Our office computers still run Windows 10. What now?

What should a small business do with computers still on Windows 10?

Get them off it, one batch at a time, starting with the computers that touch money, client records and email. I am Anthony Omini, the owner of Cross River Tech in Dallas, and this is one of the most common things I find when I first look at a small office: a mix of Windows 11 machines and a few Windows 10 computers that "still work fine". They do still work. What they no longer get is free security updates from Microsoft, and that is the part that matters.

The plan I follow for every office is the same and fits in a short list:

1. Inventory. Every computer, its age, its Windows version and whether it passes the Windows 11 hardware check.
2. Sort into three groups. Upgrade for free, replace, or bridge for a short time while a replacement is ordered.
3. Schedule. Upgrades and swaps in batches, after hours or on a quiet day, so nobody loses a working day.
4. Check each machine afterwards. Files, printers, line-of-business software and sign-ins tested before the person sits down.

If you already have managed IT with me, this is part of keeping your computers current. If you do not, I can do it as a one-time project and leave you with a written list of every machine.

Is it really unsafe to keep using Windows 10?

It gets less safe every month. When Microsoft ends support for a version of Windows, the computer keeps starting up and your programs keep opening, but security fixes stop. Attackers know this. Every new weakness found in Windows after that point stays open on unsupported PCs, and those computers become the easiest way into an office network.

The risk is not only to the one computer. A Windows 10 PC on the same network as your file share, your accounting system or your practice software can be the first step in an attack that reaches all of them. That is how many ransomware incidents in small offices start: one old machine, one click, then everything it can see.

Antivirus helps, but it does not replace security updates. Endpoint protection catches known bad software; it cannot fix a hole in the operating system itself. Software vendors also stop testing on unsupported Windows, so the next update of your accounting, legal or dental software may simply refuse to install.

The cybersecurity and backup page covers the rest of the protection an office needs; an unsupported operating system is the gap that undermines all of it.

Which computers can upgrade to Windows 11 for free?

Computers that meet Microsoft's Windows 11 hardware requirements can upgrade from Windows 10 at no license cost; Windows 10 Pro moves to Windows 11 Pro. The checks that most often decide it:

Microsoft's free PC Health Check app tells you on each machine whether it passes. When I do the inventory, I check every computer remotely or onsite and also look at what the check does not tell you: whether the disk is close to failing, whether the battery on a laptop is worn out, and whether the machine is worth spending an hour on at all.

A computer that passes but is slow, out of warranty and five years into a hard life is often better replaced than upgraded. That is a judgment call I make with you, machine by machine.

What should we do with computers that cannot run Windows 11?

Replace them. There are workarounds online that force Windows 11 onto unsupported hardware, and I do not use them in a business: Microsoft does not support those installs, and updates can fail on them later, which puts you back where you started.

For replacements I work with Dell and Lenovo business lines, because they come with business warranties and consistent parts, and because a fleet of similar machines is easier to support than a mix of retail laptops. The things I set up on a replacement before it reaches the desk:

• Windows 11 Pro, updated, with your standard programs installed
• Full-disk encryption and endpoint protection
• The person's files, browser bookmarks, printers and email moved from the old computer
• Sign-in through your Microsoft 365 or Google Workspace account, with multi-factor sign-in
• The old drive wiped or destroyed, with a note of which machine it came from

Choosing models is covered in Dell and Lenovo business computers, and retiring old equipment properly in office IT decommissioning.

What are Extended Security Updates, and are they worth paying for?

Extended Security Updates, or ESU, is Microsoft's paid program that keeps critical security patches coming to Windows 10 after the end of support. Businesses buy it per device, for a limited number of years, and the price goes up each year. It does not bring new features or Microsoft technical support; it only keeps the most serious holes patched.

ESU makes sense in a few situations:

• A machine that runs one piece of equipment or software whose vendor does not support Windows 11 yet, such as an older imaging, lab or plotter workstation.
• Replacements ordered but not delivered, so a handful of PCs need cover for a few weeks or months.
• Budget timing, when replacing everything in one quarter is not realistic and the oldest machines go first.

It does not make sense as a way to avoid the decision. Because the per-device price rises every year, paying for ESU on a computer you will replace anyway usually costs more than replacing it now. I treat it as a bridge with an end date written down, and I put the remaining machines on the replacement plan at the same time.

Will Windows 10 hurt our cyber insurance or compliance?

It can. Cyber insurance applications and renewal questionnaires ask whether the business runs unsupported software and whether security patches are applied on a schedule. Answering "no" honestly can raise the premium or limit cover; answering "yes" when it is not true can be a problem at claim time. If a renewal is coming up, it is worth fixing this first. Failed a cyber insurance questionnaire? covers the other controls insurers usually ask about.

The same applies to regulated offices:

• Dental and medical practices have to identify risks to patient information in their HIPAA risk analysis, and an operating system without security updates is an obvious one. See IT for dental practices.
• Law firms owe clients reasonable care with their confidential information, and corporate clients increasingly send security questionnaires that ask about patching. See IT for law firms.
• Insurance agencies handle personal and financial data and get the same questions from carriers.

I document what was upgraded, replaced or bridged and when, so you have an answer ready when the questionnaire arrives.

How do we upgrade without losing a working day?

By doing it in batches and outside the hours people need their computers. A typical small office plan looks like this:

1. Back up first. Every computer's files are confirmed in OneDrive, Google Drive, the file server or the backup before anything changes.
2. Test one machine. One upgrade or replacement goes first, with your line-of-business software, printers and scanners checked on it.
3. Batch the rest. Upgrades run in the evening or over a weekend; replacements are swapped before people arrive.
4. Walk the office in the morning. Each person signs in, opens their usual programs and prints once, and anything odd is fixed on the spot.

Upgrades that run remotely overnight cost you no downtime at all. Replacements need a short onsite visit, which I schedule by appointment. For an office of ten to twenty-five people this is usually a matter of a couple of evenings, not a project that drags on for weeks. If you are planning other changes, such as a move or new Wi-Fi, it is often worth doing them together; the annual office technology checkup is a good place to start.

What does it cost, and how do I get it done?

The upgrade itself has no Microsoft license cost on computers that qualify. What you pay for is the time to check, upgrade and test each machine, and new computers for the ones that do not qualify. If you are on a managed IT agreement with me, keeping Windows current is part of what the monthly fee covers, and new hardware is quoted separately. Without an agreement, the work is billed at my hourly rates: $100 per hour remote and $150 per hour onsite during business hours, $150 remote and $225 onsite after hours, with a one-hour minimum. Replacement computers are quoted per model once we know how many you need.

To start, send me the number of computers in the office, roughly how old they are, and the main programs people use. I will tell you which ones can be upgraded, which need replacing and which, if any, are worth a short ESU bridge. You can contact me or call (214) 612-7080; more on hourly help is on the IT break/fix support page.

Questions people ask

Written and reviewed by

Anthony Omini, founder of Cross River Tech

Over 15 years in IT across many industries, now running Cross River Tech, a small owner-led managed IT company in Dallas. Every article is written from his own client work and checked by him before it is published.

Still have Windows 10 in the office? Tell me how many computers you have and roughly how old they are. I will tell you which can upgrade for free and which need replacing.

Ask Anthony(214) 612-7080About Anthony