A Windows 10 Exception Runs Out at October’s Patch Tuesday
For most Windows 10 users, the support deadline passed last year. The 2016 long-serving branch kept receiving regular security updates. That exception is nearly over: Microsoft says Windows 10 Enterprise LTSB 2016 and Windows 10 IoT Enterprise LTSB 2016 will receive their final regular monthly update on 13 October 2026. After that date, devices on those releases need an eligible paid Extended Security Updates (ESU) enrolment to keep receiving the covered security fixes. Microsoft’s Windows update notice and IoT release history both identify the October deadline.
This is a deployment decision, not a fresh policy announcement. Microsoft’s 30-day notice was published on 14 September. The value now is in finding the precise edition on each device, testing a supported migration or proving that ESU activation and update delivery work before the last regular patch arrives.
The edition matters more than the Windows 10 name
The affected 2016 LTSB releases correspond to Windows 10 version 1607, build family 14393. Microsoft now often calls the branch LTSC 2016 because it renamed the Long-Term Servicing Branch to the Long-Term Servicing Channel. The Enterprise release overview explains that naming change. The Enterprise and IoT Enterprise entries in BlackTree Lifecycle track the two 2016 deadlines separately; they are automatically verified source discoveries, so Microsoft’s edition-specific documentation remains the authority for deployment decisions.
That distinction prevents two expensive mistakes. The ordinary Windows 10 version 22H2 release passed its support date in October 2025, as BlackTree’s earlier guide explains. Other long-term releases have different dates: Microsoft’s Windows 10 release table lists Enterprise LTSC 2019 through January 2029, Enterprise LTSC 2021 through January 2027, and IoT Enterprise LTSC 2021 through January 2032. A device labelled simply “Windows 10 LTSC” has not been identified well enough to make a support decision.
The IoT branch raises a particular operational problem. Microsoft describes Windows IoT Enterprise as a platform for fixed-purpose devices in banking, healthcare, hospitality, manufacturing and retail. These machines may be tied to a particular peripheral, application image or supplier maintenance contract. A functioning device can therefore remain in service long after the team that procured it has moved on. That is a reason to establish ownership and a tested replacement path now, not evidence that every such device is exposed or cannot be upgraded. Microsoft’s IoT release history sets out the product scope.
ESU buys time only after it is activated
Microsoft’s 2016 LTSB ESU instructions cover both Enterprise and IoT Enterprise. The programme is a paid subscription for critical and important security updates on enrolled devices. It does not provide a new feature branch or turn an old deployment into a normal, fully supported release.
For either 2016 edition, Microsoft requires the September 2026 servicing stack update, KB5122874, and September security update, KB5123099, or later updates, plus administrative access. After purchase, Enterprise customers retrieve a Multiple Activation Key from the Microsoft 365 admin centre; Microsoft directs IoT customers to their OEM partner for the IoT key. The instructions provide separate activation identifiers for the Enterprise and IoT programmes, and require the resulting licence status to be checked on each device. They also document an offline activation route for systems that cannot contact Microsoft’s activation servers.
Buying the licence is therefore not the finish line. An organisation needs to know whether its update management system has delivered the prerequisite servicing components, whether the correct edition’s key activates and whether a pilot device actually receives the intended updates. The September 2016-branch security release names both affected editions and warns of their impending support end. Microsoft later issued a cumulative out-of-band update for this branch, so administrators should check the latest applicable build rather than treating the September prerequisite as a fixed final patch level.
Decide which devices can move and which need a bridge
For Enterprise LTSB 2016, Microsoft’s September support notice recommends Windows 11 Enterprise LTSC 2024 as the supported destination. For IoT devices, Microsoft lists Windows 11 IoT Enterprise LTSC 2024 as its current long-term release and directs existing-device upgrades through the appropriate OEM or volume-licensing route. That is a migration candidate, not a promise that every 2016 device, driver or fixed-purpose application will accept an in-place upgrade. Microsoft’s IoT guidance makes licensing and release identity part of the decision.
A useful plan separates the fleet into three groups:
- Move now: Confirm the exact edition and build, licence entitlement, application and peripheral compatibility, backup, rollback and the service checks that prove the replacement works.
- Bridge with ESU: Identify the owner and end date of the exception, obtain the correct Enterprise or OEM key, install the prerequisites, activate a representative device and verify its licence and update state before scaling out.
- Cannot move or enrol: Record the unsupported condition explicitly. Reduce network reachability, remove general browsing and email where possible, preserve recoverable images and plan replacement or retirement. These controls can reduce exposure, but they do not restore Microsoft security maintenance.
The deadline is also a procurement test. The cost and availability of a replacement image, supplier approval, a compatible device or an OEM-issued ESU key may take longer to resolve than a software patch. Security teams should bring the asset owner, application owner and purchasing route into the same decision before 13 October.
The operational deadline is 13 October
Microsoft’s standalone Lifecycle product cards for Enterprise LTSB 2016 and IoT Enterprise LTSB 2016 display 14 October as the extended-support end date, while its Windows release health, IoT release history, update notes and ESU instructions identify 13 October as the date of the final regular monthly update. For patch planning, use the latter operational date and verify the edition and entitlement against Microsoft documentation. The date difference should not be read as an extra patch cycle.
The risk of waiting is straightforward. Without a successful migration or eligible ESU activation, the affected 2016 devices will continue to run, but new security issues will no longer have the regular Microsoft fix path they had through October. That consequence is especially hard to manage when a fixed-purpose device has no current owner, no tested image and no agreed replacement window. The next two weeks are the time to find those devices and prove which path each one can take.
Sources
- Microsoft Windows message center, 30-day notice dated 14 September 2026.
- Microsoft Windows 10 IoT Enterprise release history, 2016 and successor release dates and product scope.
- Microsoft ESU activation instructions for 2016 LTSB, last updated 27 August 2026, checked 28 September.
- Microsoft Windows 10 release information, edition and branch-specific servicing dates.
- Microsoft September 2016-branch security update and later out-of-band update.
