If you’re still running Windows 10, you’re not alone. Many schools, trusts, and small businesses are in the same position. Some devices simply can’t move to Windows 11 yet. Whether it’s older CPUs, missing TPM 2.0 chips, or the lack of Secure Boot, the hardware requirements for Windows 11 have made upgrading more challenging than expected.
And that’s okay. Budgets are tight, refresh cycles take time to plan, and replacing hundreds (or even thousands) of devices at once is impractical. Microsoft recognises this too, which is why the Extended Security Updates (ESU) programme exists. It’s a short-term bridge designed to keep your devices protected while you plan your next steps.
What the ESU Programme Actually Offers
The ESU programme keeps Windows 10 devices secure after official support ends on 14th October 2025. It provides critical and important security updates, nothing more, nothing less. You won’t get new features or performance improvements, but your systems will stay protected while you finalise your migration plans.
Here’s what you need to know:
- ESUs are available for three additional years (2025-2028).
- Devices must already be running Windows 10 version 22H2.
- No new features or performance updates are included, just security fixes.
- Updates are delivered through the same tools you already use, such as Microsoft Intune, Windows Update for Business, or WSUS.
- The programme is a temporary safety net, not a long-term fix.
What Else You Can Do
While ESUs provide an important safety net, they work best as part of a wider plan to gradually modernise your IT estate. Rather than rushing into large scale replacements, many schools and businesses are taking a phased approach. Starting with the oldest or highest risk devices first and building out from there. Others are exploring cloud-based solutions, such as Windows 365 or Azure Virtual Desktop, which include ESU protection at no extra cost and can reduce the strain on local hardware.
You might also consider moving key workloads to the cloud to lessen your reliance on on-site equipment, particularly for storage and collaboration tools. Alongside this, strengthening your security posture remains vital. Combining ESU with layered protection, such as managed security services, reliable backup solutions, and remote monitoring, helps reduce risk and gives peace of mind while you complete your transition to newer systems.
How Novus Can Help
At Novus, we understand the pressures that schools, SMBs, and public-sector organisations face, including limited budgets, competing priorities, and the need to keep systems secure without disrupting learning or business operations. Our goal is to help you manage the shift safely, sensibly, and cost-effectively.
We start by auditing your current devices to identify which ones can move to Windows 11 and which are better suited to the ESU programme. From there, we can guide you through the most affordable licensing options and help configure management tools such as Intune or Datto RMM to deliver updates securely and automatically. We’ll also support you in building a phased migration plan and provide ongoing monitoring to ensure every device stays protected throughout the process.
In short, we’ll help you find the balance between keeping your organisation secure today and preparing for tomorrow.
