WHAT IS EXPOSED, BY WHEN —
AND WHAT IT WILL COST.

Nothing, on the day. The device boots, the server runs, the database returns rows, and the application loads exactly as it did the day before. That is precisely why these deadlines get ignored. What stops is the supply of security updates, so every vulnerability discovered from that point stays open permanently. Because flaws found in current versions are frequently present in older ones too, each future patch cycle effectively publishes a map of holes that are fixed on supported platforms and left exploitable on unsupported ones. There are commercial consequences as well: Australian cyber insurance renewal questionnaires ask directly about unsupported operating systems, and the Essential Eight Maturity Model requires operating systems and applications no longer supported by their vendor to be replaced, at every maturity level.

It depends on what the money is buying time for. ESU delivers security updates rated critical and important, and nothing else: no new features, no non-security fixes and no general technical support. Microsoft prices it as a bridge rather than a destination, which is why Windows 10 ESU doubles each year, from US$61 per device in year one to US$122 and then US$244. It is cumulative too, so a business enrolling for the first time in year two pays for year one as well. ESU earns its place when a device or server is genuinely blocked: hardware certified only for the old platform, a vendor that has not certified anything newer, or a fleet too large to refresh in one budget cycle. It is poor value when it simply defers a decision that could be made now, because the price rises while the problem does not change.

This is the single most common blocker, and it is a vendor management problem before it is a technical one. Get the answer in writing and get it early, because it sets the shape of everything else: ask which operating system and SQL Server versions the vendor certifies today, what an application upgrade would cost, and what the timeline looks like. If the answer is that nothing newer is certified, the realistic options are an ESU bridge on the current platform, a lift of the workload into an Azure virtual machine to remove the ageing hardware risk while the vendor catches up, or replacing the application. Where the database is old because the product sitting on it is old, this deadline is a fair trigger to reassess the application rather than fund another three years underneath it.

It does, but not uniformly, and the differences matter. Windows Server 2016 workloads running as Azure virtual machines receive Extended Security Updates at no extra charge once the machine is set to take updates, which makes an Azure lift a genuine pressure valve for a stubborn server. Windows 10 ESU is likewise included at no additional cost for virtual machines in Windows 365, Azure Virtual Desktop and Azure, and a physical Windows 10 device is entitled to ESU for up to three years while its user holds an active Windows 365 licence. The two exceptions are worth knowing. Azure-hosted Windows Server 2012 R2 machines stop receiving ESU on 13 October 2026, the same date as on-premises servers, because the program itself ends. And starting with SQL Server 2016, moving to SQL Server on an Azure virtual machine no longer provides free ESU access, so that subscription is charged.

It is a generous offer and it does not apply to business devices. Microsoft extended the free consumer Extended Security Updates program for a second year, through 12 October 2027, for personal devices running Windows 10 version 22H2. Devices joined to an Active Directory domain or to Microsoft Entra ID, and devices enrolled in mobile device management, are excluded, which covers most business PCs set up the way a competent provider sets them up. The one carve-out is Microsoft Entra registered devices, the lightweight state common on a personal machine that accesses work email, which remain eligible. Assuming the free program covers a managed fleet is the most expensive mistake available in this whole area, because it means arriving at the deadline both unpatched and unbudgeted.

Discovery comes before any decision, and the count is almost always higher than the first estimate. For servers, ask for an inventory of every server operating system in the environment including virtual machines, since a 2012 R2 guest on a brand-new host still counts; winver or systeminfo confirms an individual box. For SQL Server, run SELECT @@VERSION on known instances, where anything reporting 13.x is 2016, then sweep the registry for instance names and check for the SQL Server Browser service on UDP port 1434 to catch instances nobody documented. For Windows 11 readiness, Microsoft Intune reports hardware eligibility across an entire fleet. For Exchange Web Services, the Microsoft 365 admin centre has a dedicated EWS Usage Report under Reports, then Usage, then Exchange. For Publisher, a search for .pub across devices, OneDrive and SharePoint finds the files. Ask every line-of-business vendor in writing as well, because appliances and turnkey systems hide instances that scanning misses.