Windows 10 end of support: what are your options?

From 14th October 2025, Microsoft will no longer support Windows 10, which means that any updates, technical support or security fixes will end.

While your IT systems won’t shut down overnight, without the safeguards and enhancements provided by regular updates, continuing with Windows 10 after this date comes with serious risks to security, compliance and maintenance.

Planning ahead and preparing ahead of the October deadline can help you avoid these risks and ensure your systems remain secure and efficient. In this blog, Chinwike Onyia, Endpoint Management and Security Lead Architect at Advania, lays out four options for your organisation ahead of Windows 10 end of life in October.

Option one: Cloud Endpoint Assessment

If you’ve invested heavily in physical clients, you might be caught between upgrading and avoiding the excessive costs of replacing out-of-warranty devices. One option might be virtual desktop solutions such as Windows 365 and Azure Virtual Desktop (AVD).

At Advania, we can set up a quick yet comprehensive Cloud Endpoint Assessment Workshop to help you discover if this is the right approach for you.

Our experts will set up a proof of concept to help you analyse your workloads on both AVD and Windows 365. This will enable you to make an informed decision, and we’ll help you in scaling the solution for production.

Option two: system centre configuration manager (SCCM) to Intune approach

Over the past couple of months, I have engaged with many businesses concerning their cloud strategy, focusing on transitioning their Windows 10 on-premises workloads from AD domain join or Entra Hybrid to Windows 11 Entra joined only.

A recurring concern among most businesses is: “we don’t know what will break if we move to Entra only and we don’t have the time.” The predominant issues include the complexity of GPOs, VPN authentication and legacy applications.

Some clients using SCCM have inquired whether they could deploy a new Windows 11 image and revisit the transition to the cloud at a later stage.

Our approach is straightforward, anchored in understanding your cloud adoption strategy and commitment. We can assist SCCM clients in transitioning to Intune through quick and simple steps:

1. Conduct a Windows 11 readiness assessment and classify Windows 11 ready devices into a collection
2. Configure Co-management and migrate all workloads to Intune
3. Create and deploy feature update to roll out Windows 11 24H2
4. Establish a pilot group to test and complete a detailed UAT
5. Deploy Windows 11 across the business

Next is phase two:

1. Conduct an application assessment and package required apps in Intune
2. Complete GPO assessment and replicate only necessary GPOs using the settings catalogue. Deploy Advania device security baseline.
3. Configure cloud Kerberos trust to address any Kerberos authentication requirements.
4. Ensure pre-requisites such as Entra Connect configuration and sync to Entra are met.
5. Fresh start a set of pilot devices and tag them to re-enrol to Entra join only. Users will receive net new devices with Windows 11 and Entra join. Complete a detailed UAT
6. Fresh start the rest of the Windows 11 devices to ensure best performance.

Option three: Azure Virtual Desktop (single and multi-session) and Windows 365

Some businesses have expressed concern about upgrading their current Windows 10 AVD sessions to Windows 11 and questioned the deployment of new images and Hostpools instead of an in-place upgrade.

Unfortunately, there is currently no in-place upgrade approach for Azure VMs, though this may change in the future.

Some users have tried switching from Gen 1 VMs to Gen 2 by enabling trusted launch (why still on Gen1?) and following the long process. However, this method does not provide an in-place upgrade. In lab settings, this approach led to profile issues, black screens, and application crashes, and remains unsupported.

Here’s our approach to upgrading clients on AVD to Windows 11:

1. The Windows 10 image will only contain baseline applications. Deploy a new Windows 11 24H2 Enterprise Multisession with Microsoft 365 Apps for multisession desktops or Windows 11 Enterprise for single-session desktops from the Azure Marketplace.
2. Install, optimise, and capture the agreed baseline apps. Package remaining apps in Intune and deploy directly to the hostpool.
3. Complete User Acceptance Testing (UAT) and obtain sign-off.
4. Deploy Windows 11 hostpools with required policies and security baselines.
5. Migrate users from Windows 10 to the Windows 11 hostpools.
6. Decommission and clean up any Windows 10 related Azure resources.

We take similar approach to Windows 365 (Cloud PC) as well. The difference with Windows 365 is the applications are most likely already packaged in Intune and provisioning a new Windows 11 using the provisioning policy in Cloud PC is really quick:

1. Create a new provisioning policy that include Windows 11 Enterprise with M365 Apps
2. Assign the Cloud PC to a user
3. Assign the Cloud PC device group to your packaged applications in Intune to download and Install any LOB
4. Complete User Acceptance Testing
5. Move to production

This is a project our experts can quickly turn around for your organisation so you can be prepared before the October deadline.

Option four: on-premises upgrade

Our final option in the Windows 10 to Windows 11 migration series caters to clients who utilise System Centre Configuration Manager (SCCM) for device management or rely on traditional domain join devices with group policies due to a lack of device management solutions.

Upgrade via SCCM

Upgrading from Windows 10 to Windows 11 using SCCM can be performed through various methods, with the most common being the Upgrade Task Sequence. What are the steps you need to take?

1. Synchronise your SCCM server with the latest Windows 11 upgrade packages and drivers, including necessary install media and drivers
2. Create or identify the device collection targeting the Windows 11 upgrade
3. Add Windows 11 Upgrade Package to SCCM
4. Download the Windows 11 ISO from the Microsoft Volume Licensing Service Centre (VLSC) or use the official Windows 11 media creation tool
5. Import the Windows 11 ISO into SCCM
6. Create a Task Sequence:
   1. navigate to Software Library > Operating Systems > Task Sequences in SCCM.
   2. Right-click on Task Sequences and select Create Task Sequence.
   3. Choose the option to upgrade an operating system or a similar option based on your SCCM version.
   4. Select the imported Windows 11 image and the Windows 10 operating system you want to upgrade from (ensure a valid upgrade path).
7. Distribute Content
8. Deploy the Task Sequence
9. Monitor the Upgrade Process

Upgrade Via Group Policy

Upgrading from Windows 10 to Windows 11 using Group Policy (GPO) involves configuring settings to enable the upgrade across a domain. While there isn’t a direct method to push an upgrade solely via Group Policy, you can manage it through the following steps using Windows Update settings, WSUS (Windows Server Update Services), or other deployment methods.

Here are the steps you need to follow:

1. Open the Group Policy Management Console (GPMC) on a machine running the tool in Active Directory
2. Select the Organisation unit with Windows 10 devices – ensure you have created a pilot device OU
3. Right click and select create group policy, then give the policy an appropriate name, right click and edit the policy
4. Navigate to Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Update
5. Enable or Configure Windows Update for Business
6. Locate the policy setting named “Select when Preview Builds and Feature Updates are received” or “Configure Automatic Updates” to schedule feature updates like the upgrade to Windows 11
7. Configure it to automatically allow Feature Updates based on the deployment ring schedule, usually set for a gradual rollout
8. Enable the “Target Release Version” setting and specify Windows 11
9. Enable “Enable featured updates” and ensure Windows 11 is selected as the feature update version
10. Navigate to Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Update for Business
11. Enable “Enable Windows Update for Business” and configure the deployment settings as needed, such as setting deferrals and specifying the version of Windows 11
12. Complete pilot testing, ensuring apps, user experience not impacted
13. Link the policy to your production devices OU and monitor roll out