Windows 10 End of Support 2025: How to Enroll in ESU Through Oct 2026

Background​

Why the enrollment notice might not appear​

• Your PC isn’t running Windows 10 version 22H2 with the latest cumulative updates installed.
• You are signed in with a local account or a non‑admin account; a Microsoft account with admin rights is required to enroll.
• The device is managed by an organization (domain‑joined or MDM/Intune), which blocks consumer enrollment.
• Microsoft’s rollout is phased, and some devices simply haven’t received the enrollment trigger yet.

The safe, supported way to show the ESU enrollment (step‑by‑step)​

• Sign into Windows 10 with an administrator account that uses a Microsoft account (not a child account).
• Confirm you’re on Windows 10 version 22H2 and install all pending Windows Updates. Reboot if updates were installed.
• Open the Start menu, type cmd, right‑click Command Prompt and choose Run as administrator.

• Enable and start the Connected User Experiences and Telemetry service:
• sc.exe config DiagTrack start=auto
• sc.exe start DiagTrack
• Add the Feature Management override registry value that unlocks the ESU enrollment UI:
• reg.exe add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 4011992206 /t REG_DWORD /d 2 /f
• Reboot the PC.
• After restart, open an elevated Command Prompt again and force an eligibility reevaluation:
• cmd /c ClipESUConsumer.exe -evaluateEligibility
• Reboot once more and then open Settings > Update & Security > Windows Update. If everything succeeded, you should now see the ESU enrollment prompt (“Enroll now” / “Get extended security updates”).

What each step does (brief technical overview)​

• Enabling DiagTrack (Connected User Experiences and Telemetry) lets Windows send and receive the minimal telemetry and feature‑management signals required to evaluate ESU eligibility. Some of the ESU enrollment logic is gated behind Microsoft’s feature management service and needs that telemetry path to be available. This is why a disabled telemetry service can prevent the UI from showing.
• The registry override under FeatureManagement\Overrides is a controlled feature‑flag flip. Setting the DWORD 4011992206 to 2 tells Windows to treat the ESU enrollment feature as enabled for this device for testing/evaluation purposes. This is a temporary, local override — it doesn’t alter Microsoft licensing servers — but it prompts the local settings UI to run an eligibility check.
• ClipESUConsumer.exe is the consumer tool built into Windows 10 that evaluates ESU eligibility and can force the local enrollment wizard to appear. The -evaluateEligibility switch executes the local test that contacts Microsoft’s enrollment endpoints and writes the result to the system so the Settings app displays the correct UI. Multiple Microsoft support answers ask users to run this exact command to trigger the enrollment dialog.

Verifying enrollment and license status​

• Return to Settings > Update & Security > Windows Update — the page should show a confirmation message saying the device is enrolled and will receive Extended Security Updates through October 13, 2026.
• You can verify registry values under:
• HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides — value 4011992206 should exist and be set to 2 if you applied the override.
• Some community posts show using:
• reg.exe query "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\ConsumerESU"
  to view consumer ESU evaluation values after running the ClipESUConsumer command. If ESUEligibilityResult = 1 appears, the assessment succeeded. (This is a community‑documented verification step frequently cited on Microsoft Q&A.

Common failure modes and how to handle them​

• You’re in an unsupported region or onboarding is being rolled out slowly to your locale. Microsoft stated the consumer ESU experience was rolled out by region and that some areas would see delayed availability. In that case you must wait for the staged rollout to reach your device.
• Device is managed (domain or MDM). Consumer ESU enrollment is blocked if the device is domain‑joined or controlled by Intune / enterprise policies. Check Settings > Accounts and confirm the device is not joined to a workplace or organization. If managed, ask your IT admin about organization‑level ESU options.
• Using a child account or non‑admin account. Only administrators using a qualifying Microsoft account can enroll a device. Create or sign in with a proper admin Microsoft account and retry.
• Missing prerequisite updates. Install all pending Windows Updates (including the cumulative update that fixes ESU enrollment bugs such as the mid‑2025 rollup noted by multiple outlets) and retry after a reboot. Several tech outlets and Microsoft community posts say patch KB5063709 and similar cumulative rollups resolved earlier ESU wizard crashes and rollout issues.
• If the enrollment attempt fails with a Microsoft server error, wait and try again later. Server‑side throttling or short‑term backend errors were reported during the initial rollout due to unusually high demand. Most users who waited a few hours retried successfully.

Risks, privacy implications and rollback instructions​

• Enabling DiagTrack restores a telemetry channel. While this specific telemetry is limited to the feature management and enrollment process, enabling telemetry may be undesirable for privacy‑conscious users. If you prefer to disable DiagTrack afterward, you can set the service back to manual/disabled with:
• sc.exe config DiagTrack start=disabled
• sc.exe stop DiagTrack
  Note that disabling too aggressively before enrollment completes can again prevent the ESU UI from appearing.
• Editing the registry carries standard risks. Back up the registry or create a system restore point before adding the FeatureManagement override. The referenced key (Overrides\4011992206) is limited in scope, but incorrect registry edits can destabilize Windows. If in doubt, create a restore point first.
• This method does not circumvent licensing or official requirements. The local override is a UI trigger and eligibility evaluator — Microsoft’s backend enrollment/licensing still controls whether your device will receive ESU patches. If your device doesn’t meet eligibility rules (wrong edition, not 22H2, managed device), the override won’t create a legitimate ESU entitlement.
• If you want to undo the registry override after enrollment completes, remove the value:
• reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 4011992206 /f
  But be aware that removing the override before enrollment may hide the UI again. It’s safest to leave the override until you confirm enrollment succeeded and the Settings app shows ESU as active.

What Microsoft has said and what was fixed​

Advanced diagnostics (for power users)​

• Check Feature Management overrides:
• reg query "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 4011992206
• Check the ClipESUConsumer evaluation results:
• reg query "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\ConsumerESU"
  Look for ESUEligibilityResult and related values; a value of 1 typically indicates success in community threads. Use this as an internal diagnostic, not a substitute for the Settings UI confirmation.
• Confirm the DiagTrack service status:
• sc query DiagTrack
• If Windows Update appears to stall, reset the update components:
• net stop wuauserv
• net stop bits
• rename %windir%\SoftwareDistribution to SoftwareDistribution.old
• net start wuauserv
• net start bits
  Clearing the SoftwareDistribution cache is a frequently recommended step when Windows Update behaves unexpectedly and has been reported as useful by some users encountering ESU enrollment issues.

When to contact Microsoft Support​

Practical recommendations and migration planning​

• Upgrade eligible hardware to Windows 11 where possible, prioritizing devices that meet Copilot+ and security baseline requirements. Microsoft strongly recommends migration for long‑term security and compatibility.
• For machines that can’t upgrade, consider migrating to a supported Linux distribution or ChromeOS Flex for web‑centric devices, then reserve ESU only as a short‑term measure.
• If remaining on Windows 10 is necessary for specific applications, use ESU as intended — install it, confirm enrollment, and maintain good security hygiene: enable a reputable anti‑malware solution, use network segmentation for legacy devices, and limit administrative access.

Final word — what to do right now (concise checklist)​

• Confirm you’re on Windows 10 version 22H2 and install all available updates; reboot.
• Sign in with a Microsoft account that has administrator rights.
• If the ESU prompt is missing, run the diagnostic/enrollment trigger steps (enable DiagTrack, add registry override, run ClipESUConsumer.exe, reboot).
• Verify enrollment in Settings > Update & Security > Windows Update. If still missing, wait for Microsoft’s staged rollout or contact Microsoft Support.

Background / Overview​

Why this matters now​

• The ESU program reduces immediate exposure to newly discovered critical threats.
• It does not replace long‑term support: drivers, firmware, and compatibility issues may still surface without feature and quality updates.
• The consumer ESU is time‑boxed; plan a migration strategy during the covered year.

What Microsoft is offering — the essentials​

• End of standard Windows 10 consumer support: October 14, 2025.
• Consumer ESU coverage (if enrolled): security‑only updates through October 13, 2026.
• Eligible editions: Windows 10 consumer SKUs (Home, Pro, Pro Education, Pro for Workstations) running version 22H2 and fully patched to the required servicing‑stack baseline.
• What ESU delivers: Critical and Important security fixes only — no feature updates, no broad technical support, and no routine quality roll‑ups outside that scope.

• Free path (most markets): sign in with a Microsoft Account (MSA) and enable Windows Backup / settings sync to OneDrive for the device. This is the widely reported no‑cash route.
• Rewards path: redeem 1,000 Microsoft Rewards points (if available in your region) to obtain the ESU entitlement for an MSA.
• Paid path: a one‑time purchase (~US$30) or local equivalent that associates ESU coverage with the Microsoft account; Microsoft has stated a single purchase can be applied across multiple devices tied to the same MSA (the in‑UI enrollment flow shows limits).

Step‑by‑step: How to claim the free year (validated)​

• Confirm your device is eligible:
• Open Settings → System → About and confirm Windows 10 version 22H2. If not on 22H2, upgrade and install all pending cumulative and servicing‑stack updates first. Microsoft required recent servicing updates for the ESU enrollment experience to appear correctly.
• Sign in with a Microsoft Account:
• Go to Settings → Accounts → Your info. If you’re on a local account, use the “Sign in with a Microsoft account” link and authenticate with an Outlook/Hotmail/Xbox account. The MSA used for enrollment must remain active and periodically re‑authenticated to retain ESU entitlement (for many users Microsoft checks sign‑in state).
• Turn on Windows Backup / Sync your settings:
• Open Settings → Accounts → Windows backup (or “Sync your settings”), and enable the toggle to back up settings to OneDrive. This step syncs selected desktop preferences, personalization, Wi‑Fi profiles, and other configuration items — not your documents unless you enable folder backup. The Windows Backup policy documentation lists the categories that can be synced.
• Open Windows Update and click Enrol now:
• Type “Windows Update” in the search bar and open Settings → Update & Security → Windows Update. If the device meets prerequisites and the staged rollout has reached it, an Enroll now option appears. Follow the wizard, choose the free route when prompted, and confirm terms. The UI will map the ESU entitlement to your Microsoft account.
• Verify ESU updates:
• ESU deliveries will show up as monthly security‑only updates in Windows Update, often labeled with “Extended Security Update (ESU)” or similar. Continue to check Windows Update and install updates as they arrive.

What exactly is synced — and what isn’t​

• Windows Backup can sync personalization and OS settings: desktop theme, wallpaper, File Explorer options, language preferences, accessibility settings, and other device settings. It can also sync Wi‑Fi network names and passwords, and optionally desktop/folder content if folder backup to OneDrive is enabled. Administrators may toggle policies to exclude or include categories.
• The default intent of the sync requirement is to back up settings and preferences, not to upload the entire Documents folder or user data unless the user explicitly enables OneDrive folder backup. That said, Windows Backup can be configured to back up Desktop, Documents, Pictures, Videos and Music to OneDrive — and that will consume OneDrive storage. Users should review the Windows Backup page and pick only the categories they consent to sync.

Regional nuance: the European Economic Area (EEA) exception​

• Microsoft removed the requirement to enable Windows Backup / OneDrive sync as a precondition for free ESU in many cases. Users in the EEA can enroll for the no‑cost ESU route with fewer cloud obligations, although a Microsoft account and periodic sign‑in checks remain part of the process. Microsoft confirmed the enrollment flow will be adjusted to meet local expectations.
• EEA users must still authenticate with a Microsoft account and may be required to sign in periodically (reports indicate a re‑authentication check roughly every 60 days) to retain coverage. The key point: the EEA carve‑out reduces the mandatory cloud backup string attached to the free route.

Security and privacy trade‑offs — an objective look​

• Benefit: you regain a year of security‑only updates for an eligible device, reducing the short‑term risk profile and buying time to upgrade, replace, or migrate. This is the program’s core value.
• Trade‑off: the free route requires tying the ESU entitlement to an MSA and enabling some form of cloud sync in many regions. That increases the telemetry and cloud footprint for the synced settings group and creates a dependency on the account for entitlement checks. While the synced items are mostly configuration data, some categories (Wi‑Fi passwords, saved credentials and folder backups) are especially sensitive if enabled inadvertently.
• Practical privacy mitigation:
• Enable only the specific sync categories you want (Settings → Accounts → Windows backup).
• Avoid enabling OneDrive folder backups if you don’t want your Documents or Desktop mirrored to Microsoft’s cloud.
• Use a Microsoft account you control, enable multi‑factor authentication, and treat the MSA like any other critical credential.
• Consider the EEA carve‑out if privacy policy or region permits, but don’t change region settings solely to bypass intended policies without understanding consequences.

Troubleshooting: If the “Enroll now” button isn’t visible​

• Confirm Windows 10 version is 22H2 and install all available updates (including servicing stack updates). Microsoft shipped fixes earlier in 2025 to resolve enrollment UI issues.
• Sign in with a Microsoft account and enable Windows Backup (or use the Rewards / paid path). If the device is domain‑joined, MDM‑managed, or otherwise enterprise‑controlled, the consumer ESU enrollment path will be blocked — those scenarios use separate commercial ESU channels.
• If the button still does not appear after updating and restarting, wait a few days and re‑check; Microsoft’s staged rollout reached large numbers of devices over a window of time. If problems persist, consult the Windows Update troubleshooter and confirm your device’s region settings if you expect EEA behavior.

Practical alternatives and a migration game plan​

• Priority 1 — Upgrade if possible:
• If the PC meets Windows 11 minimum hardware (TPM 2.0, Secure Boot, supported CPU family, RAM/storage), plan an in‑place upgrade and test critical apps/drivers. Free upgrades for eligible devices continue to be available through Windows Update.
• Priority 2 — Replace or buy smart:
• If hardware is incompatible, consider a new or refurbished Windows 11 device; many vendors list trade‑in and recycling options. Factor total cost of ownership and device compatibility when buying.
• Priority 3 — Migrate workloads:
• For older hardware that can’t run Windows 11 but still serves light web/email tasks, evaluate modern Linux distributions or ChromeOS Flex. These can reduce long‑term risk for non‑Windows workflows.
• Priority 4 — Harden and isolate:
• If the device must remain on unsupported Windows 10 without ESU, apply strong mitigations: restrict sensitive activities, use network segmentation, ensure up‑to‑date browser/third‑party software, and run a modern endpoint product that continues to support Windows 10. Treat such a device as untrusted if it connects to sensitive networks.

Recommended checklist: immediate actions for Windows 10 users​

• Verify Windows 10 is on version 22H2 and install all pending updates.
• Decide which enrollment path to use: free (MSA + Windows Backup), Rewards (1,000 points), or paid (~$30).
• If choosing the free route, sign in with an MSA, review Windows Backup categories, and enable only the sync items you accept. Turn off folder backup if you don’t want Documents/Desktop in OneDrive.
• Open Settings → Update & Security → Windows Update and click Enroll now when visible. Follow the wizard to confirm enrollment.
• Confirm monthly ESU updates appear in Windows Update and install them promptly.
• Use the year to migrate: test Windows 11 compatibility, evaluate replacement hardware, or rehearse a Linux/ChromeOS Flex transition if appropriate.

Risks and limitations — a candid assessment​

• Short horizon: ESU runs only through October 13, 2026. This is a finite bridge and will not protect against vulnerabilities discovered after that date unless alternative support is purchased or the device is upgraded.
• Limited scope: ESU brings only Critical and Important security fixes. Other important updates (stability, driver fixes, feature improvements) are not part of ESU. Those omissions can lead to functional and compatibility issues over time.
• Account dependence: the free path ties updates to a Microsoft account; lapses in sign‑in can remove entitlement, and privacy‑minded users must weigh the sync choices carefully. EEA rules reduce one risk, but account authentication remains required.
• False sense of permanence: users should not treat ESU as permission to delay migration indefinitely. The next year should be used for controlled, supported upgrades.

Final assessment and recommended approach​

• Enroll in ESU if the PC is essential and cannot upgrade immediately — prefer the free path if comfortable with the account and sync trade‑offs.
• Use the year to upgrade, replace, or migrate — test critical applications and drivers early.
• Harden any device left on unpatched Windows 10 and avoid sensitive work on unsupported systems.