Windows 10 support ended in October 2025, and a lot of small offices in Marchmont quietly enrolled their PCs in Microsoft’s Extended Security Updates (ESU) to buy a year. That year was due to end on 13 October 2026. Microsoft has extended it: the consumer ESU programme now runs until 12 October 2027, and PCs that are already enrolled carry on receiving security patches automatically. So the cliff edge has moved back a year. If your letting office on Marchmont Road, your therapy room off Warrender Park, or the two-desk consultancy working from a tenement flat still has Windows 10 machines, you have time to do this calmly — but there is a catch for businesses, covered below, and the job itself has not changed.
The good news is that this is rarely an “everything must be replaced” job. In the offices we’ve worked through this year around Marchmont, Bruntsfield and Newington, most PCs fall cleanly into one of three piles, and only one of those piles means new hardware. This guide is the triage we actually run, in the order we run it, so you can do most of it yourself and know exactly which machines need a hand. If you just want it done, that’s what our small business IT support is for.
What the Extension Changes — and What It Doesn’t
For a PC that is enrolled, security patches keep arriving until October 2027. For a PC that was never enrolled, nothing has changed: it has had no security updates since October 2025, and it shows no sign of it. It boots the same, Outlook opens, the accounts package runs. That is precisely the problem: an unpatched Windows 10 machine looks healthy right up to the point where a newly published vulnerability is used against it. For a business holding tenant details, client notes or payroll, running an unpatched operating system is also hard to square with UK GDPR’s “appropriate security” duty, and it is an automatic fail for Cyber Essentials if you hold or are working towards it.
Three things catch people out. First, Microsoft 365 apps keep receiving their own security updates on Windows 10 for longer than Windows itself does, so Office still updating is not a sign the PC is protected. Second, the extension applies to the consumer programme, and Microsoft’s terms say that programme is for personal PCs: it is not offered for commercial use, or for PCs joined to a company domain or managed centrally. The scheme meant for businesses is commercial ESU, bought through a Microsoft licensing partner and renewed a year at a time for up to three years. Most micro-businesses we see enrolled through Settings, on the consumer scheme, so it is worth knowing which one each PC is on: open Settings → Windows Update, where a consumer-enrolled PC says so. Third, ESU delivers security patches only — no fixes for other faults and no support from Microsoft. Either way, ESU is a bridge, not a destination.
1. Run the Compatibility Check on Every PC — Properly
Install Microsoft’s PC Health Check app on each Windows 10 machine and click “Check now”. Write down the result per PC; don’t trust memory. Then, because PC Health Check only tells you that something failed, open two more tools to find out why:
tpm.msc(Win + R) — shows whether a TPM exists and its specification version. “Compatible TPM cannot be found” usually means it’s switched off in the firmware, not missing.msinfo32— check BIOS Mode (UEFI or Legacy) and Secure Boot State, and note the exact processor model.
Those three readings — TPM, BIOS mode, processor — decide which pile the PC goes into. Everything else on the checklist (4 GB of RAM, 64 GB of storage) is almost never the blocker on an office machine bought in the last seven years.
2. Pile One: Passes Already — Upgrade, but Back Up First
If PC Health Check is green, the machine is offered Windows 11 as an in-place upgrade through Windows Update or the Installation Assistant. Files, apps and settings come across. But before you click, take a proper backup to a drive that is then unplugged — not just “it’s all in OneDrive”. We have seen enough upgrades roll back halfway, or offices discover their OneDrive sync had quietly stopped months earlier, to insist on this every time. The pattern is the same one we described in our guide to backups that fail silently.
Do the upgrade at the end of the day, one PC at a time, and check the next morning that your line-of-business software opens, prints and saves. Windows keeps a rollback copy for 10 days (Settings → System → Recovery → Go back), so test inside that window rather than discovering on day twelve that the label printer no longer works.
3. Pile Two: Fails on a Setting, Not the Hardware
This is the pile that rescues the most machines, and it’s where most of our Marchmont work this month has landed. Two failures here are fixable in an afternoon:
- TPM switched off. Intel machines call it PTT, AMD calls it fTPM, and on many business desktops it ships disabled. Enabling it in the firmware setup is usually a single toggle; our step-by-step guide to enabling TPM 2.0 in the BIOS covers the common menus. If BitLocker is already on, suspend it first.
- Legacy BIOS on an MBR disk. PCs that were imaged or cloned years ago often still boot in Legacy mode, which means no Secure Boot. Microsoft’s built-in
mbr2gpt /validate /allowFullOStells you whether the disk can be converted in place;mbr2gpt /convert /allowFullOSdoes it, and you then switch the firmware to UEFI and enable Secure Boot. Done in the wrong order, the PC won’t boot — which is why we image the drive before touching it.
The one we see more than any other on the bench is a machine that passes the checks but still has a spinning hard drive. Windows 11 will install on it and then be miserable to use. Swapping to an SSD (and usually going to 16 GB of RAM) during the upgrade visit is one of the most worthwhile hardware upgrades an office can make, and it’s cleaner to do before the upgrade than after.
4. Pile Three: Unsupported Processor — Plan the Retirement
If the only red mark is the processor — typically Intel 7th generation or older, or first-generation AMD Ryzen — there is no setting to change. You will find registry tweaks online that force Windows 11 onto unsupported CPUs. For a home gaming PC, some people accept that trade. For a business PC holding client data, we don’t do it: Microsoft states unsupported installs aren’t entitled to updates, and the whole point of this exercise is getting back onto a guaranteed patch stream.
These machines are candidates for replacement, and the replacement is easier than people fear: we can move the user profile, email, browser data and installed-software list onto the new PC so staff sit down to something familiar. The old drive then needs wiping properly before the PC leaves the building — our data-safe guide to retiring old office PCs covers what “properly” means for a business.
A Typical Marchmont Office, Start to Finish
To make that concrete, here’s a representative job from this autumn, anonymised: a four-desk property office in a Marchmont ground-floor unit, all four PCs on Windows 10 with consumer ESU. Two passed outright and went across overnight. The third failed on TPM and Secure Boot — it had been cloned from an older machine in 2019 and was still booting Legacy. An image, an mbr2gpt conversion, two firmware toggles and an SSD later, it upgraded cleanly. The fourth had a 6th-generation i5 and was replaced.
The only real snag was on the second “easy” PC: the upgrade rolled back with error 0xC1900101, which almost always points at a driver. Microsoft’s SetupDiag tool named the culprit — an old receipt-printer driver from a till that had long since left the office. Removing it let the upgrade complete first time. That’s the judgement call a checklist won’t make for you: when an upgrade fails, read the log before reinstalling anything. A clean install is sometimes the right answer, and it’s one we’re happy to do as part of an OS installation, but it should be a decision, not a reflex.
The logistics mattered too. Daytime parking around the Marchmont streets makes a long on-site day awkward for a small office, so we did the checks and backups on one short visit, collected the two machines needing work at close of business and had them back on desks before opening. Nobody lost a day at their desk. If a laptop in the mix has other faults — a tired battery, a failing keyboard — it makes sense to fold it into the same trip through our laptop repair service in Marchmont.
What to Do This Week
- Run PC Health Check,
tpm.mscandmsinfo32on every Windows 10 PC and sort them into the three piles. - Back up every machine to an external drive, then disconnect it.
- List the software each PC must run afterwards (accounts, practice management, printer and scanner drivers) and check the vendor supports it on Windows 11.
- Upgrade pile one now; book pile two in next; plan the replacements for pile three well ahead of October 2027 rather than in its last month.
If you’re a home user rather than a business, our general Windows 10 end-of-support guide covers the options in plainer terms. For offices across Marchmont, Tollcross, Morningside and the rest of south Edinburgh, we’re happy to do the triage for you and give you a written list of which PC goes where before any work starts.
Last updated: 10 October 2026