Windows 10 Pro

Pro covers the full Windows 10 business surface: BitLocker drive encryption, Hyper-V virtualisation, Windows Sandbox, Remote Desktop host, AD and Entra ID join, Group Policy, AppLocker, Assigned Access, the Windows Update for Business deferral framework, and the Microsoft Store for Business. Microsoft 365 Apps for Enterprise activates against Pro. The management surface is functionally identical to Windows 11 Pro — Intune Autopilot, configuration profiles, compliance policies and conditional access all work the same way. From a feature-licensing perspective, a Windows 10 Pro device and a Windows 11 Pro device are largely interchangeable in the SAM record.

Windows 10's hardware floor is significantly lower than Windows 11's. Devices with pre-8th-generation Intel Core CPUs, AMD pre-Zen 2 CPUs, or boards without TPM 2.0 / Secure Boot can keep running Windows 10 Pro but cannot upgrade in place to Windows 11 through Windows Update. Industrial PCs, medical workstations, signage controllers, and the long tail of office desktops bought before 2019 sit in this category. For these devices the realistic paths are: hardware refresh (often the cheapest in TCO), a commercial ESU subscription (yearly, through October 2028 at the latest), migration to a Windows 365 Cloud PC where local hardware only needs to render the session, or — for the most fixed-function devices — migration to Windows IoT Enterprise LTSC on the same hardware with a different licensing model.

Extended Security Updates is a separate paid programme that ships critical and important security updates only — no new features, no driver updates, no design changes. Consumers could enrol for one year, which ended on 13 October 2026; commercial customers buy ESU per device for up to three years (through October 2028) at a price that roughly doubles each year. Year one ended in October 2026, so organisations enrolling now buy year two and must also pay for the missed year. Enrolment is done through Volume Licensing or CSP and is layered on top of an existing Pro licence — ESU does not replace the base OS licence, it extends its security maintenance. ESU does not include phone support or non-security hotfixes.

Windows 10 Pro keys remain valid for fresh installs and reinstalls indefinitely on hardware that already carried a Pro digital entitlement. Retail keys move between devices one active install at a time; OEM keys remain bound to their original hardware for life and are not separable. KMS, Active Directory-based Activation and MAK all continue to function for Volume Licensing estates. A Windows 10 Pro Retail key can also be used as the seed for an in-place upgrade to Windows 11 Pro on compatible hardware — the digital entitlement converts cleanly and no second purchase is required.

For hardware that meets the Windows 11 floor, the upgrade is free, in-place, preserves applications and settings, and converts the Pro digital entitlement to a Windows 11 Pro entitlement on the same Microsoft account. There is no licensing case for staying on Windows 10 indefinitely on compatible hardware once the team has validated their critical line-of-business apps against 11. For incompatible hardware, the honest budgeting answer is that ESU is a bridge, not a destination: planning a refresh cycle to land before ESU's third-year price spike is almost always cheaper than paying another year of escalating per-device ESU fees on aging hardware.