Problem enrolling in extended security updates - Windows 10 PC

Hi hikerguy — frustrating situation, I get it. Short answer: that message means the Microsoft account currently signed into the PC is being treated as a child/family account, and Microsoft won’t let a child account be used to enroll in the consumer ESU program. The ESU license must be assigned to an adult Microsoft account (the account used to enroll) and the Microsoft account used on-device must be an admin account to complete enrollment.
What you can do (ordered by easiest/safest):
1) Enroll using an adult Microsoft account (recommended)

• If you have an adult Microsoft account (your own), add it to the PC as a user and make it an Administrator:
  • Settings > Accounts > Family & other users > Add someone else to this PC > sign in with your Microsoft account email.
  • After adding, select the account and choose Change account type > Administrator.
• Sign in with that adult account and go to Settings > Update & Security > Windows Update and click Enroll now (or follow the ESU enrollment prompts). The ESU license will be tied to the Microsoft account you used to enroll and can cover up to 10 devices. You can remove your account from the PC afterward if you want.

2) Make the wife’s Microsoft account an adult / remove family child flag

• If her account is in a Microsoft Family group and is set as a child, an organizer (an adult in the family) must remove/change that status at family.microsoft.com or remove her from the family group. After that, sign out and back in (or reboot) and try enrollment again.

3) If you can’t reach her and don’t want to enroll with your account

• Wait until she can sign in and enroll. Enrollment is available through October 13, 2026 (and security updates run until then for enrolled devices), but enrollment availability may be rolling out by region/device, so you don’t have to panic — but sooner is safer.

Advanced / troubleshooting notes (only if needed)

• If Settings shows the “adult must sign in” warning but you believe the account is adult, there have been bugs and cached parental-control flags that block enrollment. Microsoft support threads suggest making sure Windows is fully updated, signing in with an adult Microsoft account, and (in stubborn cases) checking/removing parental-control registry entries. That registry edit is advanced and I can walk you through it if you want — but don’t edit the registry unless you’re comfortable and have a backup / restore point.

A few quick answers you might need

• Will enrolling with my MS account change her files? No — adding your Microsoft account as a user/admin doesn’t change or delete her files. Just don’t use tools that explicitly modify her user profile. After enrollment you can remove your account if you want.
• Is the ESU license per-device or per-account? The consumer ESU license is tied to the Microsoft account used to enroll and can cover up to 10 devices.

Tell me:

• Do you already have an adult Microsoft account you can use?
• Are you able to add/sign into the PC right now (physically or via remote access)?
  If yes, I’ll give a step-by-step walk‑through for adding your account and completing the enrollment, including exact Settings clicks and what to expect. If you prefer not to add your account, I’ll show the safest way to remove the child flag from her account (if possible).

Tell me How to edit the registry

ChatGPT said:

Hi hikerguy — frustrating situation, I get it. Short answer: that message means the Microsoft account currently signed into the PC is being treated as a child/family account, and Microsoft won’t let a child account be used to enroll in the consumer ESU program. The ESU license must be assigned to an adult Microsoft account (the account used to enroll) and the Microsoft account used on-device must be an admin account to complete enrollment.
What you can do (ordered by easiest/safest):
1) Enroll using an adult Microsoft account (recommended)

• If you have an adult Microsoft account (your own), add it to the PC as a user and make it an Administrator:
  • Settings > Accounts > Family & other users > Add someone else to this PC > sign in with your Microsoft account email.
  • After adding, select the account and choose Change account type > Administrator.
• Sign in with that adult account and go to Settings > Update & Security > Windows Update and click Enroll now (or follow the ESU enrollment prompts). The ESU license will be tied to the Microsoft account you used to enroll and can cover up to 10 devices. You can remove your account from the PC afterward if you want.

2) Make the wife’s Microsoft account an adult / remove family child flag

• If her account is in a Microsoft Family group and is set as a child, an organizer (an adult in the family) must remove/change that status at family.microsoft.com or remove her from the family group. After that, sign out and back in (or reboot) and try enrollment again.

3) If you can’t reach her and don’t want to enroll with your account

• Wait until she can sign in and enroll. Enrollment is available through October 13, 2026 (and security updates run until then for enrolled devices), but enrollment availability may be rolling out by region/device, so you don’t have to panic — but sooner is safer.

Advanced / troubleshooting notes (only if needed)

• If Settings shows the “adult must sign in” warning but you believe the account is adult, there have been bugs and cached parental-control flags that block enrollment. Microsoft support threads suggest making sure Windows is fully updated, signing in with an adult Microsoft account, and (in stubborn cases) checking/removing parental-control registry entries. That registry edit is advanced and I can walk you through it if you want — but don’t edit the registry unless you’re comfortable and have a backup / restore point.

A few quick answers you might need

• Will enrolling with my MS account change her files? No — adding your Microsoft account as a user/admin doesn’t change or delete her files. Just don’t use tools that explicitly modify her user profile. After enrollment you can remove your account if you want.
• Is the ESU license per-device or per-account? The consumer ESU license is tied to the Microsoft account used to enroll and can cover up to 10 devices.

Tell me:

• Do you already have an adult Microsoft account you can use?
• Are you able to add/sign into the PC right now (physically or via remote access)?
  If yes, I’ll give a step-by-step walk‑through for adding your account and completing the enrollment, including exact Settings clicks and what to expect. If you prefer not to add your account, I’ll show the safest way to remove the child flag from her account (if possible).

Click to expand...

Tell me How to edit the registry

Good — I’ll show you a safe, step‑by‑step procedure to edit the registry on Windows 10 (with the exact commands you can copy), plus how to back up and how to recover if something goes wrong. I’ll also include the advanced steps (change permissions / load an offline hive) in case you hit “Access denied.” Follow each step carefully and stop if anything looks unfamiliar — I can guide you through any step.
Before you begin — absolute musts

• Create a System Restore point first (so you can roll the whole system back). Settings → Type “Create a restore point” → System Protection tab → Create. This is faster and more reliable than relying on a registry export alone.
• Export the registry key you plan to change (or export All if you’re unsure). In regedit: File → Export → select Selected branch (or All) → Save. That export is the single-click way to restore the exact keys you change.

Step‑by‑step: open, back up, edit, verify
1) Open Registry Editor as administrator

• Press Win + R, type regedit, press Enter. Approve the UAC prompt.

2) Backup the key (very important)

• Navigate to the key you want to change in the left pane.
• Right‑click that key → Export → save to a USB or Documents folder (give a clear name like backup-HKLM-software-MyKey.reg). If you plan many edits, export the full registry (File → Export → All) as an additional safety net.
  Alternative command-line backup:
• Open an elevated Command Prompt and run:
  reg export "HKLM\SOFTWARE\My\Path" "C:\Users\YourUser\Desktop\mykey-backup.reg" /y

3) Make the change (edit / create / delete value)

• To change a value: double‑click the value in the right pane, edit the data, click OK.
• To create a new value: right‑click → New → choose (String/DWORD/QWORD/Expandable string/Binary) and name it exactly.
• To delete a value: right‑click the value → Delete → confirm.
• To delete a whole key: right‑click the key → Delete → confirm.
• Tip: Make one change at a time, then reboot and verify the system behaves.

4) Importing a .reg file (reversible changes via file)

• To apply a prepared .reg file: double‑click it and accept the prompt, or from an elevated CMD:
  reg import "C:\path\yourchange.reg"
• To restore the exported backup, double‑click the backup .reg or use reg import.

5) Command-line deletion or creation (if GUI not preferred)

• Delete a value:
  reg delete "HKCU\Software\MyApp" /v MyValue /f
• Delete a key:
  reg delete "HKCU\Software\MyApp" /f
• Create a DWORD:
  reg add "HKLM\Software\MyApp" /v MyDword /t REG_DWORD /d 1 /f

What to do if “Access denied” (advanced — take ownership and set permissions)

• If you can’t edit a key because of permissions:
  1. Right‑click the key → Permissions → Advanced.
  2. Next to Owner click Change → type Administrators (or your user) → Check Names → OK.
  3. Check “Replace owner on subcontainers and objects” (if needed) and click Apply.
  4. Grant your account Full Control in the Permissions dialog and click OK.
• Be careful: changing ownership/permissions on system keys can break services. Only do this for a specific key you trust. If you want, tell me the key path and I’ll give step‑by‑step ownership commands.

If you need to edit another user’s hive (offline or another profile)

• In regedit select HKEY_USERS (or HKEY_LOCAL_MACHINE), File → Load Hive → point to the other user’s NTUSER.DAT (usually C:\Users\OtherUser\NTUSER.DAT). Give it a temporary name, edit keys, then File → Unload Hive when done. This is how you edit settings for a user who’s not currently signed in. (Advanced; ensure you unload the hive to avoid corruption.)

Recovery steps if something goes wrong

• Quick rollback: double‑click your exported .reg backup to restore the single key you changed.
• If the .reg import fails or makes Windows unstable: use the System Restore point you created earlier (Start → type “rstrui” → pick the restore point you made before edits).
• If Windows won’t boot, you can boot to Windows Recovery Environment → Troubleshoot → Advanced Options → System Restore, or use an offline registry restore by replacing the registry hives from RegBack (advanced).

Notes specific to your ESU/parental‑control situation

• If your goal is to remove a cached parental-control flag that’s blocking ESU enrollment, try the non‑registry fixes first: sign out and sign in with an adult Microsoft account, or remove the account from the Microsoft Family at family.microsoft.com. Registry changes in these cases are often unnecessary and riskier than adding an adult admin account temporarily. If those options aren’t possible and you want me to show the likely registry locations to inspect, tell me the exact message you see and whether the PC is joined to a Microsoft Account or a local account — I can then point to specific keys to check (and give the exact key paths and .reg snippets).

If you want me to produce ready‑to‑paste .reg files or exact reg.exe commands

• Tell me:
  1) The exact registry key path you want to change (or the error message / feature you’re trying to fix).
  2) Whether you’re comfortable using advanced steps (take ownership / load hive) if needed.

Example: create a System Restore backup via command line (optional)

• From elevated PowerShell:
  Checkpoint-Computer -Description "Before registry edit" -RestorePointType "MODIFY_SETTINGS"

Final safety reminder

• Don’t edit random keys you find in forums. Export before changing. Make one change at a time. Keep the backups and a restore point until you’re sure everything is stable.

Would you like:

• A short checklist I can paste for you to follow step‑by‑step on that PC now, or
• Help with the specific keys involved in the Microsoft Family / ESU block (if you can copy/paste the on‑screen message or allow me to walk you through checking account/family settings)?

I can walk you through editing the registry — but first two important points:
1) Safety warning — editing the registry can break Windows. Do not proceed unless you understand the risk. Create a full backup or a restore point and export any key you change before you change/delete it.
2) Reality check — the “An adult needs to sign in…” message is normally enforced by Microsoft’s account/family service on their servers. In many cases changing local registry entries will not flip the account’s “child” status on Microsoft’s servers. The safer, more reliable solutions remain: enroll with an adult Microsoft account, or remove the child flag via family.microsoft.com (an organizer must do that). If you still want to try registry edits, below are safe, explicit steps.
If you want to proceed, do these steps exactly.
A — Prepare (create backups and a restore point)

1. Create a System Restore Point (recommended)
   • Option A (GUI): Start → type Create a restore point → System Protection tab → Create → give a name like “Before Registry Edit” → OK.
   • Option B (PowerShell, admin): open PowerShell as Administrator and run:
     Checkpoint-Computer -Description "Before Registry Edit" -RestorePointType "Modify_Settings"
     (If PowerShell gives an error, use the GUI method.)
2. Export any registry key you will change
   • You will be shown how below; exporting creates a .reg file you can double‑click to restore.

B — Open Registry Editor (Regedit) as administrator

1. Sign in to an administrative account on the PC.
2. Press Windows key + R, type regedit, press Enter.
3. Accept the UAC prompt.

C — How to find the key(s) and export them

1. In Regedit, navigate to the key you want, or use Edit → Find (Ctrl+F) to search terms like family, parental, parentalcontrols, child, microsoftfamily.
2. Before changing anything: right‑click the key → Export → choose a location (Desktop or C:\Users\Public) and give a name like key-backup.reg → Save.
   • This .reg file is your undo for that key.

D — How to change or delete a value/key

1. Modify a value:
   • Select the key, in the right pane double‑click the value name, change Value data, click OK.
2. Delete a value:
   • Right‑click the value → Delete → confirm.
3. Delete an entire key:
   • Right‑click the key in the left pane → Export (again, if you haven’t) → then Delete → confirm.
4. If access denied:
   • Right‑click the key → Permissions → Advanced → change Owner to Administrators (click Change, type Administrators, click Check Names, OK) → give Administrators Full Control → Apply → then close and try delete again.

E — How to restore if something goes wrong

1. If you exported a .reg file: double‑click the .reg file and allow it to merge into the registry. Or from an elevated command prompt:
   reg import "C:\path\key-backup.reg"
2. If the system is unstable, boot to Advanced Startup → Troubleshoot → Advanced options → System Restore and pick the restore point you created.

F — Command-line alternatives (export / import)

• Export a key (example):
  reg export "HKCU\Software\SomeKey\SubKey" "C:\Users\Public\SomeKey-backup.reg"
• Import to restore:
  reg import "C:\Users\Public\SomeKey-backup.reg"

G — What keys might be relevant (NOTE: may not solve server-side child flag)

• I won’t guess a destructive key to delete. If you want, tell me exactly what you can see in Regedit when you search for terms like Family or Parental and I’ll point to particular keys/values that are safe to export then remove.
• Remember: the child/account age flag is set on Microsoft’s servers (your online Microsoft account profile and family.microsoft.com). Local registry changes often won’t clear a server-side restriction. Trying to bypass server checks can leave the system in an odd state.

H — Final safety suggestions

• Make sure you have a recent full backup of any important data before you edit the registry.
• If you’re uncomfortable at any step, stop and tell me which step you’re on — I’ll walk you through it slowly.
• If your goal is to complete ESU enrollment now, the fastest and safest route is still to add an adult Microsoft account to the PC and enroll with that account (I can give step-by-step for that, too).

Do you want:
A) The step‑by‑step commands to search for and remove any “Parental/Family” keys I can point to, or
B) Step‑by‑step to add your adult MS account to the PC and enroll (safer and likely to work)?
Tell me which and I’ll give exact key names and clicks or the admin‑account enrollment steps.

The solution was provided by a user on the tenforums.com website:



Go to the following URL:


Scroll down to the heading "Usage"

Click on the "Download ZIP" link.

To make things easy, create a folder with a simple name under C: I just created a folder named TOM.

Move the zip file there and extract it in the folder. You can delete the zip file at this point if you want.

The remaining steps are explained on the Github URL above (under the heading Advanced Usage), but I'll detail what I did.

Open a cmd prompt as admin. To do this, enter cmd in the Search bar (lower lefthand corner of the Windows Desktop) and select "Run as admin".

Navigate to the folder where you extracted the zip file. In my case, I entered the following in the command prompt ("DOS window"):

cd TOM

Run the following command:

Consumer_ESU_Enrollment_run.cmd -Local

If it runs properly, it should display:

Evaluate ESU Eligibility state ...
Eligibility Status: DeviceEnrolled
Eligibility Result: SUCCESS

Run Windows Update and scroll down to look for the words "Your PC is enrolled to get Extended Security Updates".

If it doesn't, try the following commands, each time repeating the steps above.

Consumer_ESU_Enrollment_run.cmd -License

Consumer_ESU_Enrollment_run.cmd -Proceed

When I ran these commands, I ran Windows Update and didn't see the option to enroll anymore (not realizing that I wouldn't see that message if I was now enrolled). I finally happened to scroll down in the Update window and saw the message that I was now enrolled.

Nice work — that’s a known, commonly used community solution. Short summary and safe next steps so you / others reading this can proceed confidently.
What you found

• The GitHub project abbodi1406/ConsumerESU is a PowerShell/CMD tool that automates enabling the Windows 10 Consumer ESU enrollment feature and attempts enrollment using available tokens (MS account in Windows, MS Store token or local account). The repo documents the usage and the optional switches you showed (-Local, -License, -Proceed, etc.).
• Many users have reported success with the script on forums (tenforums, Microsoft Q&A) when the built‑in wizard didn’t appear yet on a device.
• Microsoft’s official ESU program details (including enrollment options and the program end date October 13, 2026) are on Microsoft’s site — ESU enrollment is an official feature, but the GitHub tool is third‑party and simply automates/enables the same workflow when the wizard hasn’t rolled out to your device yet.

Safety checklist (do this before running the ZIP/script)

1. Create a System Restore point and a backup of any important files (do not skip).
2. Inspect the downloaded files before running them: open the .ps1 and .cmd files in Notepad to glance at what they do. The script is open source; you should be able to see the operations it runs.
3. Scan the downloaded ZIP with your AV (Windows Defender) and, if possible, VirusTotal before execution.
4. Confirm your Windows build / prerequisite update is present: the repo lists a minimum cumulative update requirement (example: build 19045.6036 / KB5061087 or later). If you’re older than that, install updates first. To check build: run winver, or in an elevated PowerShell run Get-ComputerInfo | select WindowsVersion, OsBuild (or systeminfo / ver).

How to run (as you already did — reiterated)

1. Download Code → Download ZIP from GitHub - abbodi1406/ConsumerESU: Windows 10 Consumer ESU Enrollment and extract to a simple folder (C:\TOM is fine).
2. Open Command Prompt as Administrator (Win → type cmd → Run as administrator).
3. cd C:\TOM (or to the folder you used).
4. Run the command you used: Consumer_ESU_Enrollment_run.cmd -Local
   • If that reports DeviceEnrolled / SUCCESS you’re done — verify in Settings > Update & Security > Windows Update where it should say “Your PC is enrolled to get Extended Security Updates.”
   • If it doesn’t enroll, try the other flags in this order: -License then -Proceed (or use combinations documented in the repo).

Region / rollout notes

• The repo includes a region workaround (temporarily change the device region or GeoId) because Microsoft’s rollout and geo-blocking can prevent enrollment in some countries; the script documents how to change region temporarily and then run enrollment. If you use that, run the scheduled‑task cleanup the repo provides (it includes a Consumer_ESU_ScheduledTasks.cmd with an option to disable the scheduled tasks it creates) and then restore your original region.

Undo / cleanup

• The repo supports a -Remove switch to remove the Consumer ESU license if you need to roll back. Keep the extracted folder until you’re sure everything is fine.

Risks / caveats (be aware)

• This is a third‑party community tool, not a Microsoft‑published installer. It’s widely used and many reports say it simply automates the same steps the official enrolment wizard uses, but it’s not “official Microsoft software.” Use at your own risk after taking the safety steps above.
• If you relied on the repo’s “manual license acquisition” method (the final fallback), the repo itself warns that a license acquired without proper enrollment is “not yet verified” to work the same as the normal flow — prefer the normal enrollment methods first.

If you want, I can:

• Walk you step‑by‑step while you perform any of the checks (build/KB, restore point, AV scan).
• Check the exact output you got from the script and explain what each line means.
• Give the precise commands to verify the KB/OS build and to run the script safely, or show how to undo with the -Remove switch.

If everything went through for you (you saw “DeviceEnrolled / SUCCESS” and the Windows Update message), you’re good — congratulations. If not, post the exact script output here and I’ll help interpret it and suggest the next action.