This article outlines what this means for organisations and what you should be considering ahead of the deadline.
Microsoft operate on a modern lifecycle policy, which defines a clear schedule for when their software and services will be supported. After the end of support, Windows 10 will continue to work however, you will no longer receive new features, updates and perhaps most importantly – no new security updates, patches or bug fixes.
No new security updates mean that if a new vulnerability or bug is discovered in Windows 10 then Microsoft will not be releasing updates to fix this. This would then mean that you have an active vulnerability that attackers could exploit to access your environment and put your organisation at risk of a cybersecurity attack.
Overall, there are four main options that companies could consider – two we would not recommend and two that we would:
1. Do nothing. While an option this is something we would strongly advise against. Once you enter into end of support, you will be putting your company into an extremely risky position. Cyber attackers will always target the weakest organisations as it’s the best return for them and easiest to do, and with an unsupported operating system there will soon be vulnerabilities to exploit.
2. Buy new hardware. While you could simply buy new hardware for all employees to replace Windows 10 devices, this is going to be extremely expensive and also isn’t necessarily needed.
3. Pay for Extended Security Updates (ESU) from Microsoft. Microsoft have announced that they will offer extended security updates. This means that your organisation can purchase a yearly subscription to security updates, which is renewable for three years. As part of this, enrolled devices receive monthly critical and/or important security updates – but it does not include new features, non-security updates or design changes. This is a good option if you need to buy more time if there are circumstances that prevent you from replacing devices before the end of support deadline.
4. Upgrade your current devices to Windows 11. Out top recommendation is to upgrade your existing devices to Windows 11. This ensures that you are on the latest operating system for security, but also is the most cost effective without buying new hardware. Now the important consideration is whether your devices are compatible or not. Those that are compatible benefit from a simple process, but those that are incompatible need further consideration, which we’ve outlined below.
The upgrade of compatible devices to Windows 11 is a very straightforward process. Assuming your devices are managed by Intune, a small configuration change is required to enable this. Once this change is made, compatible devices will receive the Windows 11 upgrade via Windows Update when the device next checks for updates. This does mean the next reboot for those devices may take longer than a normal monthly update.
Windows 11 introduces more stringent hardware requirements, such as TPM, which can mean that older Windows 10 devices may not meet the minimum hardware requirements for Windows 11. If your organisation is using Microsoft Intune, then you can retrieve data that identifies any devices you have that are not compatible. For these devices, we would recommend replacing the hardware.
We recommend identifying and replacing any incompatible devices during 2024 and starting to distribute the Windows 11 upgrade as soon as your devices are compatible. Device upgrades and/or hardware refreshes can take a longer time than expected, so do give yourself plenty of time to avoid cutting it close to the end of support deadline.
If you’d like help reviewing your hardware compatibility and upgrading to Windows 11, please contact us for more information.