Home › Blog › Extended Security Updates
Security · 23 September 2026 · 11 min read
Microsoft stops patching an operating system on a published date. Most estates still have something running on it. ESU is the paid year of patches that keeps that something defensible while you move it, and it is sold per device or per core, once a year, with a deadline for each product. Three of those deadlines fall in the next four months.
Key dates, September 2026
| Product | Security updates ended | ESU available | List price, our September list |
|---|---|---|---|
| Windows 10version 22H2 | 14 October 2025 | Three years, to October 2028 | €65 / €130 / €261per device per year |
| Windows Server 2012 and 2012 R2 | 10 October 2023 | Ends 13 October 2026no fourth year | final yearsold out of time |
| Windows Server 2016 | 12 January 2027 | From January 2027up to three years | —list price published closer to the date |
| SQL Server 2014 | 9 July 2024 | Final yearto 14 July 2027 | €4,223per two-core pack per year, Standard |
| SQL Server 2016 | 14 July 2026 | Three yearsto July 2029 | €4,223 / €16,189per two-core pack per year, Standard / Enterprise |
ESU delivers Critical and Important security updates only, per year, cumulatively. Prices are Microsoft’s list for Europe and differ by region.
Every Microsoft product has two dates. Mainstream support ends and features stop; extended support ends and security patches stop. The second date is the one that matters, because after it a newly found vulnerability in that product is public, exploitable and never fixed. Extended Security Updates are Microsoft’s answer for the estates that cannot be off the product by then: a paid programme that keeps delivering the Critical and Important security fixes for up to three more years, and nothing else.
This article is the practical version: what ESU is and is not, how it is bought and switched on through us, why an insurer or an auditor will ask about it, and three worked cases with our own list prices — Windows Server, SQL Server and Windows 10 — because all three have a deadline between October 2026 and January 2027.
ESU delivers security updates that Microsoft rates Critical or Important, on the normal Patch Tuesday cadence, for a product that has passed its end of support. That is the whole of it. There are no new features, no non-security fixes, no design changes, and no technical support beyond the ESU updates themselves. If a driver breaks or a service misbehaves, ESU does not fix it. What it buys is a defensible position: the system is patched against the vulnerabilities that ransomware and commodity malware actually use, for another year, while the replacement is built.
ESU is sold per year, and the years are cumulative. Joining in year two means paying for year one as well, because the year-two updates assume the year-one ones are installed. The price rises each year — on Windows 10 it doubles — which is Microsoft’s way of saying that the programme is a bridge, not a destination. The third year is the last; there is no year four for anyone.
Because the attacks are real. The exploits that hit unpatched Windows Server 2012 and SQL Server 2014 estates in the last three years did not need a nation state. They needed a public proof-of-concept and a server nobody had touched. A system that stopped receiving patches is, within months, the easiest way into the network.
Because someone will ask. Cyber-insurance questionnaires now ask directly whether any system runs an operating system past its end of support, and what the plan is. ISO 27001, PCI DSS and the EU’s NIS2 directive all expect timely patching of known vulnerabilities; an unsupported system is a finding, and a supported one under ESU is a documented exception with an expiry date. Auditors accept the second and not the first.
Because the application is not ready. The honest reason most ESU is bought: a line-of-business application that the vendor has not certified on a newer version, a database the ERP was built against, a device in a workshop that runs a control panel. ESU is the time to fix that properly instead of at three in the morning after an incident.
Through us, ESU is a line on the price list like any other licence: Windows 10 per device, Windows Server and SQL Server per two-core pack or per server, one year at a time, invoiced by our entity in your country. The steps are the same for every product.
Two things people learn late. A system on Azure, or connected to Azure Arc, gets Windows Server ESU at no charge, which changes the arithmetic for anything that can be lifted. And a Windows 10 device that connects to a Windows 365 Cloud PC or Azure Virtual Desktop is entitled to Windows 10 ESU without buying it separately.
A distributor with three warehouses runs its dispatch system on two Windows Server 2012 R2 hosts. The application vendor was bought in 2023 and the new owner has not certified anything above 2012. The company bought the third and final year of Windows Server 2012 ESU in October 2025; that year ends on 13 October 2026, and there is no fourth.
What the options look like now:
The lesson the distributor draws is the one this article is about: ESU worked as a bridge for three years and is now over, and the next deadline of this kind is Windows Server 2016, whose support ends on 12 January 2027. Microsoft offers ESU for it from that date for up to three years, per two-core pack with a sixteen-core minimum per server, free on Azure and monthly through Azure Arc; the list price appears closer to January and we will quote from it the day it does. If you have 2016 hosts, the inventory is worth doing now.
A manufacturing group runs its ERP on SQL Server 2016 Standard, eight cores on one host. SQL Server 2016 left support on 14 July 2026; the first ESU year runs from 15 July 2026 to 14 July 2027, and there are three years available.
The arithmetic, from our September price list:
SQL Server 2016 Standard, eight cores, from our September list
| Option | List price | What it buys |
|---|---|---|
| ESU for SQL 2016 Standardfour two-core packs, year one | 4 × €4,223 = €16,892 | Security patches until 14 July 2027; the same again for year two and year three |
| SQL Server 2025 Standardfour two-core packs, perpetual | 4 × €4,223 = €16,892 | A supported database for a decade, if the ERP vendor supports it |
| SQL Server 2025 Standardper server plus client access licences | €1,057 + €246 per user | Cheaper below about fifteen named users; the same support life |
One year of ESU costs exactly what a new perpetual licence costs. That is not a coincidence; it is the price signal. For this group the decision is not whether to buy ESU but for how long: the ERP vendor certifies SQL Server 2022 and 2025, the upgrade is a weekend with a tested rollback, and ESU for one year is the insurance that the weekend can be chosen rather than forced. A group whose vendor does not certify anything newer buys the year and uses it to change vendor.
The same pattern applies to SQL Server 2014, whose third and final ESU year runs to 14 July 2027 at the same prices, and to the per-server editions at €1,055 a year.
A clinic network has one hundred and twenty desktops. Forty were replaced this year; eighty fail the Windows 11 hardware check — no TPM 2.0, processors from 2016. Windows 10 support ended on 14 October 2025. The first ESU year runs to 13 October 2026, the second to October 2027, the third to October 2028.
Windows 10 ESU, eighty devices that cannot run Windows 11
| Per device | Year one to October 2026 | Year two to October 2027 | Year three to October 2028 |
|---|---|---|---|
| List priceour September list, per device | €65 | €130 | €261 |
| Eighty devicesjoining now, so year one is owed as well | €5,200 | €10,400 | €20,880 |
Year one and year two together for eighty devices: €15,600. Year three alone would be another €20,880.
Eighty devices for year one and year two together is €15,600, and year three alone would be another €20,880. Against that, the clinic prices the alternatives: replacing the eighty machines over two budget years, or moving the ones that only run the practice-management client to Windows 365 Cloud PCs at €23.58 a month for the smallest Business size on our list, which also carries the ESU entitlement for the old device that connects. The answer it lands on is mixed — ESU for all eighty this year, thirty replacements and thirty Cloud PCs next year, ESU for the last twenty in year three — and the point is that every line of it has a price and a date, which is what the insurer asked for.
Two details for anyone doing the same: devices must be on Windows 10 version 22H2 with the current cumulative update before the ESU key is applied, and the Enterprise LTSC editions have their own ESU lines — LTSB 2016 from 2026, LTSC 2021 from 2027 — at the same three prices.
The licences are on the price list at Microsoft’s list price for your region; our price to you is lower and on the quote. The work around them — inventory, the migrate-or-ESU decision per system, activation across a fleet, the exception document for the auditor — is scoped in writing and usually takes a few days. If a system can be moved instead of patched, we say so; ESU is a year we sell reluctantly, because the better year is the one where the old system is gone.
No. It includes the Critical and Important security updates and nothing else. Microsoft support for ESU customers covers problems with the ESU updates themselves; a driver or an application fault is outside it.
Yes. It is per device for Windows 10 and per two-core pack or per server for SQL Server and Windows Server; buy it for the systems that cannot move and migrate the rest.
Yes, but year one is paid as well: the years are cumulative because each year's updates build on the previous. On Windows 10 that means year one plus year two, €195 per device at list.
On Azure virtual machines and on servers connected through Azure Arc, Windows Server ESU is included; through Azure Arc it can be paid monthly. A Windows 10 device that connects to a Windows 365 Cloud PC or Azure Virtual Desktop is entitled to Windows 10 ESU.
Nothing: the product stops receiving security updates entirely. The third year is the last for every product, which is why the plan to be off the product belongs in the same document as the ESU purchase.