, enrol commercial machines in paid ESU, or replace hardware that fails the TPM 2.0 and CPU requirements.
Every week I inspect machines where the owner assumes Windows Update is still protecting them because the settings page says “You’re up to date.” As I wrote about a Linux server that reported itself fully patched while running three kernels behind, an operating system will happily give you a green tick when all it means is that no new patches are being offered to it.
Why an unpatched Windows 10 machine is a real problem, not a scare story
An unsupported Windows 10 PC does not stop switching on. Word still opens, your printer still works, and your browser still loads your bank. What stops arriving are the monthly kernel, driver, and networking fixes that close vulnerabilities attackers actively exploit.
That hits home users and small businesses in two different ways:
- For UK small businesses (Cyber Essentials and insurance): Under the NCSC requirements—and as I covered in how to pass Cyber Essentials first time—every computer in scope must run a supported operating system receiving regular security updates. One unpatched Windows 10 PC on your office network without active ESU is an automatic fail, and gives cyber insurers an easy reason to decline a claim.
- For home PCs and laptops: Microsoft Defender definitions continue to update for a while, which lulls people into thinking they are safe. Antivirus definitions do not patch an underlying operating system flaw when a rogue browser pop-up or malicious PDF tries to escalate privileges.
Why Windows 11 refuses to install on working hardware
Windows 11 enforces strict hardware gates: an 8th-generation Intel Core (or AMD Ryzen 2000) processor or newer, UEFI Secure Boot, and a **TPM 2.0** (Trusted Platform Module) security chip. Millions of fast, reliable PCs bought between 2016 and 2018 fail the processor check, while plenty of newer machines built after 2019 fail simply because TPM 2.0 (`fTPM` or `PTT`) is switched off in the BIOS.
Before you bin a computer because the Windows PC Health Check app showed a red cross, check which of the two groups it falls into:
- Capable hardware with a disabled BIOS setting: Roughly one in four machines I look at during a Windows Security Audit or Home Device Security check actually has a supported CPU, but Secure Boot or Intel PTT / AMD fTPM was left disabled at the factory. Turning it on in UEFI takes ten minutes and makes the Windows 11 upgrade official and free.
- Genuinely unsupported CPUs (Intel 6th/7th Gen or older): You will see guides online telling you to bypass the TPM and CPU check using registry flags or Rufus. On a spare test box, fine. On a business machine or your main home computer, Microsoft explicitly withholds annual feature updates and can drop cumulative security patches on bypassed hardware without warning. I do not deploy registry bypasses on client machines because a security fix that silently stops updating ten months later is worse than knowing you need a new PC.
Your four options, compared honestly
If you have one or several Windows 10 PCs sitting on your desk in October 2026, here is what each path actually costs and what it buys you:
| Option | Typical Cost | Best For | The Catch |
|---|---|---|---|
| 1. Enable TPM 2.0 & upgrade to Windows 11 | £0 licence (free upgrade) | 2018+ PCs failing only on BIOS settings | Requires UEFI/BIOS changes and checking BitLocker recovery keys first |
| 2. Commercial Extended Security Updates (ESU) | ~£50/year (Year 1), doubles each year | Business PCs running legacy software that cannot move yet | Expensive stopgap; consumer 1-year ESU ends October 2026 |
| 3. Refurbished business-grade Windows 11 PC | £220–£350 (e.g. Dell Latitude / Lenovo ThinkPad Gen 10+) | Home users & small offices replacing 2015–2017 machines | Needs clean setup and data migration so old bloatware does not follow you |
| 4. Do nothing (stay on unpatched Windows 10) | £0 today | Offline-only machines (e.g. an air-gapped CNC controller) | Fails Cyber Essentials instantly; growing exposure for banking and email |
How I handle Windows 10 machines for clients
Whether I am running a read-only Windows security audit for a London company or boarding a household laptop onto my £10-a-month Home Device Security Plan, the rule is the same: tell you the truth before you spend money on the wrong thing.
- Step 1 — Read the hardware properly: I check the exact CPU generation, TPM 2.0 status, Secure Boot state, and SSD health (SMART wear levels).
- Step 2 — Upgrade if the hardware supports it: If the machine is eligible for Windows 11 and the disk is healthy, I back up your BitLocker keys, enable the required security features, and bring it onto Windows 11 cleanly.
- Step 3 — Refuse to charge you for a dead end: If a laptop has a 2015 dual-core processor and a worn-out drive, I will not put it on a £10 monthly plan and pretend software maintenance makes it safe. I will tell you straight, point you at a sensible £250 refurbished business laptop if you want one, and help you move your files across.
Common questions
Can I just install third-party antivirus and keep using Windows 10?
No. Antivirus software scans files and processes, but it cannot patch vulnerabilities inside the Windows 10 kernel, TCP/IP network stack, or File Explorer. Nor will third-party antivirus satisfy a Cyber Essentials assessor if the operating system itself is out of support.
Will enabling TPM 2.0 or Secure Boot wipe my files?
No, changing TPM or Secure Boot settings does not erase your disk. However, if drive encryption is already active, changing boot settings without backing up your recovery key first can trigger a BitLocker recovery prompt on restart. Always verify your recovery key before touching BIOS settings.
How do I check if my office or home PCs are actually safe?
For a business, book a Windows Security Audit—I will inventory every machine, tell you which ones pass or fail Cyber Essentials, and give you a plain-English action list. For a home PC, look at the £10/month Home Device Security Plan or send me a message with your PC model and I will tell you where it stands.
