Windows 10 end of support: the estate you cannot see

Where the deadline actually stands

Windows 10 stopped receiving mainstream support on 14 October 2025. Extended Security Updates then bought time in yearly instalments, with Year 1 ending in October 2026 and each subsequent year costing more, because ESU is a bridge rather than a destination.

Windows 11 requires TPM 2.0 and Secure Boot, which turns this into a hardware programme rather than a software one: a large share of venue back-office and EPOS-adjacent PCs predates it and cannot be upgraded in place at any price. So the position in September 2026 is simple. If you bought ESU Year 1, you have weeks left. If you did not, those machines have had no security updates for nearly a year.

What is Extended Security Updates?

Extended Security Updates is a paid Microsoft programme that continues to deliver security patches for Windows 10 after mainstream support ended, sold in yearly instalments with the price rising each year. It provides security fixes only: no new features, and no guarantee that third-party software vendors will keep supporting their applications on the platform.

Why a hospitality estate is harder than an office

An office refresh is a logistics exercise. A venue estate is an archaeology exercise: scattered machines, often unlogged, frequently doing something nobody has documented.

There is the back-office PC in the cellar running the rota, the stock system and the safe software. There are EPOS-adjacent terminals: the manager's reporting PC, the cash-up station, the back-office server the till software talks to. There are kitchen display PCs in a hot, greasy environment, signage players above ceiling tiles, and BMS and AV control PCs installed by a contractor with their own remote access.

And there is the machine nobody has logged into for two years, running the only copy of something important: a licence server, a legacy reporting tool, a monthly export finance depends on.

The compliance angle is not a judgement call

An unsupported operating system inside the card data environment is a PCI DSS problem, not a matter of risk appetite. The standard requires system components to be protected from known vulnerabilities, and an operating system receiving no patches cannot meet that. PCI DSS v4.0.1 is current, and all its requirements are in force following the 31 March 2025 deadline.

Requirement 12.5.2 expects annual confirmation of PCI scope, so "which machines are in scope?" has to be answered in writing, and an unsupported in-scope machine will surface in a self-assessment questionnaire or a report on compliance. The [[PCI DSS checklist for hospitality]{.underline}](about:blank) is the place to confirm what sits inside your cardholder data environment. Unsupported endpoints are also among the most reliable footholds an attacker can find, which is why they feature in real [[hospitality cyber security attack paths]{.underline}](about:blank).

You cannot plan a refresh you cannot count

Start with an inventory from more than one source: what the management and antivirus tools already know, a network discovery scan per site to catch unmanaged machines, and GMs walking their sites with a checklist, because signage players and AV control PCs often sit on switches nobody has documented.

Record for each device: site, location, operating system, hardware model and age, TPM and Secure Boot status, what it does, who owns the application, whether it touches card data, and whether anyone would notice if it were switched off. That last column resolves the most machines.

Triage: upgrade, replace, isolate, retire

The vendor-locked machines

Every estate has a PC that an EPOS, AV or BMS vendor has not certified for Windows 11. Upgrading it breaks the support agreement; leaving it breaks the security position.

Handle that as a formal conversation, not an email. Ask the vendor in writing for their certification roadmap and a date, and record the answer: it becomes part of your compensating-control story and of the commercial discussion at renewal. A vendor with no roadmap is telling you something useful.

Budgeting and scheduling around trading

A refresh across a multi-site group is a capital programme and rarely fits one financial year. Split it by risk: the card data environment first, internet-facing machines second, anything that stops a site trading third, everything else next year. That survives a finance review better than a site-by-site rollout.

Scheduling is underestimated. A venue cannot lose its back office on a Friday. Work happens on the quietest morning, before deliveries, with the machine imaged in advance so the visit is a swap rather than a build. Data, printer mappings, saved reports and six years of bookmarks have to come across, or the refresh is remembered as the week IT broke everything. That planning is ordinary [[IT consultancy]{.underline}](about:blank) work.

Isolation, done properly

For a genuinely immovable machine, isolation is a legitimate last resort. But it means more than putting the device on a different VLAN.

It means its own segment with default-deny rules in both directions, permitting only the traffic its function requires. No internet access unless a named vendor destination is allowed. Removal from the card data environment, documented. No shared credentials and no local admin used elsewhere. Logging and alerting on denied traffic. And a review date with a named owner, so a temporary arrangement does not become permanent.

Operators running large numbers of [[restaurant and bar sites]{.underline}](about:blank) find a handful of these per estate, not hundreds. Handle them deliberately and the rest is ordinary procurement, best run with a [[managed IT support]{.underline}](about:blank) partner who holds the asset register.