Microsoft’s patch KB5063709 quietly repaired the enrollment path that had prevented many Windows 10 users from signing up for the company’s one‑year Extended Security Updates (ESU) program, restoring the “Enroll now” experience in Settings so eligible PCs can get security‑only updates through October 13, 2026. (support.microsoft.com)
Microsoft set the end of mainstream support for Windows 10 at October 14, 2025, and later introduced a consumer ESU program to give home users an extra year of critical and important security updates through October 13, 2026. The consumer ESU path is deliberately narrow: it delivers security‑only patches (no feature updates, no general technical support) and is available only to eligible consumer SKUs running Windows 10, version 22H2. (support.microsoft.com)
Shortly after Microsoft began surfacing the consumer ESU enrollment UI, a subset of users reported that clicking “Enroll now” opened a wizard that crashed or simply closed immediately — effectively blocking enrollment. The August 12, 2025 cumulative update (KB5063709) includes a fix that addresses that behavior and also bundles servicing stack improvements intended to make the update and enrollment flow more reliable. (support.microsoft.com) (techradar.com)
Restoring enrollment is materially useful: ESU reduces exposure to new vulnerabilities by continuing security patching beyond the official support end date. For users whose hardware cannot run Windows 11, or who need more time to test and schedule upgrades, that safety net matters. (support.microsoft.com)
That said, the episode also underlines a persistent tension in Microsoft’s ecosystem: centralized, account‑bound programs make licensing and multi‑device coverage easier to manage, but they force privacy and architectural tradeoffs that long‑time Windows users may resent. The ESU path is helpful and pragmatic, but it’s short, narrow, and explicitly limited to security updates; it should be treated as a deliberate pause button for migration planning, not a new destination. (support.microsoft.com) (windowscentral.com)
For anyone still seeing enrollment trouble after installing the August 2025 update, double‑check build numbers and device eligibility, reboot, and then try Settings → Update & Security → Windows Update again — the “Enroll now” button should now complete the flow. If it does not, escalate to Microsoft support or use the documented troubleshooting steps for servicing stack and app registration issues. (support.microsoft.com)
Microsoft’s late‑breaking fix turns a moment of community annoyance into a manageable migration window. The technical repair is welcome, but the broader questions about account dependence, limited scope, and the inevitability of migration remain. The responsible course for consumers is simple: install the update, enroll if you need the extra year, and use that breathing room to plan the move to a supported platform before the ESU window closes on October 13, 2026. (support.microsoft.com) (support.microsoft.com)
Source: VICE Microsoft Fixed the Bug That Kept People From Signing Up for Windows 10 Extended Updates
Background
Microsoft set the end of mainstream support for Windows 10 at October 14, 2025, and later introduced a consumer ESU program to give home users an extra year of critical and important security updates through October 13, 2026. The consumer ESU path is deliberately narrow: it delivers security‑only patches (no feature updates, no general technical support) and is available only to eligible consumer SKUs running Windows 10, version 22H2. (support.microsoft.com)Shortly after Microsoft began surfacing the consumer ESU enrollment UI, a subset of users reported that clicking “Enroll now” opened a wizard that crashed or simply closed immediately — effectively blocking enrollment. The August 12, 2025 cumulative update (KB5063709) includes a fix that addresses that behavior and also bundles servicing stack improvements intended to make the update and enrollment flow more reliable. (support.microsoft.com) (techradar.com)
What KB5063709 changed — the technical facts
The headline: enrollment wizard fix and build bump
- KB5063709 is a cumulative security update released in August 2025 that raises Windows 10 22H2 systems to Build 19045.6216 (21H2 systems receive the corresponding 19044.x build). (support.microsoft.com)
- The update contains a consumer‑facing quality fix that addresses a defect where the ESU “Enroll now” wizard would fail to stay open, preventing users from completing enrollment. Installing the update should restore the normal enrollment flow for affected systems. (support.microsoft.com) (techradar.com)
Under the hood: servicing stack and Secure Boot notes
KB5063709 is frequently distributed combined with a Servicing Stack Update (SSU) to improve update reliability; when an LCU and SSU are combined administrators should be aware standard uninstallation via wusa.exe may not remove the SSU portion. The update also surfaces guidance and mitigations related to Secure Boot certificate lifecycles, calling attention to firmware and certificate timings that can affect boot behavior on certain devices. These platform‑level items are important for advanced users and administrators to test before mass deployment. (support.microsoft.com)Who is eligible and what you get
Eligibility (short version)
- Devices must be running Windows 10, version 22H2 (Home, Pro, Pro Education, or Workstation).
- Devices must have the latest updates installed (preconditions vary by image and servicing stack).
- The ESU license is tied to a Microsoft account and enrollment requires signing in with an administrator Microsoft account — local accounts alone cannot complete enrollment.
- Consumer ESU does not apply to domain‑joined devices, MDM‑enrolled devices, kiosk devices, or devices already licensed via enterprise ESU. (support.microsoft.com) (windowscentral.com)
What ESU provides — and what it does not
- ESU delivers Critical and Important security updates through October 13, 2026. It does not deliver feature updates, general non‑security fixes, or standard Microsoft technical support. ESU is a temporary safety net — not a long‑term servicing plan. (support.microsoft.com)
Enrollment options (consumer paths)
Microsoft exposes three consumer enrollment paths; all require a Microsoft account to complete enrollment:- Free via Windows Backup settings sync — enable the built‑in Windows Backup settings sync (which uses OneDrive) and enroll at no cost. This option leverages settings sync rather than a full file backup. (support.microsoft.com)
- Microsoft Rewards redemption — redeem 1,000 Microsoft Rewards points to enroll a device. This is non‑refundable and tied to the Microsoft account that redeems the points. (support.microsoft.com)
- One‑time paid purchase — pay a one‑time fee (listed around $30 USD per license) through the Microsoft Store tied to your Microsoft account; a single consumer ESU license can be used on up to 10 eligible devices associated with the same account. (support.microsoft.com) (windowscentral.com)
How to confirm KB5063709 is installed and how to enroll (step‑by‑step)
- Open Settings → Update & Security → Windows Update.
- Click “Check for updates” and install available updates; ensure you install KB5063709 or the latest cumulative update that advances your build to the versions Microsoft documents (22H2 → Build 19045.6216 after the August update). After installing, reboot when prompted. (support.microsoft.com)
- Back at Settings → Update & Security → Windows Update, look for the Enroll now link or the ESU enrollment banner. If it appears, click Enroll now and sign in with your Microsoft account when requested. (support.microsoft.com)
- Choose one of the three enrollment options (sync, rewards, or purchase) and follow the on‑screen prompts to complete the process. You can reuse the same ESU license on up to ten devices tied to the same Microsoft account. (support.microsoft.com)
Why this fix mattered — practical impact
When Microsoft first began surfacing the consumer ESU paths in July 2025, a real‑world usability problem emerged: some users saw an ESU enrollment prompt but clicking through did nothing because the wizard crashed. That left users with a visible option but no actionable way to claim it, which is effectively worse than not having the option at all. KB5063709 repaired that flow and broadened enrollment visibility, enabling households and small‑scale users to opt into a year of security coverage while they plan migrations. (techradar.com)Restoring enrollment is materially useful: ESU reduces exposure to new vulnerabilities by continuing security patching beyond the official support end date. For users whose hardware cannot run Windows 11, or who need more time to test and schedule upgrades, that safety net matters. (support.microsoft.com)
Critical analysis — strengths, tradeoffs, and risks
Strengths
- Pragmatic safety net: A no‑friction, time‑boxed way for consumers to keep receiving security patches for a year reduces immediate exposure to exploits and zero‑day risks. The multi‑device licensing for the paid path is a sensible concession for households. (support.microsoft.com)
- Multiple enrollment paths: Offering free enrollment via settings sync, Rewards redemption, or a paid purchase increases accessibility and choice for different user preferences and budgets. (support.microsoft.com)
- Operational fixes included: Combining servicing stack improvements with the LCU in KB5063709 reduces future installation failures and addresses underlying app registration quirks that caused the crash. That’s good servicing hygiene. (support.microsoft.com)
Tradeoffs and risks
- Microsoft account requirement: Requiring a Microsoft account for all enrollment options — including paid purchases — forces centralized account usage and will upset users who purposely use local accounts for privacy or operational reasons. This is a real privacy and convenience tradeoff. Independent reporting and Microsoft’s guidance both confirm the Microsoft account binding. (windowscentral.com) (support.microsoft.com)
- Short‑term only: ESU is explicitly a one‑year bridge. It is not a substitute for a proper migration plan. Relying on ESU as a permanent strategy is risky; after October 13, 2026, systems not migrated will again be unsupported. (support.microsoft.com)
- Limited scope of updates: ESU covers only security updates (Critical and Important). Many non‑security bugs, driver updates, and feature improvements will not be backported — that can leave user experiences aging while the system receives only bare‑minimum protections. (support.microsoft.com)
- Firmware and Secure Boot considerations: KB5063709 highlights Secure Boot certificate lifecycle matters; older firmware or device OEMs that do not update certificates or firmware in a timely fashion may encounter boot issues when platform policies change. Advanced users and administrators should test such interactions before fleetwide changes. (support.microsoft.com)
- Rollout variability and confusion: Microsoft staged the deployment and some regional rollouts lagged; combined with the initial signup bug and inconsistent web messaging, many users have felt confusion about eligibility and timing. The bug fix reduces the technical barrier, but communication problems amplified frustration. Community reporting and coverage tracked both the bug and the later fix. (techradar.com)
Privacy and practical implications
Enrolling via the free backup route requires enabling Windows settings sync to OneDrive and linking a Microsoft account. For privacy‑conscious users, that tradeoff — free security updates in exchange for account‑bound settings sync — may be unacceptable. The Rewards option shifts cost to attention and participation in Microsoft’s ecosystem. The paid option converts the decision into a monetary one, but still requires an account. These are design choices that privilege account‑centric licensing and tracking over anonymous or local options. (support.microsoft.com) (windowscentral.com)Practical troubleshooting: if you still don’t see “Enroll now”
- Confirm KB5063709 (or a later cumulative update) is installed and that your device reports Build 19045.6216 (22H2). If the build number doesn’t match, check Windows Update history and apply updates. (support.microsoft.com)
- Reboot after installing updates; servicing stack changes and LCU installs often require a reboot to finalize registration and UI fixes. (support.microsoft.com)
- If the enrollment banner still does not appear, verify device conditions: Windows 10 version 22H2, not domain‑joined or MDM‑enrolled, not a kiosk, and not already licensed for ESU. (support.microsoft.com)
- For stubborn cases, consult Microsoft’s support guidance and run Update Troubleshooter; advanced users can check app registration and servicing stack state, as community troubleshooting pointed at incomplete app registration as a likely culprit for the enrollment wizard crash prior to the KB fix. If you manage many devices, test the flow on a clean image and confirm SSU prerequisites for offline servicing scenarios.
What this episode says about Microsoft’s update process
The enrollment bug and its remediation illustrate several broader themes about modern Windows servicing:- The cumulative + servicing stack model accelerates patch deployment but also concentrates risk: if an SSU or LCU leaves an image in a slightly inconsistent state, downstream app or UI flows can break until a corrective update is released. KB5063709 is an example of Microsoft shipping a combined SSU+LCU to restore operational behavior quickly. (support.microsoft.com)
- Account‑centric licensing simplifies tracking and multi‑device reuse for Microsoft, but it clashes with long‑standing consumer expectations about local accounts and privacy choices. Expect continued friction as Microsoft nudges users toward account‑linked experiences. (windowscentral.com)
- Staged rollouts plus ambiguous or outdated web messaging create avoidable confusion. Several outlets and community channels noted inconsistent communications around the ESU announcement and the persistence of old webpage language in July 2025; that confusion amplified frustration when the enrollment path initially failed for some users. The technical fix was necessary, but clearer communication and earlier detection of the wizard failure would have reduced the noise. This particular claim about Microsoft leaving old webpage language in place for weeks is supported by community reporting but not fully verifiable in every region; treat that item as a user‑experience observation rather than an incontrovertible policy failure. (techradar.com)
Recommended next steps for Windows 10 users
- Install KB5063709 (or the latest cumulative update) from Windows Update or the Microsoft Update Catalog and reboot. Confirm your OS build number matches Microsoft’s published values (22H2 → 19045.6216 after the August update). (support.microsoft.com)
- If you plan to stay on Windows 10 past October 14, 2025, enroll in ESU promptly once the enrollment prompt appears. Decide which enrollment route suits you: free settings sync, Rewards points, or the one‑time paid option (consider how many devices you’ll cover with a single account). (support.microsoft.com)
- For privacy‑focused users who refuse a Microsoft account, begin migration planning now: investigate Windows 11 eligibility, Linux alternatives, or hardware refresh options. ESU is a one‑year bridge, not a long‑term solution. (support.microsoft.com)
- For advanced users or those who manage multiple devices, test firmware and Secure Boot interactions in a lab environment prior to enrolling a fleet; the KB’s Secure Boot certificate lifecycle guidance is material and can affect boot behavior on older hardware. (support.microsoft.com)
Final assessment
KB5063709 did what it needed to do: it repaired a broken enrollment UI and shored up servicing mechanics so the consumer ESU program could function as Microsoft promised. For households and individuals who are not ready or able to move to Windows 11 immediately, that fix materially reduced the risk of being left without security patches after the platform’s October 14, 2025 end‑of‑support date. (support.microsoft.com) (techradar.com)That said, the episode also underlines a persistent tension in Microsoft’s ecosystem: centralized, account‑bound programs make licensing and multi‑device coverage easier to manage, but they force privacy and architectural tradeoffs that long‑time Windows users may resent. The ESU path is helpful and pragmatic, but it’s short, narrow, and explicitly limited to security updates; it should be treated as a deliberate pause button for migration planning, not a new destination. (support.microsoft.com) (windowscentral.com)
For anyone still seeing enrollment trouble after installing the August 2025 update, double‑check build numbers and device eligibility, reboot, and then try Settings → Update & Security → Windows Update again — the “Enroll now” button should now complete the flow. If it does not, escalate to Microsoft support or use the documented troubleshooting steps for servicing stack and app registration issues. (support.microsoft.com)
Microsoft’s late‑breaking fix turns a moment of community annoyance into a manageable migration window. The technical repair is welcome, but the broader questions about account dependence, limited scope, and the inevitability of migration remain. The responsible course for consumers is simple: install the update, enroll if you need the extra year, and use that breathing room to plan the move to a supported platform before the ESU window closes on October 13, 2026. (support.microsoft.com) (support.microsoft.com)
Source: VICE Microsoft Fixed the Bug That Kept People From Signing Up for Windows 10 Extended Updates
