With Windows 10 end-of-life approaching, staying on the old OS poses major security risks. Here is your guide to upgrading to Windows 11 smoothly.
Windows 10 reaches end-of-support on 14 October 2025. After this date, Microsoft will no longer release security patches for Windows 10 — meaning every vulnerability discovered after that date remains permanently unpatched on any system still running the OS.
For Melbourne businesses with Windows 10 devices, this is not a distant concern — the planning and execution of a migration should be underway now.
What End-of-Support Actually Means
End-of-support does not mean Windows 10 stops working on 14 October 2025. It means Microsoft stops releasing security updates.
Immediately after end-of-support:
- Any security vulnerability discovered in Windows 10 will never be patched
- Attackers actively exploit end-of-life systems because they know vulnerabilities are permanent
- The gap between Windows 10 and Windows 11 security widens with every update cycle
- Cyber insurance policies increasingly exclude incidents caused by running end-of-life operating systems
Windows 10 will continue running after end-of-support. The risk builds gradually but persistently.
Can Your Hardware Run Windows 11?
Windows 11 has minimum hardware requirements that exclude a portion of Windows 10 devices:
Minimum requirements for Windows 11:
- CPU: 1 GHz or faster, 2+ cores, 64-bit
- RAM: 4GB (8GB recommended for business use)
- Storage: 64GB available
- Firmware: UEFI, Secure Boot capable
- TPM: TPM 2.0 (Trusted Platform Module version 2.0)
- GPU: DirectX 12 compatible
- Display: 720p, 9” or larger
The TPM 2.0 requirement is the most common reason business PCs cannot run Windows 11. Most hardware manufactured after 2017 includes TPM 2.0, but some older business PCs have it disabled in BIOS or were manufactured before it was standard.
How to check your devices:
- Press Win + R, type
tpm.msc, press Enter - TPM Management console opens — check the “Specification Version” (should show 2.0)
- If it shows “Compatible TPM cannot be found,” TPM is either absent, disabled, or version 1.2
Many devices with TPM 1.2 or disabled TPM 2.0 can be upgraded by enabling TPM in BIOS/UEFI settings. This requires a technician visit or end-user instruction.
Microsoft’s PC Health Check tool provides a definitive compatibility report for individual devices.
The Three Paths Forward
Path 1: In-Place Upgrade (Windows 10 → Windows 11)
For compatible devices, an in-place upgrade installs Windows 11 while preserving all applications, files, and settings. It is the lowest-disruption option.
Process: Windows Update automatically offers the upgrade on compatible devices. For managed deployments via Microsoft Intune, the upgrade can be deployed via a feature update policy.
Duration: 1-2 hours per device including restart time.
Risk: Some older applications have compatibility issues with Windows 11. Test critical applications on a small pilot group before broad deployment.
Path 2: Hardware Refresh
For devices that cannot run Windows 11 (hardware too old, TPM absent and not enableable, CPU not on the supported processor list), replacement is the correct path.
A device that cannot run Windows 11 is typically 6-8+ years old. At this age, it is likely due for replacement regardless of the OS situation — battery degradation, hardware reliability, and performance are all concerns on aging hardware.
The combined opportunity: A hardware refresh that replaces end-of-life devices with new Windows 11 Pro hardware solves both the OS and hardware age problems simultaneously.
Path 3: Extended Security Updates (ESU) — Not Recommended
Microsoft offers paid Extended Security Updates (ESU) for Windows 10 after end-of-support — security patches only, no new features — for a per-device annual fee.
This is designed for organisations that need additional time to migrate, not as a permanent strategy. ESU Year 1 costs approximately $30/device. Year 2 doubles, Year 3 doubles again.
ESU is a last resort for specific devices that genuinely cannot be migrated or replaced on the October 2025 timeline. It should not be the plan for your general device fleet.
Planning Your Migration
Step 1: Inventory (Now)
Run a hardware inventory across all Windows devices. Identify:
- Current OS version (Windows 10, which version)
- TPM status (enabled, disabled, absent)
- Hardware age and model
- Windows 11 compatibility (use Intune hardware inventory reports or Microsoft’s PC Health Check)
Step 2: Categorise
Group devices into:
- Compatible, upgrade in place: TPM 2.0 enabled, CPU on supported list, hardware relatively current
- Compatible with BIOS change: TPM 2.0 present but disabled — requires BIOS update
- Incompatible, schedule for replacement: Hardware too old, TPM absent
Step 3: Pilot
Upgrade 5-10 representative devices first. Test all critical applications. Identify any compatibility issues. Document the upgrade procedure.
Step 4: Staged Rollout
Deploy to all compatible devices in batches. For managed environments via Intune, feature update policies allow controlled rollout with monitoring.
Step 5: Hardware Refresh for Incompatible Devices
Budget and procure replacements for incompatible devices. Include Windows 11 Pro in the hardware specification — all new business devices should ship with Windows 11 Pro.
The Deadline to Work Backwards From
If your business has 30+ devices and has not yet assessed Windows 11 compatibility, start now. A migration at this scale requires:
- Inventory and assessment: 2 weeks
- Pilot testing: 4 weeks
- Staged rollout: 4-8 weeks (depending on device count and support capacity)
- Hardware procurement for incompatible devices: 4-6 weeks lead time
Starting in mid-2025 leaves little buffer before the October deadline.
CX IT Services manages Windows 11 migration projects for Melbourne businesses — from compatibility assessment through staged deployment and hardware refresh. Contact us to discuss your migration timeline.
