Still on Windows 10 or an old server? What end of support means for you.

Somewhere in a lot of small businesses there is a computer that has been asking to upgrade for a year and a server in a cupboard that nobody wants to touch. Both still work, which is the problem. Microsoft has stopped free fixes for Windows 10, Windows Server 2016 follows on 12 January 2027, and the questions about it now come from insurers and Cyber Essentials assessors.

The short version.

• Nothing switches off. Microsoft says Windows 10 computers will still function after support ends. What stops is security fixes, so every newly found weakness stays open.
• Windows Server 2016 support ends on 12 January 2027, including the Essentials edition built for small offices.
• Paid extended updates for Windows 10 double in price each year, and the second year began in October 2026. Join late and you pay for the years you missed.
• Cyber Essentials won’t certify a business running unsupported systems unless they get paid updates or are cut off from the internet. Insurers ask about it too.
• There are four sensible ways out: upgrade, replace, move the server’s job to the cloud, or pay for a bridge year while you do one of the other three.

What end of support means.

Every Microsoft product has a published end date. Up to that date, Microsoft fixes security holes as they are found, usually in a monthly update. After it, the fixes stop unless you pay for them. Its Windows 10 page lists what ends: technical support, software updates, and security updates or fixes.

The day after, the computer looks exactly the same. That is why end of support is so easy to ignore. The change is in what happens next: criminals keep finding weaknesses, and on an unsupported system those weaknesses never close. The National Cyber Security Centre (NCSC), the government’s cyber security agency, says as much in its guidance on obsolete products: over time, new weaknesses are found that relatively low-skilled attackers can use. It also says the only fully effective fix is to stop using the obsolete product.

Antivirus doesn’t close the gap. Microsoft will keep updating its Defender antivirus and the Microsoft 365 apps on Windows 10 until October 2028. Neither fixes Windows itself.

The dates that matter.

Product	Where it stands
Windows 10	Free support ended 14 October 2025. Paid updates for businesses run to October 2028 at most
Windows Server 2016, including Essentials	Support ends 12 January 2027
SQL Server 2016, a database that some accounts and practice software runs on	Support ended 14 July 2026
Exchange Server 2016 and 2019, office email servers	Support ended October 2025. Microsoft released the final paid updates in October 2026 and says there will be no more
Office 2016 and Office 2019	Support ended 14 October 2025
Office 2021 and Office LTSC 2021, the one-off purchase versions	Support ended 13 October 2026
Windows 11 Home and Pro, version 24H2	Updates ended 13 October 2026. Machines need the yearly update to keep getting fixes

That last line catches people out. Windows 11 is not a one-off fix: each yearly version of Home and Pro gets two years of updates, so a Windows 11 laptop that has been stuck on an old version for months is in the same position as a Windows 10 one. Checking that updates are installing is part of the job.

Older Office has a second problem. Microsoft ended support for Office 2016 and 2019 connecting to Microsoft 365 back in 2023. They may still connect, but Microsoft warns they may run into unexpected reliability problems.

How many businesses are still on Windows 10.

More than you might think. Lansweeper, which sells software that keeps track of company computers, found in July 2026 that 21.4% of small and medium business Windows machines it can see still ran Windows 10, against 16.6% in large organisations. That is about one in five. It is a vendor’s figure from its own customers, not a UK survey, and some of those machines will be on paid updates.

For a UK view, Statcounter measures which versions of Windows are used to visit websites. In October 2026, 13.87% of UK desktop visits from Windows came from Windows 10, down from 31.61% a year earlier. That mixes homes and offices, but the direction is clear, and so is the size of what is left.

What insurers and Cyber Essentials ask.

Cyber Essentials. This is the government-backed security certificate that many customers and tenders now ask for. The current requirements, version 3.3 since April 2026, say all software on devices in scope must be licensed and supported, with high-risk and critical updates installed within 14 days. Unsupported software must be removed, or moved onto a separate network that has no internet access at all. The 2026 question set is blunter: an unsupported operating system without regular fixes from the vendor means you will not be awarded certification.

Paid updates count. IASME, which runs the scheme for the NCSC, says Windows 10 devices enrolled in extended updates are compliant, and that those not enrolled are not. It also calls extended updates a short-term fix. For servers, a version is compliant while it is in Microsoft’s mainstream or extended support, the two free phases of its support, so Server 2016 passes until 12 January 2027. After that, the question set accepts paid update subscriptions in general, but IASME calls them a last resort. Check with your certification body before relying on one.

Insurers. The forms you fill in to get cover, known as proposal or application forms, ask directly. Chubb’s UK proposal form (September 2024) asks whether you run any unsupported hardware, software or systems, whether they are cut off from the internet, and when you plan to retire them. Beazley’s 2024 form for smaller businesses asks you to confirm that you have no software past its end of life exposed to the internet. Hiscox’s policy summary (October 2024) goes further and lists claims due to the use of any outdated or unsupported computer system among its exclusions.

Every insurer words this differently, so read your own policy. And answer the form accurately. Our ransomware and insurance guide explains why a wrong answer on a proposal form can cost more than the awkward truth.

The ICO. The Information Commissioner’s Office enforces data protection law, which requires security appropriate to the risk, taking into account current technology and the cost. The ICO names old software in its fines. In May 2026 it fined South Staffordshire Water and its parent company, listing obsolete, unsupported software including Windows Server 2003 among the failures and calling legacy software a significant and avoidable risk. Closer to home for a small business, DPP Law, a law firm, was fined £60,000 in 2025. Attackers got in through a staff laptop, then took over an unprotected administrator account on the firm’s old case management software, which it had kept running for its records three years after support ended in 2019. “We only keep it for the old files” is a common reason to leave something running. The risk stays for as long as the software does.

Option one: upgrade what you can.

Windows 10 computers move to Windows 11 for free if they meet Microsoft’s requirements. The headline requirements are a supported processor, 4GB of memory, 64GB of storage and a security chip called TPM 2.0. Microsoft’s free PC Health Check app tells you whether a machine qualifies and, if it doesn’t, why not.

Microsoft publishes lists of supported processors. The Intel list starts with the eighth generation, and the AMD list with some Ryzen 2000 desktop chips and the Ryzen 3000 laptop chips. In our experience that covers most business computers bought from about 2019 onwards, and older machines usually fail on the processor.

There are well-known workarounds to force Windows 11 onto unsupported hardware. Don’t use them on business machines. Microsoft says such devices aren’t guaranteed to receive updates, including security updates, which defeats the point.

An upgrade is a good moment to check the software as well as the hardware. Ask the suppliers of the software your business runs on which versions they support on Windows 11, and test one machine before the rest.

Option two: replace the machines that can’t.

The NCSC’s advice to small organisations is direct: if a computer is no longer supported, replace it. It adds a useful line for budgets: you don’t need the latest model, just something that still receives updates.

Its Windows 10 advice makes the same point from the other side. Devices that can’t meet Windows 11’s requirements remain fundamentally vulnerable to attack, and replacing them is a chance to fix security weaknesses.

A laptop old enough to fail the Windows 11 check is often near the end of its useful life anyway: its battery, its speed and its ability to run the next version of anything are all running down.

Replacing in batches spreads the cost. Start with the machines that handle money, client data or administrator accounts, and work outwards.

Option three: move the server’s job to the cloud.

For a Windows Server 2016 machine, the right question is often not “what replaces this server?” but “what does this server do?” In many small offices the answer is shared files, email, user sign-in, perhaps a printer and one application. Most of that now lives comfortably in Microsoft 365.

The NCSC suggests the same route: wherever possible, move services from obsolete servers to modern, supported servers, or cloud services, and consider cloud software where updates are managed for you. Our cloud migration guide covers how that move runs, what the cloud does not back up, and where your data ends up.

Keylet, a multi-branch Cardiff property agency, went this way. Its servers were rebooting during working hours and running software heading out of support. Files moved to SharePoint and OneDrive, the lettings system moved to a cloud platform, Alto, and the servers were switched off for good.

The cloud isn’t right for everything. Some industry software still needs a machine in the building, and then a supported replacement server is the answer. Working out what the server does tells you which you have.

Option four: pay for a bridge year.

Extended Security Updates, Microsoft’s paid updates after end of support, exist for the machines you can’t move in time. The terms are worth reading before you buy.

Windows 10. Businesses can buy up to three years of updates, ending in October 2028. They are sold a year at a time, the price doubles every year, and they are cumulative: if you join in the second year, which began in October 2026, you pay for the first year too. They include security fixes only, with no technical support. A cheaper consumer version runs to October 2027, but Microsoft says it can’t be used in commercial scenarios, and it isn’t offered on computers joined to a company network or managed by a business.

Windows Server 2016. Paid updates run for up to three years, to January 2030, through Azure Arc, a Microsoft service that connects the server to its cloud for monthly billing. The server has to keep that connection, so this route doesn’t suit one you plan to cut off from the internet. They cover the Standard and Datacenter editions and generally require Software Assurance, an add-on to the original licence. Microsoft does not name Essentials.

Exchange 2016 and 2019. There is no future cover to buy. The final paid updates shipped in October 2026, and no more are coming.

Microsoft is clear that extended updates are a temporary bridge, not a long-term answer. The NCSC calls them a temporary measure. Used well, they cover the gap while new laptops arrive or a migration runs. Used badly, they become an annual bill that doubles while the problem stays put.

The last resort: cut it off.

Sometimes a computer can’t be upgraded or replaced: the one that runs a laboratory instrument, a cutting machine or a piece of software the supplier stopped updating years ago. Cyber Essentials and the NCSC both allow for this. For Cyber Essentials, the machine goes on its own separate network that blocks all traffic to and from the internet. The NCSC adds that email, web browsing, shared folders and USB sticks should be shut off as far as possible, so the machine has as little contact with the rest of the office as it can.

IASME notes that it is not unusual to need professional help to set this up, and the NCSC says these controls only work if they are technically enforced, not just agreed. Keep it to the machines that have no alternative, and review the decision regularly.

Where to start.

1. List every computer and server, with its version of Windows, its age and what it does. Include the machine in the corner that only one person uses.
2. Run PC Health Check on every Windows 10 machine. Sort them into “can upgrade” and “needs replacing”.
3. Find out what each server does. Files, email, sign-in, a database, one application. Then decide, item by item, whether it moves to the cloud or to a supported replacement.
4. Ask your software suppliers which versions of Windows and Windows Server they support, and get it in writing.
5. Check your insurance and Cyber Essentials answers against what you run today, and fix the gaps before the renewal.
6. Set dates. Server 2016 support ends on 12 January 2027. If anything will miss that, decide now whether you are paying for a bridge year or isolating it, and put the replacement date in the diary at the same time.

None of this needs to happen in a single weekend. It needs a list, a plan and dates, and the first two can be done this week.