How are you planning to handle the upcoming end of support for Windows 10 as a long-term platform?

23 Tem 23:55

The official end of regular support for Windows 10 doesn't mean all devices will become unusable overnight. Microsoft offers the LTSC (Long-Term Servicing Channel) variant for Enterprise editions, which receives feature updates only every 2–3 years but gets long-term security updates. For businesses prioritizing stability over new features, this is the most common strategy, as it minimizes untested changes. In a mixed environment, the best way to implement this is through a centralized update management tool (WSUS, SCCM, or Intune). Here, you can block feature updates and only allow monthly security patches. For the last three years after official support ends, you can enable paid Extended Security Updates (ESU)—especially useful if critical applications still rely on unchanged systems. Alternatively, critical devices can be migrated to a VM running a supported version (e.g., Windows 11 Enterprise), while the physical hardware continues running Windows 10 LTSC. For older PCs that still work well but don’t support all new features, a proven approach is to update only core components and disable resource-heavy services (e.g., Cortana, telemetry). Often, keeping graphics drivers and .NET Framework up to date is enough while leaving the rest of the system in LTSC mode. However, if hardware limitations arise (e.g., missing TPM 2.0 for Windows 11), a gradual migration is recommended: first deploy a lightweight OS based on LTS versions (e.g., Windows 10 LTSC 2019), then fully transition to Windows 11 once hardware is upgraded. This way, security is maintained without disrupting daily operations.

24 Tem 01:45

About a year ago, I went through the same situation: On an old HP desktop that still runs reliably but no longer supports all current drivers, Windows 10 LTSC 2019 was the only option to receive security updates without constantly getting new feature updates. To achieve this, I disabled all non-critical options (e.g., telemetry, automatic app updates) via Group Policy and configured the system for the Extended Support period until 2029. This way, I keep receiving essential security patches while the device remains stable and avoids unexpected changes. At the same time, I’ve already planned a gradual migration to Windows 11 for critical workstations: Central images are updated in a virtual test environment, and key applications are checked for compatibility beforehand. For less important PCs, the LTSC image continues to run until the hardware is replaced. My tip: Use the LTSC branch if you need long-term stability, and combine it with targeted feature disabling. At the same time, you should create a clear migration plan for newer devices so that Windows 10’s end of support doesn’t suddenly turn into an emergency.

24 Tem 03:26

I primarily use the LTSC (Long-Term Servicing Channel) version for our older Windows 10 clients. This way, we still receive monthly security updates until 2029 without new feature updates destabilizing the system. Through GPOs, I automatically disable optional feature updates and keep driver and browser versions at a tested level—this significantly reduces unexpected breakages. In comparison, our backend team often uses Linux LTS distributions (e.g., Ubuntu 20.04) in Docker containers, where we can control the entire platform version. For pure server workloads, we prefer migrating to this container environment because security patches can be applied selectively to the required components, and the host OS remains unchanged for longer. However, for desktop clients that still run well hardware-wise, the LTSC version of Windows 10 remains a reliable compromise as long as we strictly control the update policy.

24 Tem 04:22

One approach I often see for Windows 10 environments with longer lifecycles is leveraging the Long-Term Servicing Branch (LTSB/LTSC) in combination with strict Group Policy configurations. This allows only security-relevant updates to be applied while feature updates—potentially destabilizing the system—are deliberately disabled. This minimizes the risk of incompatibilities, especially on older machines that no longer support all current drivers. In parallel, I implement a two-stage patch management process: critical security patches are first deployed immediately via WSUS or Intune, followed by a test patch cycle in a small pilot environment to catch any regressions before rolling updates broadly. For devices where hardware upgrades are unavoidable, a controlled rollout of Windows 11 Pro for Business clients may make sense, while legacy systems continue operating in LTSC mode. Now, what if you rely on critical applications that are officially supported only under Windows 11, but your existing hardware doesn’t meet the upgrade requirements? How would you balance the need for required functionality against the risks of an outdated security stack in this scenario?