Resource

When your operating system reaches end of life.

Software vendors stop patching old operating systems on a fixed schedule. After that date, security holes don't get fixed. For a business, that's the moment your IT goes from supported to exposed. Here's what it means, where the dates fall, and what to do about it.

Plain-English

End of support is a security event.

When Microsoft or Apple reach an operating system's end-of-support date, three things stop, and none of them are negotiable.

- 01
Security patches stop
New vulnerabilities are no longer fixed. Anything found after that date stays exploitable on every machine still running that OS. Ransomware operators specifically target end-of-life environments because they know the holes won't close.
- 02
Bug fixes stop
Crashes, performance regressions, driver issues, compatibility breaks with newer hardware or software, none of those tickets get fixed. The OS is frozen in whatever state it was in on the cut-off day.
- 03
Vendor support stops
You can't open a case with the vendor for that OS. Third-party software vendors progressively drop support too, so line-of-business applications start refusing to install or warning that you're outside what they support.
The dates

Where the deadlines actually fall.

Microsoft publishes fixed end-of-support dates per version. Apple supports the current and two prior major macOS versions, with security updates rolling forward as new versions ship.

Operating system
End of support
Status today
What it means
Windows 10
All editions including Pro, Enterprise.
14 October 2025
Past
Unpatched. Plan migration now.
Windows 11
Current consumer and business OS.
14 October 2031
Supported
Current target for fleet upgrades.
Windows Server 2016
Standard / Datacenter.
12 January 2027
Supported
Plan replacement or cloud migration this year.
Windows Server 2019
Standard / Datacenter.
9 January 2029
Supported
Comfortable runway, but not indefinite.
Windows Server 2022
Standard / Datacenter.
14 October 2031
Supported
Solid for existing workloads. Many fleets will skip to 2025.
Windows Server 2025
Latest Windows Server release.
10 October 2034
Current
Target for new server deployments.
macOS
Apple supports current + two prior majors.
Rolling
Per version
Stay within two majors of current.
The shortcut isn't a fix

A bypass installs the OS, not the support behind it.

Tools like Rufus, registry workarounds, and modified install media will put Windows 11 on hardware that fails Microsoft's compatibility check. The OS boots. The vendor support behind it doesn't come along for the ride. The same risks apply any time you bypass a compatibility check on any operating system, so here's why we steer clients away from it.

- 01
Updates may stop
Microsoft's own disclaimer during a bypass install is unambiguous: machines installed outside the supported configuration are not entitled to receive updates, including security updates. The whole point of upgrading is to keep getting patches. If you don't, you've spent the effort and gained none of the protection.
- 02
The hardware requirements aren't decoration
TPM 2.0, Secure Boot, and modern CPU features underpin protections like virtualisation-based security and credential isolation. A bypass gets you the OS shell, not those defences. The floor also keeps rising: Windows 11 24H2 added a CPU instruction-set requirement (SSE4.2, POPCNT) that older bypass-installed machines fail, so any bypass has a built-in expiry date you don't get to set.
- 03
Support, insurance, and compliance say no
Microsoft can refuse to assist on unsupported configurations, and many third-party vendors follow suit. Cyber insurance reviews and Privacy Act compliance treat an unsupported install the same as no upgrade at all. The hardware is still outside the supported baseline, regardless of what's running on top of it.
01 · Inventory first

You can't plan around what you can't see.

Tag every workstation, laptop, and server by OS version, edition, and patch level.

The exercise usually surfaces a handful of forgotten machines: a meeting-room PC, a reception kiosk, a server in a cupboard nobody opens. Those are the ones an attacker finds first.

02 · Check hardware compatibility

Not every Windows 10 machine can run Windows 11.

Windows 11 requires TPM 2.0, UEFI with Secure Boot, an 8th-generation Intel CPU (or newer AMD equivalent), 64 GB of storage, and 4 GB of RAM as minimums.

Devices that miss the bar need replacement, not an in-place upgrade. We run the compatibility check as part of every Evaluation.

03 · Stage the rollout

Pilot, then expand.

Migrate a small group of users first: enough to flush out line-of-business compatibility issues without putting the whole office at risk.

Once the pilot is stable, roll out by team or floor in stages over a quarter. We do the planning, the imaging, and the after-hours cutover.

04 · Don't leave it to the last fortnight

Last-minute fleet upgrades are expensive and rushed.

Hardware lead times blow out as the deadline approaches and every other business in the country is buying at the same time.

Cyber insurance renewals can refuse to cover unsupported operating systems, and Privacy Act obligations and industry compliance regimes treat them as a control failure. Plan the work with eighteen months on the clock, not eighteen days.

Browsers go stale too

An out-of-date browser is its own attack surface.

Modern browsers (Chrome, Edge, Firefox, Safari) update themselves by default, so most of this problem solves itself. The cases that bite SMBs are when something stops the auto-update from working, or when the underlying OS is too old to keep getting newer browser versions.

- 01
Auto-update gets disabled
Group Policy, MDM profiles, or a well-meaning admin can block the silent updater. Most outdated browsers in business environments are this scenario, not user negligence. The fix sits at the policy layer, not on the user's machine, so the right person to call is whoever manages the fleet.
- 02
Old OS, frozen browser
Once an operating system drops off vendor support, browsers stop following along soon after. Chrome 110 was the last release that ran on Windows 7 and 8.1. A machine stuck on an old OS is also stuck on a frozen browser - the worst of both worlds.
- 03
Defunct browsers still in production
Internet Explorer reached end of support on 15 June 2022 and Edge Legacy on 9 March 2021. Anything still pinned to those for line-of-business apps is running on engines that haven't received a security fix in years. The application owner needs to plan a replacement, not the user.

Don't get caught at end of support

Let's plan your upgrade.