Still Running Windows 10 in 2026? A Post-EOL Remediation Plan for Unsupported PCs

Windows 10 support ended on October 14, 2025. If a few PCs in your office are still running it, you're past the point of planning a migration. The job now is to limit the risk those machines carry while you move them out.

A decent plan finds every remaining device, records why it's still there, puts temporary safeguards around it, and gives it a retirement date somebody has agreed to.

Build a Verified Exception List

Pull from device management, endpoint security, your directory, and network records, because no single one has everything. For each Windows 10 computer, record:

• Device name, user, department, and location
• Hardware model and support status
• The business application or peripheral that depends on it
• How sensitive the data on it is, and what it can reach on the network
• Current security and management coverage
• A business owner and a technical owner
• The planned fix and a target date

Chase down any device that shows up in one inventory and not another. A computer nobody is tracking is harder to protect, and it's the one that gets forgotten.

Decide Whether ESU Makes Sense

Extended Security Updates can bridge a gap for eligible systems. They shouldn't become your retirement plan, and they cost money that's often better spent on the replacement.

For each device you're considering, confirm:

• Microsoft's current eligibility, licensing, and enrolment requirements (these have changed over time, so check the current terms)
• That the device really is receiving and reporting updates
• The business reason you need more time
• Which other controls stay in place during the exception
• The final replace, upgrade, or decommission date

Put a name on whoever accepts the leftover risk. Security updates won't fix aging hardware, an unsupported application, or a weak configuration, and they won't fix an exception process with no end.

Isolate What Can't Move Yet

A Windows 10 PC tied to a legacy application, a machine controller, or an odd peripheral shouldn't keep broad access to the rest of the network just because it always has.

Options include:

• A separate network segment with limited routes
• Access to only the servers and destinations it needs
• No internet access at all, if the workflow doesn't call for it
• Limits on email, web browsing, and removable media
• No standing local admin rights
• Strong identity controls on any remote or privileged access
• Central endpoint monitoring, where the tooling still supports it

Test the isolation before you rely on it. The workflow has to keep running, and the PC shouldn't be able to reach systems it has no business touching.

Resolve the Application Blocker

"The software only runs on Windows 10" is a claim to verify. Give it an owner and some evidence:

1. Which version of the application and its database are you running now?
2. Does the vendor support a Windows 11 release?
3. What upgrades, integrations, drivers, or licences would that take?
4. Is the real blocker the application, a peripheral, or an undocumented workflow?
5. Can the data be exported or migrated?
6. Can you pilot the change and roll it back?

If the vendor has no supported path, someone in leadership has to decide between replacing the software, redesigning the process, or formally accepting a tightly limited legacy setup.

Phase the Retirement

Sort the remaining devices by what needs to happen to them:

• Upgrade: the hardware is supported and the applications pass testing.
• Replace: the hardware or its reliability no longer meets the business need.
• Replatform: the application or workflow has to move first.
• Isolate temporarily: a documented blocker needs a short exception.
• Decommission: the system is unused, duplicated, or no longer justified.

Order the work by exposure and dependency, not by what's easiest. Devices with a lot of access, or with sensitive or operationally important data, go first.

Keep a Risk-Acceptance Record

Every exception should say what the business needs, what risk is being accepted, which compensating controls apply, who owns it and who approved it, how often it's reviewed, when it expires, and what the migration plan is. An exception with no expiry date tends to outlive the reason it was granted.

Close the Loop

Review the remaining Windows 10 list on a regular schedule. When a device is retired, remove it from your identity, endpoint, monitoring, backup, and asset systems. Keep the business data you're required to keep, dispose of the hardware securely, and update your documentation after each phase.

Related Reading

This picks up where our earlier Windows 10 end-of-life guide left off, with a focus on managing the exceptions that are still around.