NewApp Digest
search bot

Extended Security Updates

Windows 11 tops market share as 10 faces extended farewell
Winsage
March 2, 2026

Windows 11 tops market share as 10 faces extended farewell

Recent data from Statcounter indicates that Windows 11 has a market share of 72.57 percent, while Windows 10 holds 26.45 percent. Microsoft claims that Windows 11 has surpassed one billion users. Statcounter's data is collected from over 1.5 million websites and may be subject to revision. Microsoft will discontinue support for many versions of Windows 10 in October 2025, leading some organizations to consider Extended Security Updates (ESU), which can incur additional costs. Windows Server 2016 has a 20.3 percent share among monitored servers, and Windows 10 2016 LTSB accounts for 0.5 percent of Windows devices, making up 19.8 percent within the LTSC/LTSB category. The higher usage of LTSC/LTSB is attributed to special-purpose devices in consumer and retail sectors, which face stricter upgrade protocols.
Microsoft gives Windows laggards the 'gift of time' wrapped in licensing fees
Winsage
February 25, 2026

Microsoft gives Windows laggards the ‘gift of time’ wrapped in licensing fees

Microsoft is offering up to three years of Extended Security Updates (ESU) for older Windows installations, with the expectation of compensation. Most major versions of Windows 10 will reach end of support by 2025, while Windows 10 Enterprise 2016 LTSB and Windows IoT Enterprise LTSB 2016 will end support on October 13, 2026, and Windows Server 2016 will conclude support on January 12, 2027. Microsoft recommends upgrading to Windows Server 2025 for Windows Server 2016 users. The pricing for ESU for Windows 10 2016 LTSB starts at a specified amount per device for the first year, with expected increases in subsequent years. Customers using Intune or Windows Autopatch may receive a reduced rate. There is no official pricing for Windows Server 2016 ESU, creating uncertainty for administrators. Historically, Microsoft has charged a premium for extended support, with previous ESU costs for Windows Server 2012 being 100 percent of the full license price for the first year. The final cost of ESU will depend on each organization’s licensing agreement.
Support for Windows Server 2016 is coming to an end
Winsage
February 24, 2026

Support for Windows Server 2016 is coming to an end

Microsoft has announced the end of support for several Windows products launched in 2016, including Windows Server 2016, Windows 10 Enterprise 2016 LTSB, and Windows IoT Enterprise LTSB 2016. Windows Server 2016 has been in the extended support phase since January 2022, with security updates available until January 12, 2027. Windows 10 Enterprise 2016 LTSB and Windows IoT Enterprise LTSB 2016 will reach the end of their extended support on October 13, 2026. Microsoft offers the Extended Security Updates (ESU) program for these products, allowing critical security updates for a fee, with costs for Windows 10 Enterprise 2016 LTSB set to increase annually per device. ESU will also be available for Windows Server 2016, but pricing details are not yet released. Windows IoT Enterprise LTSB 2016 will receive extended support through hardware manufacturers, with terms and costs varying by supplier. Microsoft emphasizes that using unsupported software increases risks and that migrating to a newer version of Windows is the only long-term solution.
Microsoft Refreshes Secure Boot Root of Trust Certificates
Winsage
February 13, 2026

Microsoft Refreshes Secure Boot Root of Trust Certificates

Microsoft is refreshing Secure Boot certificates across its Windows ecosystem ahead of their expiration in June 2026 to enhance firmware-level security. Most systems will automatically receive the new certificates via Windows Update, while older or specialized devices may require firmware updates from the original equipment manufacturer (OEM). Devices that do not receive the update will still boot but will gradually lose access to critical boot-level mitigations and future compatibility improvements. The deployment of the new certificates has started with regular monthly Windows updates and applies to home users, businesses, and educational institutions. Organizations can manage updates independently using tools like Group Policy. Many devices produced since 2024 and nearly all systems shipped in 2025 already have the updated certificates. If systems are not updated, they will continue to function but will enter a degraded security state, unable to adopt new Secure Boot mitigations. This could increase exposure to threats and lead to compatibility issues with newer operating systems and software. IT administrators should ensure that Windows Update is deploying the latest updates and that device firmware is current, especially for older hardware or specialized systems.
Microsoft Introduces New Secure Boot Certificates Before June Deadline
Winsage
February 13, 2026

Microsoft Introduces New Secure Boot Certificates Before June Deadline

The foundational security certificates supporting Windows Secure Boot, introduced in 2011, will expire in mid-2026, specifically in June and October. Microsoft and PC manufacturers are updating the Windows ecosystem to address this. Devices that do not receive updated certificates may face security limitations and compatibility issues with newer operating systems and hardware. The transition is described as a "generational refresh" of the trust infrastructure for Windows. Systems failing to update will still function but may enter a "degraded security state," unable to install new security mitigations or newer operating systems. Most users will receive updates automatically through Windows Update, while older systems may require manual intervention. Systems at risk include those running unsupported Windows versions, with Secure Boot disabled, or not enrolled in Extended Security Updates. Users should check their Secure Boot status using PowerShell commands to ensure they are using the new certificates. The update affects not only Windows PCs but also other devices utilizing UEFI Secure Boot.
Microsoft's latest update patches six zero-days and two critical flaws - but is it another buggy mess?
Winsage
February 12, 2026

Microsoft’s latest update patches six zero-days and two critical flaws – but is it another buggy mess?

Microsoft's February Patch Tuesday update addresses feature and security bugs, continuing the refresh of Secure Boot certificates to protect against bootkit malware. Secure Boot prevents malicious software from executing during startup by using trusted certificates, many of which are set to expire in June. The update is available for both Windows 11 and Windows 10 users, with the latter needing to be enrolled in the Extended Security Updates (ESU) program until October 2026. Windows 11 fixes include resolutions for full-screen gaming and WPA3-Personal Wi-Fi connectivity issues, while Windows 10 improvements address Chinese fonts, specific graphics processing units, and custom folder names in File Explorer. A bug causing unexpected restarts in Secure Launch-compatible PCs has also been fixed. The update includes 55 security patches, a decrease from January's 114, with two classified as critical and six identified as zero-day vulnerabilities. One vulnerability exploited in the wild could allow system privilege escalation, another could disrupt network connectivity, and a third could disable security controls and access sensitive data. Users can update their Windows 11 PCs through System > Windows Update, and Windows 10 users through System > Update & Security. Due to previous buggy updates, users may consider waiting a few days before installing the February update, with the option to uninstall if issues arise.
Refreshing the root of trust: industry collaboration on Secure Boot certificate updates
Winsage
February 11, 2026

Refreshing the root of trust: industry collaboration on Secure Boot certificate updates

Secure Boot is a security feature in Windows and Windows Server that protects devices from untrusted software at startup. It has been in operation since 2011 and relies on certificates embedded in a PC’s firmware. The original Secure Boot certificates will begin to expire in late June 2026. New certificates are being rolled out through regular Windows updates for supported devices, with OEMs preparing new devices with updated certificates since 2024. If devices do not receive the new certificates before the expiration of the old ones, they will continue to function but will enter a degraded security state, limiting future protections. Users generally do not need to take action, as updates will be installed automatically, but some specialized systems may require separate firmware updates. Organizations can monitor the update status through the Windows Security App and should ensure devices are running the latest updates and firmware. Support is available for individuals and organizations facing issues during the update process.
Microsoft is keeping Secure Boot alive with Windows updates
Winsage
February 10, 2026

Microsoft is keeping Secure Boot alive with Windows updates

Microsoft is enhancing the security of Windows devices by replacing boot-level security certificates that are nearing expiration, with this initiative integrated into regular Windows platform updates. The original Secure Boot certificates from 2011 will expire between June and October 2026, prompting Microsoft to issue new certificates in 2023, which are included in many new Windows devices sold since 2024. Older hardware will require updates to remain compliant. Devices with expired certificates will continue to operate but will enter a "degraded security state," potentially hindering future updates and causing compatibility issues. The new Secure Boot certificates rollout began with the Windows 11 KB5074109 update. Most Windows 11 users will have the new certificates installed automatically, while specialized systems may have different update protocols. Windows 10 users must enroll in Microsoft’s Extended Security Updates to receive the new certificates.
Search