Windows 10 reached the end of its free support life on October 14, 2025, and if your business is reading this in 2026 still running it on machines that touch client data, email, or payment information, the operating system underneath your daily work is no longer receiving security patches. That doesn't mean the computers stopped working — they didn't, and won't. It means every new vulnerability discovered in Windows 10 from that date forward simply never gets fixed on an unenrolled device, and that gap only grows wider the longer a business waits to act.
This guide is built to answer the practical questions an SMB owner or IT manager actually has right now: what does end of support really change day to day, is your existing hardware even eligible for a free upgrade to Windows 11, what does Extended Security Updates (ESU) actually cost if you need to buy time, what does a full migration cost in real Canadian dollars, and what does a sane, staged migration plan look like for a business that can't afford downtime. It also includes three realistic Canadian SMB case studies, a downloadable-style migration checklist, and an honest comparison of your three real options so you can make the right call for each device in your fleet rather than one blanket decision for the whole business.
Who wrote this guide
This guide was written and reviewed by IT Cares certified technicians based on running real Windows 11 migrations for Canadian small and mid-size businesses since Windows 10's end-of-support date. We're not trying to scare anyone into buying new hardware they don't need — a meaningful share of devices we check pass the compatibility test and upgrade for free. The goal here is to give you the same decision framework we use with clients: check first, then decide, device by device.
What "End of Support" Actually Means for Your Business
Windows 10's end-of-support date wasn't a shutdown switch. Every existing Windows 10 machine kept working exactly as it did the day before, and will keep working for as long as the hardware physically survives. What actually changed is quieter and, for a business, more consequential: Microsoft stopped shipping free security patches, feature updates, and standard technical support for Windows 10 on unenrolled devices. Bugs and vulnerabilities discovered from that date forward simply don't get fixed unless a device is separately enrolled in Extended Security Updates.
That distinction matters because most businesses conflate "the computer still works" with "the computer is still safe to use for business data," and those are two entirely different claims. An unpatched operating system doesn't become dangerous all at once — it becomes gradually more exposed as security researchers and, more importantly, attackers discover new vulnerabilities that will never be fixed on that specific version. Ransomware groups and malware authors actively watch for exactly this kind of widening gap, because an unpatched, widely deployed operating system is a far more efficient target than actively maintained software. Our deep-dive on how ransomware actually works covers the attacker's side of this in detail; the short version for this guide is that an unpatched fleet is precisely the kind of low-effort, high-yield target ransomware operators look for first.
📊 IT Cares field note: The businesses we see get hurt by this aren't the ones who never heard end of support was coming — most owners had seen a notification at some point. It's the ones who assumed "we'll get to it eventually" was a safe holding position, right up until a cyber insurance renewal got denied over it, or a client's vendor security questionnaire flagged it, or — less often but more expensively — an unpatched machine became the entry point for an actual incident.
Beyond the direct security risk, end of support creates three secondary problems worth planning around. First, cyber insurers increasingly ask specifically about supported operating systems during underwriting and renewal, and an unsupported OS on business machines can affect premiums, coverage terms, or even claim eligibility if an incident traces back to it. Second, software vendors gradually stop supporting Windows 10 for their own applications — accounting software, industry-specific line-of-business tools, and security software itself will eventually drop compatibility, leaving you stuck between an unsupported OS and unsupported applications. Third, new business hardware — printers, scanners, peripherals — increasingly ships with drivers built and tested against Windows 11 first, with Windows 10 support either absent or an afterthought, which quietly limits what you can even buy going forward.
Want a straight answer on where your fleet actually stands?
IT Cares checks every device against the real Windows 11 requirements and gives you a device-by-device recommendation — no upsell to hardware you don't need.
Is Your Hardware Even Eligible? The Windows 11 Compatibility Requirements
Before deciding anything about budget or timeline, the first real question is simpler: does your existing hardware qualify for a free in-place upgrade at all? Windows 11 introduced a meaningfully stricter hardware baseline than any previous Windows version, and it's the single biggest reason some businesses end up needing new hardware rather than a straightforward upgrade.
- TPM 2.0 (Trusted Platform Module): A dedicated security chip, either built into the processor or as a separate module on the motherboard, required for hardware-backed encryption and credential protection. This is the single most common reason an otherwise capable machine fails the compatibility check — many business PCs built before roughly 2016-2018 either lack TPM entirely or have it disabled by default in the BIOS/UEFI settings.
- UEFI firmware with Secure Boot capability: The device needs modern UEFI firmware (not legacy BIOS) with Secure Boot support, which prevents unauthorized operating systems and bootloaders from running during startup.
- A supported processor: Generally an 8th-generation Intel Core CPU or newer, or an AMD Zen 2 (Ryzen 2000 series-plus, generation-dependent) CPU or newer. Older business machines with 6th or 7th-generation Intel chips are common casualties here even when every other spec looks fine.
- At least 4GB of RAM (Microsoft's stated minimum), though realistically 8GB or more is the practical floor for comfortable business use with modern browsers, Microsoft 365, and typical line-of-business software running simultaneously.
- 64GB or more of storage, with a DirectX 12-compatible graphics card running a WDDM 2.0 driver — rarely a blocker on business machines bought within the last several years, but worth confirming on older units.
The fastest way to check a single device is Microsoft's free PC Health Check app, which runs a compatibility scan and reports pass or fail with a specific reason if it fails — most commonly "this PC doesn't currently meet the Windows 11 requirements" pointing at TPM 2.0 or the CPU generation. For a business with more than a handful of devices, checking machines one at a time isn't practical; an IT provider can run a fleet-wide compatibility report through endpoint management tooling in a fraction of the time, which is usually the more efficient starting point once you're past a single-digit device count.
Before writing off a device, check the BIOS
A meaningful share of "incompatible" machines fail the check simply because TPM is present on the motherboard but disabled in the BIOS/UEFI settings by default — sometimes labelled "PTT" (Intel Platform Trust Technology) or "fTPM" (AMD). Enabling it and re-running the compatibility check costs nothing and occasionally turns a "needs replacement" device back into a free upgrade candidate. This is exactly the kind of check worth having an IT provider confirm before a purchase decision gets made on a device that might not have actually needed one.
Three Ways to Handle Windows 10 End of Life: An Honest Comparison
Once you know which devices pass the compatibility check, every device in your fleet effectively has three real paths forward. There's no single right answer for a whole business — the right mix depends on device age, budget timing, and how critical each machine is to daily operations.
| Factor | In-Place Upgrade | New Hardware | ESU (Extended Security Updates) |
|---|---|---|---|
| Upfront cost | $0 in licensing if the device is already licensed and passes compatibility; labour/downtime only | Roughly $650–$2,500+ CAD per device depending on desktop vs laptop and specs (see pricing section) | Consumer: ~$30 USD one-time (or free with backup/Rewards points). Business/Volume Licensing: per-device annual fee, doubling each year |
| Requirements | Device must pass TPM 2.0, Secure Boot, and CPU compatibility checks | None — any new business PC ships Windows 11-ready | Device stays on Windows 10; enrollment through a Microsoft account or Volume Licensing/CSP |
| Security coverage | Full — same ongoing security update cycle as any current Windows 11 device | Full — plus newer hardware-level security features unavailable on older machines | Security patches only, no feature updates, and only for a limited, extendable period (up to 3 years for business ESU) |
| Timeline | Hours per device once backed up and validated; fastest path for eligible machines | Days to weeks depending on procurement, plus setup and data migration time | Same day enrollment; buys planning time rather than solving the underlying issue |
| Best for | Machines under roughly 4–5 years old that pass the compatibility check | Machines that fail compatibility, or that are already near the end of their useful hardware life regardless of Windows 11 eligibility | A small number of specialized or legacy-dependent machines that need more time before a permanent decision |
| Limitations | Not available on incompatible hardware; some peripherals/drivers may need updating post-upgrade | Highest upfront cost; requires data migration and app reinstallation planning | Temporary and increasingly expensive each additional year; doesn't solve the underlying hardware gap |
Read plainly, the table points toward the approach most Canadian SMBs land on in practice: run the compatibility check across the whole fleet first, upgrade every device that passes for free, replace the devices that clearly fail or are already near end of life, and reserve ESU for the small handful of edge cases — a specialized piece of equipment tied to legacy software, or a device replacement that's already budgeted for next quarter and doesn't need to happen today. Very few businesses end up choosing just one path for every machine.
What Migration Actually Costs in Canada (2026 Pricing)
Cost is usually the question that stalls a decision the longest, so here are honest, directional Canadian ranges for each path rather than a vague "it depends." Actual cost depends on fleet size, device mix, and whether you handle the work internally or bring in an IT provider.
- In-place upgrade (per eligible device): $0 in Windows licensing. If handled by an IT provider with proper backup, verification, and post-upgrade testing, expect roughly $79.99–$149.99 CAD per device for a professionally managed upgrade, versus doing it yourself for the cost of your own time and the real risk of skipping a verified backup step.
- New business hardware: Entry-level business desktops typically run $650–$950 CAD; solid mid-range business laptops run $900–$1,500 CAD; premium business-grade laptops with extended warranty and enterprise management features run $1,500–$2,500+ CAD. Add roughly $99.99–$199.99 CAD per device for professional data migration and setup if you want your existing files, settings, and applications moved over rather than starting from a blank machine.
- Consumer ESU (one extra year): Roughly $30 USD as a one-time fee per Microsoft account (covering up to 10 devices tied to that account), or free by enabling Windows Backup sync, or free by redeeming 1,000 Microsoft Rewards points.
- Business ESU (Volume Licensing/CSP, up to 3 years): Microsoft's published structure charges per device per year and doubles with each additional year of coverage — directionally in the range of $85–$100+ CAD per device for year one, roughly double that for year two, and roughly double again for year three. Because Microsoft has adjusted ESU terms before and pricing can vary by licensing channel, treat these as planning-stage figures and confirm current numbers with Microsoft or your IT provider before committing budget.
Two things are worth flagging specifically because they catch businesses off guard: first, ESU gets more expensive every year you stay on it by design — it's built as a bridge, not a long-term alternative to actually migrating, and treating it as a permanent solution usually costs more within three years than simply replacing the hardware would have. Second, the real migration cost for most businesses isn't the Windows license or even the hardware — it's the labour of backing up, validating line-of-business software, and testing peripherals across the fleet, which is exactly the work worth budgeting time for regardless of which path you choose per device.
Want an actual number for your business, not a range?
IT Cares' managed IT services include Windows 11 migration planning scoped to your real fleet — no guesswork on which devices qualify. If security posture during and after the migration is the bigger concern, our cybersecurity services and IT security audit checklist cover what to verify once your fleet is fully on Windows 11.
The Step-by-Step Migration Plan for a Small Business
A rushed, all-at-once migration is the most common cause of post-migration problems — a printer that stops working, a line-of-business app that behaves differently, or a staff member locked out of a file they need mid-workday. The sequence below is the same one IT Cares runs for client fleets, built to catch problems on a small scale before they become a full-business disruption.
Build a Complete Device & Software Inventory
List every Windows 10 device in the business — including any remote or hybrid staff machines that might get overlooked — along with its age, specs, and every application and peripheral it depends on. You can't plan a migration around devices and dependencies nobody has written down, and this step consistently surfaces machines nobody remembered were still in active use.
Run a Compatibility Check Across the Whole Fleet
Check every device against the real Windows 11 requirements — TPM 2.0, Secure Boot, supported CPU — using the PC Health Check app individually or a fleet management tool for a bulk report. Sort the results into three buckets: upgrade-eligible, replacement-needed, and edge cases that might need a closer look (like BIOS-disabled TPM).
Back Up Everything Before Touching Anything
Confirm a verified, restorable backup exists for every device and its data before any upgrade or hardware swap begins. Our full guide to business cloud backup covers this in depth — the migration-specific point is that "we have a backup" and "we have confirmed this backup actually restores" are different claims, and a migration is exactly the kind of change where you want the stronger of the two.
Decide Your Mix, Device by Device
For each device, choose in-place upgrade, hardware replacement, or temporary ESU coverage based on its compatibility results, age, and role in the business. Resist the instinct to apply one decision to the whole fleet — a five-year-old reception desktop and a two-year-old accountant's laptop rarely belong in the same bucket.
Pilot With a Small Group First
Migrate a handful of devices — ideally covering your most-used line-of-business software and any specialized peripherals — before touching the rest of the fleet. A pilot group of 2-4 machines is usually enough to surface most real-world issues without risking a full-business disruption if something unexpected comes up.
Validate Line-of-Business Apps & Peripherals
Confirm every critical application, printer, scanner, and specialized device still works correctly on Windows 11 during the pilot. Compatibility gaps here — an older printer driver, a legacy accounting package, a specialized scanner — are the single most common source of migration delays, and catching them on 2-4 pilot machines is dramatically cheaper than discovering them mid-rollout.
Roll Out in Stages by Department
Once the pilot is clean, migrate the rest of the business in planned waves — by department, location, or shift — rather than all at once. Keep a rollback plan ready for each wave, and schedule waves around each team's actual workload rather than defaulting to "whenever IT gets to it."
Train Staff & Retire Old Hardware Securely
Give staff a short walkthrough of what visibly changed in Windows 11 — the Start menu layout and a handful of relocated settings are the most common points of confusion, and a 15-minute team walkthrough headed off most support tickets we see post-migration. For any replaced hardware, securely wipe the drive rather than relying on a normal file deletion, then donate, resell, or recycle through certified electronics recycling — our computer recycling service handles secure data destruction and responsible disposal for retired business hardware.
The Downloadable Migration Checklist: Print This or Save It
Below is the condensed, actionable version of the plan above — meant to be printed, saved as a PDF, or copied into your own tracking document and worked through device by device.
Windows 10 → 11 Migration Checklist — 2026
Inventory & Assessment
☐ Complete list of every Windows 10 device exists and is current
☐ Every device has been run through the PC Health Check (or fleet-wide equivalent)
☐ BIOS/UEFI checked for disabled TPM before writing off a "failed" device
Backup & Data Protection
☐ A verified, restorable backup exists for every device before migration begins
☐ Critical business files confirmed accessible from the backup, not just "backed up"
Decision & Planning
☐ Each device assigned a path: upgrade, replace, or temporary ESU
☐ Budget confirmed for hardware replacements and/or ESU enrollment
☐ Migration timeline set with a pilot phase before full rollout
Pilot & Validation
☐ 2-4 pilot devices migrated covering key line-of-business software
☐ All critical printers, scanners, and peripherals tested on Windows 11
☐ No pilot-phase issues left unresolved before full rollout begins
Rollout & Wrap-Up
☐ Staged rollout completed by department or location
☐ Staff given a short walkthrough of Windows 11 changes
☐ Retired hardware securely wiped and disposed of or recycled responsibly
Real Canadian SMB Examples: How This Plays Out in Practice
These three examples are composite, illustrative case studies based on the kinds of migrations and outcomes that are common across Canadian SMBs since Windows 10's end-of-support date — not accounts of specific named clients. They're included because the real numbers make the decision concrete in a way generic advice doesn't.
Case study 1: Bellwood Insurance Brokers, Kitchener, ON — 18 employees
Bellwood ran 22 Windows 10 devices across its office, most purchased in two batches roughly three and six years earlier. A fleet compatibility check found 14 devices passed the Windows 11 requirements outright, 3 more passed once TPM was enabled in the BIOS, and 5 older desktops in the back office failed on CPU generation. The 17 eligible machines were upgraded in place over a single weekend at $99.99 CAD per device for a managed upgrade (backup, upgrade, verification), totaling $1,699.83 CAD. The 5 incompatible machines were replaced with entry-level business desktops at roughly $780 CAD each plus $129.99 CAD in migration setup, totaling about $4,550 CAD. Total project cost: just under $6,250 CAD for the full 22-device fleet, completed over three weeks including a one-week pilot.
Case study 2: Fraser Valley Dental Supply, Abbotsford, BC — 34 employees
Fraser Valley's warehouse ran several older Windows 10 PCs tied to a specialized inventory-scanning application whose vendor hadn't yet confirmed Windows 11 compatibility at the time of planning. Rather than force a risky upgrade on business-critical warehouse machines, the company enrolled 6 of those specific devices in business ESU as a bridge while the software vendor finished testing, at an estimated $510 CAD for year-one coverage across the group, while the remaining 28 office and management devices — all compatible — were upgraded in place over the same month for roughly $2,800 CAD combined. The ESU purchase bought Fraser Valley a confirmed 12-month runway to migrate the warehouse machines properly once vendor compatibility was verified, rather than either risking a broken inventory system or leaving those machines unpatched with no plan.
Case study 3: Rideau Bookkeeping Collective, Ottawa, ON — 9 employees
As a micro business with a tight annual technology budget, Rideau needed to stage its migration across two fiscal quarters rather than all at once. A compatibility check on its 9 devices found 6 eligible for a free upgrade and 3 aging laptops that failed. Rideau upgraded the 6 eligible machines immediately at minimal cost, replaced 1 of the 3 failed laptops that quarter (roughly $1,050 CAD for a business laptop plus setup), and used consumer ESU (the free Windows Backup enrollment path, at no direct cost) to cover the remaining 2 laptops for one additional year while budgeting their replacement into the following fiscal quarter. The phased approach let a 9-person business fully close its Windows 10 security gap without a single large unplanned expense hitting one budget cycle.
What these three cases have in common
None of them treated the fleet as one all-or-nothing decision. Each business ran the compatibility check first, then matched the path — upgrade, replace, or temporary ESU — to what each specific device and its role actually needed. That's the pattern worth copying: check before you budget, and expect your fleet to end up with a mix of outcomes rather than a single uniform answer.
Budgeting the Migration: Making the Case to Leadership
For IT managers, the technical plan is rarely the hard part of this project — getting budget approved from ownership or leadership usually is, especially for a project that doesn't visibly change anything if it goes well. A few framings consistently help move the conversation.
Frame the cost of inaction in real dollars, not abstract risk. Compare the migration budget — typically a few thousand dollars for a small fleet — against the realistic cost of even a moderate security incident tracing back to an unpatched device: incident response, potential downtime, client notification, and reputational impact regularly runs into five or six figures even for a small business. Our guide to setting a realistic cybersecurity budget per employee gives a useful reference point for sizing this conversation against your overall IT spend.
Tie it to something leadership already tracks. A cyber insurance renewal, a client vendor-security questionnaire, or an upcoming compliance deadline are all levers that make budget approval move faster than presenting the migration as a purely internal IT initiative nobody outside IT will ever notice happened.
Phase the spend across fiscal periods if the full fleet feels like too much at once, the way Rideau Bookkeeping did above — upgrade what's free and eligible immediately, replace the most business-critical incompatible devices this quarter, and use ESU as a deliberate, budgeted bridge for the rest rather than an accidental default because nobody made a decision.
If ongoing hardware refresh planning matters more than treating this as a one-time scramble, bundling regular device lifecycle review into a managed IT services agreement means the next OS transition — whenever it comes — never catches the business by surprise the way this one may have.
Frequently Asked Questions
Ready to Find Out Exactly Where Your Fleet Stands?
IT Cares checks every device against the real Windows 11 requirements and hands you a device-by-device migration plan — upgrade, replace, or bridge with ESU, whichever actually makes sense for each machine.
Comments (3)
Ran the PC Health Check across our 15-machine office expecting to replace half of them. Turned out 4 just had TPM disabled in the BIOS. Saved us a few thousand dollars we'd already started budgeting for new hardware.
The ESU-as-a-bridge idea for our one legacy scanning app was exactly what we needed. Didn't want to force an upgrade before the vendor confirmed compatibility, and this let us patch security without touching the app.
The comparison table made it easy to explain to our owner why we weren't replacing every single machine. Phased it exactly like the Rideau example — free upgrades now, one replacement this quarter, ESU on the rest until next budget cycle.
Leave a Comment