Windows 10 EOL, six months later: the fleets nobody updated

Lifecycle · April 10, 2026 · 7 min read

October 14, 2025 came and went. Microsoft stopped shipping free security updates for Windows 10. Half a year on, the ITAM fallout is louder than the launch itself.

If you work in IT, you already know the date. October 14, 2025 was when Microsoft officially retired free support for Windows 10. No more free security patches. No more bug fixes. Unless you paid into the Extended Security Updates program, your Windows 10 machines started the next morning as supported hardware running unsupported software — which is a surprisingly popular category, given how loudly the deadline was telegraphed.

Six months in, the picture on the ground is messier than the press releases suggested. Here's what we're hearing from the lean IT teams we talk to every week.

The "unknown" column is still the biggest one

Ask a 40-person company how many of their laptops are on Windows 11, and you'll usually get three numbers in quick succession: the MDM number, the spreadsheet number, and the number the IT lead thinks it probably is. None of them agree.

This isn't a failure of effort. It's a failure of inventory. Patch management tools see the endpoints they're installed on. RMMs see the endpoints they can reach. HR sees the people. The CSV from procurement sees the serial numbers from 2022. Nothing in the stack answers "which physical devices exist, and what's running on them, right now." That's the ITAM job, and for a lot of small and mid-sized teams, nobody is doing it.

The pattern, in our experience, is consistent: the devices that fall out of a Win11 migration aren't the loud ones — they're the ones assigned to a contractor who left in 2024, the loaner sitting in a drawer at the Austin office, the "spare" that's been with the VP of Sales for eighteen months without showing up in anyone's inventory. You migrate the machines you can see. The ones you can't are the problem.

The TPM 2.0 cliff is real, and it's a procurement story now

The hard part of the Windows 11 transition was never the operating system. It was Microsoft's hardware bar: TPM 2.0, a supported CPU generation, and Secure Boot. Anything older than roughly 2018 Intel silicon was, for most practical purposes, a brick as far as in-place upgrades go.

What this created was a quiet, forced hardware refresh cycle. Teams that would have happily milked another year out of a fleet of 2019 ThinkPads suddenly had a budget conversation they hadn't planned for. And because budgets are annual, that conversation is still happening. We've seen a noticeable uptick in "which of my devices are not Win11-capable, and what do they cost to replace?" as a Q2 question, not a Q4 one.

If you can't answer that question in under five minutes for your own fleet, that's the ITAM gap. It's not a patching gap and it's not a procurement gap — it's the layer underneath both of them.

What the ITAM category is quietly doing about it

The interesting thing about the last six months is watching how different ITAM tools responded. We're in this market; we pay attention. Here's the honest field read, tool by tool.

The honest summary: every tool in this space can technically track Windows version. The question is whether it surfaces what's missing without you having to go looking. That's the bar we think the category needs to clear, and it's the one most tools still don't.

Three things worth reading this week

A few pieces that crossed our desk and are worth your time if you're thinking about any of this:

• Microsoft Learn — "Windows 10 Extended Security Updates (ESU) program." If you haven't decided whether to enroll yet, this is the canonical source. The pricing structure is a meaningful ITAM budget line, and the enrollment flow is worth understanding before you commit.
• Krebs on Security — ongoing coverage of post-EOL CVEs affecting Windows 10. Brian Krebs has been consistently good on the "what does unsupported actually mean in practice" question. A useful counterweight to the "nothing will happen immediately" takes.
• Snipe-IT GitHub — discussion: custom fields for OS tracking. If you're on Snipe-IT and trying to bolt a Win11 report together, the community thread has some clever workarounds — and a few cautionary tales about custom field sprawl.

What to actually do this week

If you've read this far and you're thinking "okay, but what's the action item," here it is. Block thirty minutes. Do these four things:

• Count your endpoints. Not the ones you can see in your MDM — the ones that should exist according to payroll, procurement, and your asset list. Compare the numbers. The gap is the problem.
• Flag every device without a confirmed OS field. "Probably Windows 11" is not a confirmed OS. Anything older than a 30-day check-in goes in the unknown column.
• Find the warranty expirations hiding in Q2 and Q3. A Win11-incapable device with an expired warranty isn't a refresh candidate — it's a risk. Price the replacement now, not after it dies.
• Put one person's name on it. "The team" doesn't own ITAM. Someone does. Six months past the biggest OS deadline of the decade is a fine time to write their name down.

None of this is glamorous. None of it will show up in a product release note. But it's the unsexy work that decides whether your fleet is auditable in October 2026, when the next round of deadlines — the Windows 11 23H2 servicing end, the Office 2016/2019 sunset, the Exchange Server 2016/2019 retirement — all stack up in a single quarter.

The teams that handle those well won't be the ones with the biggest tools. They'll be the ones who knew what they had.

The Compass goes out every Friday. If this was useful and you want next week's in your inbox, the easiest way to subscribe right now is to start a free trial — we'll add you automatically. No pitch deck, no sales call.