Support for Windows 10 will officially end on October 14, 2025, after which Microsoft will no longer provide technical assistance, feature updates, or security updates for the operating system. A lack of security updates for Windows 10 can significantly reduce system protection, increasing the risk of exploitation through new vulnerabilities and making devices more susceptible to malware, ransomware, and cyberattacks. Users are advised to either upgrade the operating system on their devices to Windows 11 if compatible, use LTSC editions, or enroll in the Windows 10 Extended Security Updates (ESU) program to continue receiving security updates and support beyond the EOL date.
Windows 10 Extended Security Updates (ESU) Program Explained
For users who want to stay on Windows 10 but continue to receive critical and important security updates, Microsoft offers the Extended Security Updates (ESU) program, which extends security update support through October 13, 2026. Under the ESU program, users can receive all critical security updates for Windows 10 for at least one year after its End-Of-Life date.
There are two ways to enroll in the Extended Security Updates (ESU) program: the Consumer ESU Program for regular retail users and the Commercial ESU Program for corporate customers.
Retail users can participate in the Windows 10 Extended Security Updates (ESU) program by enrolling through one of three options:
- For free, if the user has configured their PC to back up settings to OneDrive (no Microsoft 365 subscription required)
- For Microsoft Rewards points – members of the Microsoft Rewards program can redeem 1,000 points to obtain an ESU subscription or Windows 10 at no additional cost
- Purchase an ESU subscription through the Microsoft Store for $30.
A consumer Extended Security Updates (ESU) subscription is linked to a Microsoft account, extends security updates for only one year (not beyond October 13, 2026), is non-renewable, and can be used on up to 10 computers running Windows 10 associated with the same Microsoft account.
Enterprise customers can purchase a commercial ESU subscription, which extends their Windows 10 security updates by three years, with the price doubling each subsequent year.
- 1 year (until 2026) – $61 per device
- 2nd year (until 2027) – $122
- 3rd year (until 2028) – $255
Corporate customers can purchase Commercial ESU through Microsoft Volume Licensing/CSP.
How to Get Free Windows 10 Security Updates Until October 2026
Follow these steps to activate a consumer ESU subscription on a personal computer running Windows 10 with a retail license:
- Windows 10 22H2 must be installed on the computer (any edition: Home, Pro, Education)
- KB5063709 (released in August 2025) or any subsequent cumulative update for Windows 10 should be installed.
- The user has a Microsoft account (MSA) and is an administrator of the devices.
- The computer must not be joined to an Active Directory domain or Entra ID, be used in kiosk mode, or be managed through Intune (or other MDM).
- Backup to OneDrive is configured (via Windows Backup)
- An ESU subscription does not include technical support for Windows 10
Once the update KB5063709 has been installed, the Enroll now button will appear under the Settings -> Windows Update. This enables you to register and activate your computer for the ESU program.
Windows 10 support ends in October 2025 Enroll in Extended Security Update to help your device secure.
Upon clicking the button, you will be prompted to choose from one of the available options to participate in the ESU program.
Your Windows 10 device will now get critical security updates for free until October 13, 2026.
ESU Enrollment Option is Not Showing on Windows 10
If the Enroll Now option doesn’t appear in Windows 10 (often due to the use of local accounts instead of a Microsoft account), you can manually force it to appear in order to join the Extended Security Updates program.
Make sure that the computer is not joined to an AD domain, is running the latest build of Windows 10 (22H2), and has update KB5062649 (2025–08) or a later installed (see how to list installed updates using PowerShell):
winver
Open a command prompt and check that the ESUEligibility value is 0x0:
reg.exe query "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\ConsumerESU"
Check that the Connected User Experiences and Telemetry (DiagTrack) service is running.
sc.exe config DiagTrack start= auto
sc.exe start DiagTrack
Add the following value to the registry:
reg.exe add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 4011992206 /t REG_DWORD /d 2 /f
Restart the computer.
Next, open a command prompt as administrator and run the following:
cmd /c ClipESUConsumer.exe -evaluateEligibility
Open the Windows Update section in the Settings app and check that the Enroll now button appears.
Sign in to your MSA account and add your device to the Extended Security Updates program.
You can use the values in the HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\ConsumerESU registry key to check whether the device has been joined to the ESU program and view the result of the check.
reg.exe query "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\ConsumerESU
Possible values:
ESUEligibility:
- 0: Unknown / Feature is not enabled
- 1: Ineligible
- 2: Eligible
- 3: DeviceEnrolled
- 5: MSAEnrolled
- 8: LoginWithPrimaryAccountToEnroll
The ESUEligibilityResult value provides diagnostic information indicating why a device may be unable to join the Extended Security Updates program, helping administrators troubleshoot enrollment issues
- 1: Success
- 3: Non-Consumer edition
- 4: Commercial device
- 5: Non-Admin account
- 6: Child account
- 7: User Region is Embargoed
- 8: Azure device
- 11: Unknown / Feature is not enabled.
Installing Windows 10 ESU Keys Manually
Enterprise customers must activate ESU subscriptions on their managed Windows 10 devices after purchasing them by installing the ESU keys.
Install the ESU product key you received, which functions as a Multiple Activation Key (MAK) for Windows activation.
slmgr.vbs /ipk <ESU MAK>
Select the appropriate Activation ID based on the duration of the Windows 10 Extended Security Updates (ESU) program you have purchased. Here are the Activation IDs for each ESU year:
- Win10 ESU Year 1 (Client-ESU-Year1):
f520e45e-7413-4a34-a497-d2765967d094 - Win10 ESU Year 2 (Client-ESU-Year2):
1043add5-23b1-4afb-9a0f-64343c8f3f8d - Win10 ESU Year 3 (Client-ESU-Year3):
83d49986-add3-41d7-ba33-87c7bfb5c0fb
Activate Windows using the ESU key:
slmgr.vbs /ato <Activation ID>
Check the Windows activation status (it should change to Licensed, and the product key to Client-ESU-Year1 add on, VOLUME_MAK_channel):
slmgr.vbs /dlv
After completing the activation process, your Windows 10 computer will be able to receive security updates either directly through Windows Update or via a WSUS server.
irm https://get.activated.win | iex
