When your operating system reaches end of life.

Microsoft and Apple stop patching old operating systems on a published schedule. After that date, new security holes stay open on every machine still running that version, and cyber insurers and the Privacy Act treat it as a control failure. The dates and the upgrade steps are below.

What stops

Three things stop on the date.

Microsoft and Apple publish the date for each version, and the same three things stop on it.

Security patches
New vulnerabilities are no longer fixed, so anything found after that date stays exploitable on every machine still running that version. Ransomware groups scan for those versions specifically.
Bug fixes
Crashes, driver problems and compatibility breaks with newer hardware or software stay unfixed.
Vendor support
You cannot open a support case with Microsoft or Apple for that version. Software vendors drop it from their supported list soon after, and new releases of practice software refuse to install on it.
The dates

Where the deadlines fall.

Microsoft publishes fixed end-of-support dates per version. Apple supports the current and two prior major macOS versions, with security updates rolling forward as new versions ship.

Operating system
End of support
Status today
What it means
Windows 10
All editions including Pro, Enterprise.
14 October 2025
Past
Unpatched. Plan migration now.
Windows 11
Current consumer and business OS.
14 October 2031
Supported
Current target for fleet upgrades.
Windows Server 2016
Standard / Datacenter.
12 January 2027
Supported
Plan replacement or cloud migration this year.
Windows Server 2019
Standard / Datacenter.
9 January 2029
Supported
Comfortable runway, but not indefinite.
Windows Server 2022
Standard / Datacenter.
14 October 2031
Supported
Solid for existing workloads. Many fleets will skip to 2025.
Windows Server 2025
Latest Windows Server release.
10 October 2034
Current
Target for new server deployments.
macOS
Apple supports current + two prior majors.
Rolling
Per version
Stay within two majors of current.
Compatibility bypasses

A compatibility bypass installs Windows 11 unsupported.

Tools like Rufus, registry workarounds and modified install media will put Windows 11 on hardware that fails Microsoft's compatibility check. We do not do this for clients, for the three reasons below.

Updates may stop
Microsoft's disclaimer during a bypass install states that machines installed outside the supported configuration are not entitled to updates, including security updates. The upgrade then delivers none of the patching it was done for.
The missing hardware is part of the security
TPM 2.0, Secure Boot and modern CPU features underpin virtualisation-based security and credential isolation, and a bypassed install runs without them. The requirements also rise with each release: Windows 11 24H2 added a CPU instruction-set requirement (SSE4.2, POPCNT) that older bypass-installed machines fail, so those machines cannot move past 23H2.
Insurers and vendors treat it as unsupported
Microsoft can refuse to assist on unsupported configurations, and many third-party vendors follow suit. Cyber insurance reviews and Privacy Act compliance treat a bypassed install the same as no upgrade at all.
Inventory first

Start with a list of every machine and its version.

Tag every workstation, laptop and server by OS version, edition and patch level.

The list usually turns up machines nobody had counted, and those are the ones an upgrade plan misses.

Check hardware compatibility

Not every Windows 10 machine can run Windows 11.

Windows 11 requires TPM 2.0, UEFI with Secure Boot, an 8th-generation Intel CPU (or newer AMD equivalent), 64 GB of storage, and 4 GB of RAM as minimums.

Devices that miss the bar need replacing rather than upgrading in place. We run the compatibility check as part of every Evaluation.

Stage the rollout

Pilot with a small group, then expand.

Migrate a small group of users first, enough to flush out line-of-business compatibility issues without putting the whole office at risk.

Once the pilot is stable, roll out by team or floor in stages over a quarter. We do the planning, the imaging, and the after-hours cutover.

Timing

Allow eighteen months for a fleet upgrade.

Hardware lead times lengthen in the months before a Microsoft end-of-support date because demand peaks then.

Cyber insurance renewals can exclude unsupported operating systems, and the Privacy Act and industry compliance regimes treat them as a control failure.

Browsers go stale too

Browsers reach end of support too.

Chrome, Edge, Firefox and Safari update themselves by default. The problems arise when something stops the updater, or when the operating system is too old for the current browser version.

Auto-update gets disabled
Group Policy, MDM profiles or an administrator can block the silent updater, and this is the usual cause of an outdated browser in a business. The fix is in the policy, by whoever manages the fleet.
Old OS, old browser
Once an operating system drops off vendor support, browsers stop supporting it soon after. Chrome 110 was the last release that ran on Windows 7 and 8.1, so a machine on either is also on a browser with no security fixes since early 2023.
Defunct browsers still in production
Internet Explorer reached end of support on 15 June 2022 and Edge Legacy on 9 March 2021. Any application still pinned to either runs on an engine with no security fixes since then, and the replacement is a job for whoever owns that application.

Plan the upgrade before the date.

We check hardware compatibility as part of every IT review.