Windows 10 and Secure Boot: What Changes in October 2026
In October 2026, two important deadlines expire for Windows PCs: on October 13, the first ESU year for Windows 10 in businesses, and on October 19, a key Microsoft Secure Boot certificate.
“Do I have to buy a new PC now?” – I have been hearing this question in recent weeks from customers in Bedburg, Bergheim, and the entire Rhein-Erft district. No wonder: contradictory information is circulating online, and even specialist sites sometimes still cite outdated dates.
In this article, I explain clearly what actually applies – separately for home users and businesses. And I show you how to check in just a few minutes whether your PC is affected.
The Short Version for Those in a Hurry
Private Windows 10 PCs get one more year. Business PCs must act by October 13. And for all Windows PCs, a quick look at Secure Boot is worthwhile.
| Date | What happens | Who is affected | What to do |
|---|---|---|---|
| October 13, 2026 | First ESU year for Windows 10 in businesses ends | Windows 10 PCs used for business | Book second ESU year, switch to Windows 11, or replace device |
| October 19, 2026 | Secure Boot certificate “Windows Production PCA 2011” expires | All Windows 10 and Windows 11 PCs, especially older devices | Install updates, check status, update BIOS/UEFI if needed |
| October 12, 2027 | ESU for home users ends (instead of October 2026) | Private Windows 10 PCs | If registered: do nothing. Plan migration by 2027 |
| October 10, 2028 | Final ESU year for businesses ends | Windows 10 PCs used for business | Should be fully migrated by then at the latest |
Windows 10 at Home: You Have Until October 2027
Microsoft quietly extended free security updates for private PCs by one year in the summer – until October 12, 2027. According to Microsoft, anyone who is already registered does not need to do anything: protection continues automatically.
The change initially appeared only in a footnote. That is why you may still read online in some places that it ends on October 13, 2026. For home users, that is no longer true.
Is My PC Already Registered?
- Open Settings > Update & Security > Windows Update.
- There you can see whether your PC is registered in the ESU program. If not, the link “Register now” appears.
- Press Windows key + R, type
winver, and confirm. It must show Version 22H2.
What You Should Watch Out For
- In Germany, ESU is free as long as you remain signed in to the PC with your Microsoft account.
- If you no longer sign in with this account, updates stop after up to 60 days. Then you must register again.
- If you prefer to work with a local account, you can buy ESU once for around 30 US dollars.
- One registration covers up to 10 devices.
My advice: Use the gift year to migrate calmly – not to postpone the topic again. Otherwise, in October 2027 you will face exactly the same question. If you would like support, you can find my IT help for home users here.
Windows 10 in Business: The First ESU Year Ends on October 13
The extension does not apply to PCs used for business. Microsoft explicitly excludes the free private ESU in business environments – for example, for PCs in an Active Directory domain, in Microsoft Entra, or in device management (MDM).
Businesses book ESU per device and year, for a maximum of three years. According to Microsoft, the price doubles each year:
| ESU Year | Runs Until | Price per Device (Microsoft Volume Licensing) |
|---|---|---|
| Year 1 | October 13, 2026 | 61 US dollars |
| Year 2 | October 12, 2027 | 122 US dollars |
| Year 3 | October 10, 2028 | 244 US dollars |
Important: The years build on one another. Anyone joining only now pays retroactively for the first year – so waiting does not make it cheaper. What you actually pay depends on the purchasing channel.
Upgrade, Replace, or Bridge? My Rule of Thumb per Device
- The PC meets the Windows 11 requirements (including TPM 2.0): upgrade to Windows 11. This is usually the cleanest and cheapest solution.
- The PC cannot handle Windows 11 and is already outdated: replace it. The first two ESU years together already cost 183 US dollars per device – money that is better invested in new hardware.
- The PC controls a machine or an old specialist application that does not run under Windows 11: use ESU as a bridge – with a clear plan for when it will be replaced.
Why This Matters Especially for Medical Practices, Law Firms, and Tax Offices
The GDPR requires appropriate technical measures to protect personal data (Art. 32). An operating system without security updates can hardly be justified as appropriate – at the latest after an incident, that is exactly what will be asked.
Anyone processing patient or client data should therefore have made a decision for every Windows 10 computer before October 13. I take on exactly this assessment as part of my IT support for businesses.
Secure Boot: The Last Old Certificate Expires on October 19
On October 19, 2026, the Microsoft certificate “Windows Production PCA 2011”, which signs the Windows startup process, expires. This affects Windows 10 and Windows 11 equally.
First, the all-clear: your PC will continue to start normally afterward, and regular Windows updates will also continue to run. However, according to Microsoft, if the new 2023 certificate is missing, the PC will no longer receive new protections for the early startup process.
That sounds harmless, but it is not entirely. That is exactly where so-called bootkits come in – malware that starts before Windows and is hard for normal antivirus scanners to find. A well-known example is BlackLotus.
Do I Need to Do Anything?
If you use Windows 11 and install updates regularly, in most cases you have already received the new certificates automatically. You should pay attention in three cases:
- Older PCs and servers for which the manufacturer no longer provides BIOS/UEFI updates.
- Windows 10 PCs without ESU. They no longer receive any updates at all – and therefore no new certificates either.
- Computers on which updates have been stuck for months or are being held back manually.
How to Check the Status in Two Minutes
- Open Windows Security > Device Security. Since April 2026, Windows also shows the status of the Secure Boot certificates there.
- Press Windows key + R, type
msinfo32, and look at the entry “Secure Boot State”. It should be set to “On”. - For those interested in technical details: In a PowerShell with administrator rights, this command shows
Trueif the new certificate is already stored:
[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'
If your PC shows a warning or False, the next step is usually a BIOS/UEFI update from the manufacturer. This should be approached carefully – a failed firmware update can cripple a PC.
And please do not simply turn off Secure Boot to get rid of the issue. Microsoft explicitly advises against this too – the PC would then be significantly less protected.
Frequently Asked Questions
Will Windows 10 still work after October 13, 2026?
Yes. The PC starts, programs run as usual. Only the security updates end – for business PCs without a booked second ESU year.
Will my PC no longer start after October 19?
Yes, it will start normally. Without the new Secure Boot certificates, it will only lack future protections for the startup process.
As a self-employed person, can I simply use the free private ESU?
Microsoft explicitly excludes business use. Even if registration should technically work on a single office PC, I would not rely on it for your business.
Will Office and Microsoft 365 continue to receive updates under Windows 10?
Yes, the Microsoft 365 apps will receive security updates on Windows 10 until October 10, 2028. But that does not help if the operating system underneath is unprotected.
Can I also install Windows 11 on a PC without TPM 2.0?
Technically there are workarounds, but Microsoft does not officially support it. For business PCs with sensitive data, I advise against it.
Are there alternatives to Windows 11?
For older private PCs that you mainly use for browsing, emailing, and editing documents, Linux can be a good and free solution. We would be happy to look together at whether that fits your computer.
Conclusion: Decide Calmly Now Instead of Under Pressure in October
For home users, Microsoft has turned back the clock by one year. Businesses, by contrast, must decide by October 13 for every Windows 10 computer: extend, upgrade, or replace. And for everyone: install updates and briefly check Secure Boot status.
Would you like to know how the computers in your business are doing? As part of a free initial IT consultation, we will get an overview together – on-site in Bedburg, Bergheim, and the Rhein-Erft district or via remote support. You will learn which devices are Windows 11 capable, where ESU is still worthwhile, and where replacement makes more sense.
Schedule a free initial IT consultation – or call me directly: 02272 / 9774010.
Information current as of: September 27, 2026. Microsoft occasionally changes deadlines and terms at short notice – I keep this article up to date.
Sources
- Microsoft: Extended Security Updates (ESU) for Windows 10
- Microsoft Learn: Extended Security Updates (ESU) program for Windows 10
- Microsoft Support: When Secure Boot certificates expire on Windows devices
Transparency note: This article was written by me.
AI was used for language editing. I am responsible for the content.
