Windows 10 reaches end of support

Windows 10 stopped receiving free security updates today. Estimates for the installed base still running it range widely; every one of them is in the hundreds of millions of machines.

the TPM problem#

The reason this is unusually messy is Windows 11's hardware requirements, specifically TPM 2.0 and the supported-CPU list.

Microsoft's justification is security: a hardware root of trust enables virtualization-based security, credential guard, and measured boot, and these meaningfully reduce entire categories of attack. That argument is technically sound.

The consequence is that a large number of machines that are functionally fine — adequate CPU, plenty of RAM, working perfectly — cannot install the supported operating system. Not because they are slow. Because of a security chip.

The environmental math is grim. Estimates of machines rendered security-obsolete run into the hundreds of millions. Those devices do not stop working; they become unpatched machines on the internet, or they become e-waste, and both outcomes are bad.

the options#

Extended Security Updates. Consumers get a limited free path (with conditions) or a modest paid year. Enterprises pay per device, per year, escalating annually, for up to three years. Budget for it if you have a fleet — the escalation is designed to be painful on purpose.

Upgrade the hardware. The intended path. Expensive at fleet scale and sometimes impossible for machines running certified software tied to specific configurations.

Bypass the requirements. Documented registry workarounds exist and work. Microsoft has warned that unsupported installations may not receive updates, which makes this a poor choice for anything you depend on.

Move to Linux. Genuinely viable for a larger share of use cases than it was five years ago, particularly for developer machines and for kiosk or single-app deployments. Several distributions ran campaigns targeting exactly this moment.

The blocker remains what it has always been: specific Windows-only applications, and hardware with Windows-only drivers.

for developers specifically#

Check your minimum supported version. If your application still supports Windows 10, decide when it stops. Users on an unsupported OS are a support burden and a security liability, and the decision to drop them is easier to make now with a clear industry line to point at.

Test on Windows 11. Particularly anything touching security features: credential storage, code signing, driver interaction, or anything that uses the TPM. Behavior differs.

If you ship developer tooling, the Windows developer story is meaningfully better than it was — WSL 2, the modern terminal, winget, and PowerShell 7 are all good. If your Windows support is a grudging afterthought from 2018, it is worth revisiting.

the broader pattern#

Operating system lifecycle transitions are increasingly forced by security architecture rather than by capability. The machine is fast enough. The machine lacks a specific security primitive that the new threat model requires.

This will happen again — with memory tagging, with pointer authentication, with whatever comes after. The useful lesson for anyone planning a fleet: hardware lifespan is now set by the security roadmap, not by performance. Plan accordingly, and push back on vendors who make that window shorter than it needs to be.