Windows 10 Security Guide: Enroll in ESU Through 2027 and Check Secure Boot Certificates

What ended, and what didn't​

Microsoft's support page is plain about it. After October 14, 2025, Windows 10 PCs keep working, but Microsoft no longer provides:

• Technical support for any issue
• Software updates
• Security updates or fixes

Microsoft says that without those updates, a Windows 10 PC is at greater risk from viruses and malware. That's the difference between a supported and an unsupported operating system. Every month attackers learn about new Windows flaws, and an unenrolled Windows 10 machine gets no fixes for them. PCMag compares it to a tug-of-war where one side has stopped pulling. The comparison works. You don't lose all at once, but you lose a little more each month.

There are other costs over time, and PCMag points them out. New software and new hardware drivers will increasingly target only Windows 11. One example that applies to many readers: Microsoft says Microsoft 365 apps on Windows 10 lost support on October 14, 2025. Microsoft will still ship security updates for Microsoft 365 on Windows 10 until October 10, 2028, but it recommends upgrading to avoid performance and reliability problems.

Summary: Windows 10 still runs, but without ESU it gets no new Windows security fixes. ESU is the main way to stay protected if you're not upgrading yet.

The ESU extension: one more year​

The most useful news here isn't new, but plenty of people still don't know about it. Microsoft quietly extended the consumer program. An editor's note dated June 25, 2026 on Microsoft's blog post says the Windows 10 ESU program for personal use devices is "being provided for an additional year, with coverage now available through Oct. 12, 2027." Microsoft says an ESU license can be used on up to 10 devices on the same Microsoft account, and users who were already enrolled stay covered until the new October 2027 end date automatically.

Microsoft's consumer ESU page backs this up. You can enroll any time until October 12, 2027, and existing enrollments carry over with no action needed. The same page also warns that your device is more exposed for as long as it stays unenrolled. If you've been planning to sign up later, you're unprotected until you do.

What ESU covers is narrow. Microsoft says it delivers only critical and important security updates, as rated by the Microsoft Security Response Center, for Windows 10 version 22H2. You get no other fixes, no new features or improvements, and no technical support. It doesn't make Windows 10 fully supported again. It only adds security patches.

Three ways to enroll​

Microsoft lists three consumer options, and each one gives you coverage through October 12, 2027:

BleepingComputer reports that users in the European Economic Area can get ESU free just by signing in to Windows 10 with a Microsoft account. Microsoft's FAQ also confirms that enrollment options and timing can vary by region.

Business pricing is a separate program​

PCMag says businesses pay $61 per PC, with costs rising for the second and third years. That matches other coverage. The Desk Brief puts commercial ESU at US$61 per device in Year 1 and says Microsoft doubles the price each following year. Prior years are cumulative, Year 2 ends October 12, 2027, and Year 3 ends October 10, 2028. Don't confuse the two programs. The October 2028 date applies to the commercial program. Consumer coverage ends in October 2027.

Step by step: enrolling a Windows 10 PC in ESU​

These steps are based on Microsoft's consumer ESU page and its September 8, 2026 support document for the licensing package.

Before you start, check that:

1. The PC runs Windows 10 version 22H2 in the Home, Pro, Pro Education or Pro for Workstations edition.
2. The latest Windows updates are installed.
3. You'll sign in with a Microsoft account that has administrator rights. Child accounts can't enroll. If you normally use a local account, you'll be asked to sign in with a Microsoft account.
4. The PC isn't in kiosk mode, isn't joined to an Active Directory domain or Microsoft Entra, and isn't enrolled in an MDM solution. Microsoft Entra-registered devices can still use the consumer program.

Then enroll:

1. Open Settings > Update & Security > Windows Update.
2. If the PC qualifies, you'll see an enrollment link. Select Enroll now.
3. Sign in with your Microsoft account if asked. If you already back up your settings, you'll see a prompt to finish enrolling. If you don't, choose between turning on settings backup, redeeming Rewards points or paying the one-time fee.
4. For more PCs on the same license (up to 10), go to the same Windows Update page on each one and choose Enroll now. If you're signed in with the account you used the first time, choose Add device.

If no enrollment link appears: Microsoft says the ESU Licensing Preparation Package, KB5126256, is required. It has to go on after a security update released on or after October 14, 2025, such as KB5066791. Windows Update downloads it automatically once that update is installed. The PC restarts after it installs, and you can also get it from the Microsoft Update Catalog. Microsoft points out that this package doesn't enroll the PC or deliver patches by itself. It only prepares the PC for enrollment, so you still have to finish the steps above.

What success looks like: You can check your status any time in Settings > Update & Security > Windows Update. If you paid, the purchase also shows up in your Microsoft account order history. If anyone on the PC enrolls, every user account on that PC is covered.

Secure Boot certificates: where PCMag goes too far​

PCMag says Microsoft "cut off Secure Boot certificates in June." It also says Windows 10 users who haven't signed up for ESU get "no cert for you!" Some of this is true, and some of it is stated too broadly.

Microsoft's support documentation gives the actual schedule. The Secure Boot certificates issued in 2011 expire on different dates in 2026:

• Microsoft Corporation KEK CA 2011: expires June 24, 2026, replaced by Microsoft Corporation KEK 2K CA 2023
• Microsoft UEFI CA 2011: expires June 27, 2026, replaced by Microsoft UEFI CA 2023 (for third-party boot loaders) and Microsoft Option ROM UEFI CA 2023
• Microsoft Windows Production PCA 2011: expires October 19, 2026, replaced by Windows UEFI CA 2023, which signs the Windows boot loader

That last date has already passed, so this matters now. But PCMag's description of what happens next is more alarming than Microsoft's. Microsoft says devices without the 2023 certificates keep starting and running normally, and standard Windows updates still install. What those devices lose is new early-boot protection: updates to Windows Boot Manager, the Secure Boot databases and revocation lists, plus fixes for newly found boot-level flaws. Microsoft adds that over time this can affect things that depend on Secure Boot trust, such as BitLocker hardening and third-party boot loaders.

Microsoft's certificate documentation lists Windows 10 version 22H2 among the affected versions. It describes the replacement certificates as arriving through Windows Update, with some PCs also needing a firmware update from the manufacturer. The evidence we checked doesn't confirm PCMag's flat claim that every non-ESU Windows 10 PC gets no new certificates. Either way, the practical takeaway is the same: an unenrolled Windows 10 PC gets no Windows fixes at all, so its boot security will fall behind over time.

Check your PC's Secure Boot status​

You don't need to guess. Microsoft added a status display starting in April 2026:

1. Open Windows Security.
2. Go to Device security > Secure Boot.
3. Read the colored badge and the text under it:
   • Green, with text saying all required certificate updates have been applied: no action needed. Microsoft warns that the green checkmark alone doesn't confirm the certificates were updated, so read the text.
   • Yellow: something needs attention, often a hardware or firmware limit that blocks the automatic update. Microsoft says to contact your PC manufacturer.
   • Red: a boot-level security fix exists that your current boot setup can't receive.

Microsoft advises against dismissing these warnings if your PC hasn't received the new certificates yet. Status badges are turned off by default on enterprise-managed devices, and IT admins can turn them on with the HideSecureBootStates registry setting.

Before changing anything at boot level, find your BitLocker recovery key. PCMag warns that installing the updated certificate may trigger BitLocker recovery. Microsoft's own documentation says Secure Boot changes can affect BitLocker. Five minutes spent finding your 48-digit key now beats a locked laptop later.

Antivirus helps, but it doesn't replace patches​

PCMag's final advice is to run a strong third-party antivirus, possibly a full suite with an exploit-blocking firewall, "to compensate for the built-in security that Microsoft removed." Some of that is sound. An attacker still has to get malicious code onto your PC and run it, and good detection can block that.

There are two caveats PCMag skips:

• Microsoft hasn't removed Windows 10's built-in antivirus. PCMag itself reports that Microsoft Defender Antivirus updates on Windows 10 continue through October 2028. Third-party security software is optional.
• Antivirus can't fix a flaw in the operating system. It may catch a known exploit, but it can't patch a vulnerable Windows component. Microsoft's ESU documentation also calls ESU a temporary bridge, not a long-term solution.

Treat third-party security software as an extra layer on top of ESU. It isn't a replacement for ESU, and it isn't a reason to skip enrolling.

How many people this affects​

PCMag cites StatCounter showing Windows 11 at 74% and Windows 10 at 25%. Wikipedia's Windows 10 entry gives the same split as of October 2026. StatCounter measures web usage share, not installed PCs, but a quarter of Windows users is still a lot of machines. Many of them are on hardware that can't pass PC Health Check, and with RAM prices rising, PCMag argues that buying a new PC is a hard sell right now.

Your Windows 10 checklist​

1. Confirm you're on 22H2 and fully updated.
2. Enroll in ESU through Settings > Update & Security > Windows Update. Settings sync is free.
3. If enrollment isn't offered, check whether KB5126256 is installed.
4. Check Secure Boot status in Windows Security, and contact your PC maker if the status says so.
5. Store your BitLocker recovery key somewhere other than the PC.
6. Keep Defender or a reputable security suite running, as an extra layer.
7. Plan your move off Windows 10 before October 12, 2027. Check Windows 11 eligibility and budget for new hardware if your PC can't upgrade.

ESU buys you until October 12, 2027 to plan that move. Use the time to get your next PC sorted, and don't count on Microsoft extending the deadline again.