Windows 10 in 2027: ESU, Windows 11 or Linux?

Windows 10 is like a favourite jacket with a hole in the pocket. It still fits, but sooner or later something falls out. Microsoft has stitched on one more year of patches, and that thread runs out on 12 October 2027.

The short answer

What should you do with a Windows 10 PC in 2027? Microsoft ended support for Windows 10 on 14 October 2025. Its Extended Security Updates (ESU) programme for home users delivers critical and important security updates until 12 October 2027, and you can enrol at any time before that date [1][2]. Use the time to check with Microsoft's PC Health Check app whether the PC meets the Windows 11 requirements: TPM 2.0, UEFI firmware that is Secure Boot capable, and a supported processor [4][5][8]. If it does, the upgrade is free through Windows Update [3]. If it does not, there are two clean paths: test a Linux distribution from a USB stick, or plan a new device. Whatever you choose, back up first. All dates, prices and conditions in this guide are as of 25 Oct 2026.

What ESU covers and what it does not

• ESU is for Windows 10, version 22H2, in the editions Home, Pro, Pro Education and Workstations. It delivers only security updates that the Microsoft Security Response Center rates critical or important. There are no new features, no other fixes and no technical support [1].
• You need the latest Windows updates, the licensing preparation package KB5126256, an administrator account and a Microsoft account that is not a child account. The licence is tied to the Microsoft account you enrol with and covers up to 10 devices. Once one user on a PC has enrolled, all other users on that PC are covered too [1][2].
• Consumer ESU is not for business use. Microsoft does not offer it for devices in kiosk mode, for devices joined to an Active Directory domain or to Microsoft Entra, or for devices managed by a mobile device management (MDM) system. Devices that are only registered with Microsoft Entra may take part [1].
• If you are already enrolled, coverage continues to 12 October 2027 without any action [1]. The original end date was in October 2026. According to heise, Microsoft changed its support articles to the new date in late June 2026 with little announcement [26]. Stiftung Warentest reported the extension on 2 July 2026 [25].
• A detail that is easy to miss: Microsoft is replacing Secure Boot certificates from 2011 that have been expiring since June 2026. Secure Boot is the firmware check that only lets signed software start the PC. For Windows 10, Microsoft points to ESU as the way to keep receiving security updates, including those for Secure Boot [11].

What ESU costs: the EEA has its own rules

Microsoft shows a different version of its ESU page depending on where you open it, and it says that options and timing can vary by region, for example in the European Economic Area (EEA) [1].

Microsoft names no euro amount on its page. Stiftung Warentest, a German consumer organisation, puts the local-account route at "around 30 euros" [25]. Refunds for the purchase follow Microsoft's policy for digital purchases in your country [1]. We make no legal assessment of these conditions.

How to enrol

1. Open Settings > Update & Security > Windows Update. If the device meets the prerequisites, you see a link to enrol in ESU [1][2].
2. Select Enroll now. If you sign in to Windows with a local account, Windows asks you to sign in with a Microsoft account [1][2].
3. In the EEA, choose between staying signed in (no extra cost) and the one-time purchase. Outside the EEA, choose between syncing settings, Rewards points and the purchase [1][2].
4. Check the status in the same place. A purchase also appears in your order history [1].
5. On further PCs, select Enroll now, or Add device if you are signed in with the same Microsoft account [1].

Can this PC run Windows 11? Four checks

Microsoft's minimum is a compatible 64-bit processor with at least two cores at 1 GHz, 4 GB of RAM, 64 GB of storage, UEFI firmware that is Secure Boot capable, TPM 2.0, a DirectX 12 graphics card with a WDDM 2.0 driver and a 720p display larger than 9 inches [4][5]. TPM stands for Trusted Platform Module, a security chip or firmware function that creates and protects keys. For a direct upgrade the PC needs Windows 10, version 2004 or later, with the security update of 14 September 2021 or later [4]. Windows 11 Home and Windows 11 Pro for personal use need internet access and a Microsoft account during first set-up [5].

1. Run PC Health Check. Search for "PC Health Check" in the taskbar, or install it from Microsoft's address aka.ms/GetPCHealthCheckApp, then select Check now [8]. The app explains which requirement fails. Microsoft notes that it does not check the graphics card or the display [5]. Windows Update may also show the upgrade offer directly [14].
2. Read the TPM. Open Windows Security > Device security, or press Windows + R and run tpm.msc. Under Specification Version you need 2.0 [9]. If no TPM appears, it may be switched off in the firmware. Microsoft lists typical names for that switch: Security Device, TPM State, AMD fTPM switch, AMD PSP fTPM, Intel PTT or Intel Platform Trust Technology. Most retail mainboards for self-built PCs ship with TPM turned off, Microsoft says [9].
3. Read Secure Boot. Press Windows + R, run msinfo32 and look for Secure Boot State [11]. For the upgrade, the PC has to be Secure Boot capable with UEFI enabled. Turning Secure Boot on is recommended, not required [10]. If the firmware runs in Legacy or CSM mode, the boot mode has to change to UEFI, and Microsoft points to the PC maker's documentation for that step [10].
4. Check the processor. Microsoft publishes processor lists for PC makers. The Intel list names Core processors from the 8th to the 14th generation and newer series; the AMD list includes Ryzen 2000 models such as the Ryzen 5 2600 [6][7]. Later generations that meet the same principles count as supported even when they are not listed [6][7]. If PC Health Check reports the processor as unsupported, no firmware setting changes that.

Before you touch TPM or firmware settings: if the drive is encrypted with BitLocker, have the recovery key ready. Microsoft lists turning off, disabling or clearing the TPM, firmware updates and changes to the boot manager among the events that start BitLocker recovery [12].

Official paths and unofficial workarounds

Online you will find tools and registry tweaks that install Windows 11 on hardware that does not meet the requirements. We describe none of them. Microsoft's position: installing Windows 11 on such hardware is not recommended, the device gets no support from Microsoft and is not guaranteed updates, including security updates, and damage caused by incompatibility is not covered by the manufacturer warranty. Windows also adds a watermark to the desktop [13]. If problems appear, Microsoft recommends going back to Windows 10. The Go back button in Settings > System > Recovery exists only for 10 days after the upgrade [13]. Our assessment: anyone who leaves Windows 10 for an unsupported Windows 11 risks the very thing they wanted to escape, a PC without reliable security updates.

Linux: test it from USB before you decide

A live session starts Linux from a USB stick without changing the internal drive. Linux Mint's installation guide describes the limits: the live session is slower than an installed system, changes are not saved, and some applications behave differently or not at all [20]. That makes it a test drive for hardware and everyday programs, not a verdict on speed. Ubuntu describes the same three steps for trying or installing: download the ISO image, write it to a USB stick with an image writer, start the PC from that stick [22].

Our assessment: for a PC that fails the Windows 11 check, Mint's lower stated requirements and its support until 2029 make it the obvious first test. For a comfortable experience, Ubuntu asks for more memory than the Windows 11 minimum. Fedora suits people who are happy to upgrade about once a year. Test what matters to you in the live session: Wi-Fi, sound, printer, webcam and the programs you use daily.

If you play online games, check them before you switch. Valve's documentation says Proton, the layer that runs Windows games in Steam on Linux, supports Easy Anti-Cheat and BattlEye, but each game's developer has to enable that support. Kernel-level anti-cheat is not currently supported [24]. Our guide on gaming on Linux covers how to check your own library.

If you buy a new PC: criteria, not models

We name no models and have not tested any device. Microsoft's requirements give you the criteria: TPM 2.0 and UEFI with Secure Boot in the data sheet, and a processor from Microsoft's lists or a newer generation [4][6][7]. Treat 4 GB of RAM and 64 GB of storage as the floor they are, not as a target [4]. The "Copilot+ PC" label only matters if you want those particular features; it requires a processor with an NPU rated at more than 40 TOPS, 16 GB of RAM and a 256 GB SSD [5]. To move files and settings, Windows Backup saves them from Windows 10 to your Microsoft account. Restoring works on Windows 11, version 22H2 or later, if you sign in with the same Microsoft account during set-up. 5 GB of storage is included; more requires a subscription [16].

Back up before any switch

• Copy your user folders to an external drive. Windows Backup can also sync Desktop, Documents, Pictures, Videos and Music to OneDrive, but a free Microsoft account includes only 5 GB [15]. A local copy plus a second copy elsewhere follows the 3-2-1 rule.
• Save your BitLocker recovery key before changing firmware or partitions [12].
• Note the licence keys of paid programs, and export the passwords saved in your browser or move them into a password manager [27].
• After a Windows 11 upgrade with problems, you have 10 days to go back [13].

A worked example with two invented PCs

Both PCs and all results are invented. They show the method, not a test.

• PC A: desktop with a Ryzen 5 3600, Windows 10 22H2, Microsoft account. PC Health Check reports that TPM 2.0 is missing; Windows Security shows no security processor. The Ryzen 5 3600 is on Microsoft's AMD list [7]. The drive is BitLocker-encrypted, so the owner saves the recovery key first, enables "AMD fTPM switch" in the UEFI, checks tpm.msc (Specification Version 2.0), runs PC Health Check again and takes the free upgrade through Windows Update.
• PC B: laptop with a 7th-generation Intel Core i5 laptop processor (not on Microsoft's Intel list [6]), 8 GB of RAM, Windows 10 22H2, local account, used in Germany. PC Health Check reports the processor as unsupported. The owner enrols in ESU and chooses between signing in with a Microsoft account (no extra cost, sign in at least every 60 days) and the one-time purchase that keeps the local account [2]. During the ESU year they start Linux Mint from USB and test Wi-Fi, sound and their printer, and decide later whether to install Mint or replace the laptop.

Checklist

• Run winver and confirm that the PC runs Windows 10, version 22H2 [1][27].
• Check under Settings > Update & Security > Windows Update whether the PC is enrolled in ESU, and enrol if it is not.
• In the EEA, decide between staying signed in with a Microsoft account and the one-time purchase, and note the 60-day rule.
• Run PC Health Check and write down which requirement fails.
• Read the TPM version in tpm.msc and Secure Boot State in msinfo32.
• Save the BitLocker recovery key before you change any firmware setting.
• Compare your processor with Microsoft's list instead of guessing.
• Leave unofficial installers alone if the processor is unsupported.
• Test Linux from a USB stick before you erase anything.
• Check your online games for anti-cheat support before you switch.
• Back up your files to an external drive and test a restore.
• Put 12 October 2027 in your calendar, together with a reminder a few months earlier.

Related pages: Linux: kernel and distribution; 3-2-1 backup and restore testing; Laptop upgrade: check RAM and SSD first; SSD health: read SMART on Windows and Linux; Gaming on Linux: Proton and anti-cheat; TPM 2.0; Secure Boot.