Windows 10 Enterprise

Credential Guard, Microsoft Defender Application Guard for Edge, Windows Defender Application Control (WDAC) tooling, AppLocker with full enterprise management, DirectAccess (deprecated but still shipping), Windows Information Protection, the Long-Term Servicing Channel option (LTSC 2021), Microsoft Desktop Optimisation Pack (MDOP) entitlements where still applicable, and the Microsoft 365 Apps for Enterprise activation paths. Several of these features physically exist in Pro binaries but only activate with an Enterprise licence; SAM tools detect the mismatch and flag it in audit reports.

Windows 10 Enterprise LTSC 2021 is a separate SKU with a five-year mainstream support window (through 12 January 2027) intended for special-purpose devices: medical imaging, industrial controllers, ATMs, kiosks, point-of-sale terminals. It receives only security and quality updates — no feature updates, no Edge, no Store, no Cortana. LTSC is deliberately inappropriate for general-purpose information-worker PCs (Microsoft has been explicit about this for years) and Volume Licensing typically caps the percentage of an estate that can be LTSC. For fixed-function devices that cannot be re-certified often, LTSC 2021 remains the right answer until the hardware is retired.

Commercial ESU for Windows 10 Enterprise is sold per device for up to three years (through 14 October 2028). Year one is the cheapest tier; year two roughly doubles; year three roughly doubles again. ESU ships security updates rated Critical and Important only — no feature updates, no quality fixes for non-security defects, no driver updates and no design changes. Enrolment is via Volume Licensing or CSP and stacks on top of an existing Enterprise licence. For most organisations, ESU is a planned bridge over a hardware refresh or a Windows 11 migration, not a long-term residence — by year three the per-device price is significantly higher than the amortised cost of new hardware.

Organisations already on Microsoft 365 E3 or E5 have Windows 11 Enterprise included as a per-user benefit on up to five devices. The cheapest, cleanest migration plan for most shops is: validate critical line-of-business apps against Windows 11, refresh or in-place-upgrade qualifying hardware, and let Microsoft 365 subscription activation flip the device from Windows 10 Enterprise to Windows 11 Enterprise the moment a licensed user signs in. Devices that cannot make the hardware floor either enrol in commercial ESU as a bridge or move the user to a Windows 365 Cloud PC, where the local hardware no longer matters for the OS licensing.

The window between October 2025 and October 2028 is when most large estates carry mixed Windows 10 and Windows 11 Enterprise devices, with some Windows 10 endpoints on ESU and some not. SAM tools should reconcile per-device base licences against the VLSC record and the Microsoft 365 user count, flag any unsupported Windows 10 devices without ESU enrolment, and report ESU coverage by year so that finance can plan the year-two and year-three budget impact accurately. Audit findings during this period almost always cluster around forgotten-about ESU gaps on machines IT thought had already been retired.