Microsoft’s final free security updates for Windows 10 stop on October 14, 2025 — and if you want another year of critical patches you must take action now to enroll in the consumer Extended Security Updates (ESU) program, update to the required build, and meet Microsoft’s enrollment rules.
Windows 10 reaches the end of its mainstream servicing lifecycle on October 14, 2025. After that date Microsoft will stop delivering routine feature updates, non-security quality fixes and the normal stream of free monthly security patches for consumer editions of Windows 10 (Home, Pro, Pro Education and Workstations). Your PC will continue to boot and run, but without vendor security fixes it becomes progressively riskier to use online, especially for sensitive work, banking, or anything exposed to the internet.
Microsoft has published a short-term, consumer-facing escape hatch: the Windows 10 Consumer Extended Security Updates (ESU) program. ESU is deliberately narrow — it delivers only Critical and Important security fixes (security-only updates) for eligible Windows 10 devices for one additional year, with coverage running through October 13, 2026 for enrolled devices. ESU is not a long-term support plan; it is a one-year bridge to let individuals migrate to Windows 11, replace aging hardware, or complete a careful transition.
This article explains exactly what is changing, what ESU does and does not provide, who is eligible, the enrollment options and traps, and the precise steps to take in the next 72 hours to avoid being unprotected after October 14.
Key EEA specifics you must know:
Microsoft set a firm deadline; the technical facts and the enrollment mechanisms are now public. The next few days are the critical window to avoid an immediate exposure to unpatched vulnerabilities: update your machine, back everything up, sign in with the Microsoft Account you intend to use, and enroll if you plan to keep Windows 10 for the extra year. The ESU year is a lifeline — use it deliberately to migrate, not as an excuse to delay indefinitely.
Source: Forbes Microsoft’s Free Windows Offer Ends In Days: You Need To Act Right Now
Windows 10 reaches the end of its mainstream servicing lifecycle on October 14, 2025. After that date Microsoft will stop delivering routine feature updates, non-security quality fixes and the normal stream of free monthly security patches for consumer editions of Windows 10 (Home, Pro, Pro Education and Workstations). Your PC will continue to boot and run, but without vendor security fixes it becomes progressively riskier to use online, especially for sensitive work, banking, or anything exposed to the internet.Microsoft has published a short-term, consumer-facing escape hatch: the Windows 10 Consumer Extended Security Updates (ESU) program. ESU is deliberately narrow — it delivers only Critical and Important security fixes (security-only updates) for eligible Windows 10 devices for one additional year, with coverage running through October 13, 2026 for enrolled devices. ESU is not a long-term support plan; it is a one-year bridge to let individuals migrate to Windows 11, replace aging hardware, or complete a careful transition.
This article explains exactly what is changing, what ESU does and does not provide, who is eligible, the enrollment options and traps, and the precise steps to take in the next 72 hours to avoid being unprotected after October 14.
What’s ending on October 14, 2025 — the essentials
- The free, routine stream of Windows 10 security updates and feature updates ends on October 14, 2025.
- After that date Microsoft will no longer provide standard technical assistance, feature or quality updates for consumer Windows 10 editions.
- A machine running Windows 10 will still work after October 14, 2025 — but without updates it becomes increasingly exposed to security vulnerabilities.
- Microsoft’s guidance: upgrade eligible PCs to Windows 11 where possible; if you cannot, enroll the device in consumer ESU or replace the device.
What the consumer ESU program actually is
Short, security-only coverage
- ESU delivers only the security fixes that Microsoft classifies as Critical or Important. It does not deliver feature updates, non-security stability/quality improvements, or general technical support.
- ESU coverage for enrolled consumer devices runs through October 13, 2026 — one year beyond the Windows 10 cutoff.
Eligibility and prerequisites (what your PC must be running)
- Your device must be on Windows 10, version 22H2 (consumer SKUs: Home, Pro, Pro Education, Workstations).
- The device must have the latest cumulative updates / servicing stack updates installed — Microsoft rolled a patch in August 2025 (the combined cumulative update) that fixed enrollment problems and helped surface the ESU enrollment flow. Install all pending Windows Updates before you attempt to enroll.
- Enrollment is tied to a Microsoft Account (MSA) and requires administrator privileges to complete the process on the device.
Who cannot use consumer ESU
- Domain-joined or corporate-managed devices enrolled via MDM, kiosk devices, and many enterprise scenarios are excluded; businesses should use corporate licensing / commercial ESU channels instead.
How to get the extra year — the three enrollment paths
When your device meets the prerequisites, Microsoft surfaces an Enroll now option inside Settings → Update & Security → Windows Update. The enrollment wizard walks you through the available choices. There are three consumer enrollment paths:- Free (no direct fee) — enable Windows Backup / sync PC Settings to OneDrive while signed into a Microsoft Account on the device. This ties the ESU entitlement to your MSA and the synced device.
- Free (if you already have them) — redeem 1,000 Microsoft Rewards points in your Microsoft account.
- Paid — one-time purchase ≈ $30 USD (local currency equivalent, taxes may apply). The paid one-time purchase can be used across up to 10 devices tied to the same MSA.
Step-by-step: immediate actions (what to do in the next 72 hours)
- Back up everything now.
- Create a full disk image and a separate copy of your critical files to an external drive or cloud storage.
- A good backup is your safety net if anything goes wrong during updates or migration.
- Confirm Windows version and install updates.
- Settings → System → About: confirm Windows 10, version 22H2.
- Settings → Update & Security → Windows Update: Install all pending updates. The August 2025 cumulative rollup contained fixes that made ESU enrollment more reliable; ensure those updates are applied.
- Sign in with a Microsoft Account (MSA).
- If you plan to use the free sync option or redeem Rewards, sign into Windows with the MSA you want to use for ESU. Make sure the account is an adult (not a child) account.
- Open Settings → Update & Security → Windows Update.
- Look for the Enroll now banner or link. If it is present, follow the wizard to complete enrollment (choose the free sync, redeem Rewards, or pay the one-time $30 charge).
- Verify enrollment and updates.
- After enrollment confirm that Windows Update shows ESU updates being offered and that cumulative security patches are installing.
- If you can upgrade to Windows 11, run the upgrade planning steps.
- Use PC Health Check to confirm eligibility (TPM 2.0 and Secure Boot are the most common blockers). If eligible, plan and test the upgrade, making sure important applications and drivers are compatible.
Regional nuance: the European Economic Area (EEA) concession and the 60‑day rule
Regulatory pressure and consumer advocacy prompted Microsoft to change the consumer ESU experience for residents of the European Economic Area (EEA). The EEA concession removed the forced OneDrive backup requirement that applied elsewhere and made free ESU access available to EEA consumers — but it did not remove the Microsoft Account requirement.Key EEA specifics you must know:
- EEA consumers can get free ESU without the OneDrive/settings-backup precondition, but a Microsoft Account is still required.
- Microsoft requires periodic re-authentication: if the Microsoft Account used to enroll is not used to sign in for a period of up to 60 days, ESU updates will be discontinued for that device and the user must re‑enroll by signing in using the same MSA.
- The 60-day check is effectively an active upkeep rule: you must sign into Windows with the same Microsoft Account at least once every 60 days to maintain the free EEA entitlement.
Common enrollment snags and how to fix them
- Staged rollout: Microsoft rolled ESU enrollment out in phases. If you don’t see the Enroll now option, make sure you meet prerequisites, install the latest cumulative and servicing updates, reboot, and check again. The August 2025 cumulative update fixed several enrollment wizard crashes.
- Local accounts: ESU enrollment requires signing in with an MSA during the process. If you’re using a local account, expect to be prompted to sign into a Microsoft Account to complete enrollment — the wizard won’t accept purely local-only workflows except for the paid route after you sign in to make the purchase.
- OneDrive capacity: the free sync route uses Windows Backup to OneDrive. OneDrive’s free tier is small (5 GB); if your Windows Backup demands exceed that, you may be prompted to purchase more OneDrive storage or select the paid ESU option.
- Payment / Rewards hiccups: there are real-world reports of temporary failures when redeeming Microsoft Rewards points or completing purchases through the wizard. If a transaction fails retry or use an alternate enrollment path (sync or paid).
What ESU does not protect against — the hidden risks
- No feature updates or driver updates: ESU does not include new Windows features, firmware/driver updates or non-security quality fixes. Over time hardware and drivers may become incompatible with modern applications or games even if security patches continue.
- Third-party software vulnerability exposure: security of your system depends on the whole stack. Unsupported applications, browsers, or plug-ins can still be attack vectors.
- Anti-cheat, DRM and compatibility: some game anti-cheat systems and modern applications may only be maintained against supported OSes. Running an out-of-support OS risks breakage or blocked online access for some titles.
- Privacy and account trade-offs: the free ESU paths push account-based entitlements and cloud sync. That may be acceptable for many users, but privacy-focused individuals who avoid cloud accounts face either the paid route or migrating away from Windows.
- False sense of safety: ESU buys time, not permanence. Treat the extra year as a migration runway — not a new baseline.
Migration options and practical trade-offs
- Upgrade to Windows 11 (best long-term security and features)
- Pros: continued free feature and quality updates, stronger security model in modern hardware, Microsoft support.
- Cons: hardware requirements (TPM 2.0, Secure Boot, supported CPU) rule out many older PCs.
- Replace hardware
- Pros: move to a supported platform and newer hardware; less hassle if your PC is very old.
- Cons: cost, e-waste considerations.
- Switch to Linux or other OS
- Pros: keep older hardware useful; many user-friendly, long-term supported distributions exist.
- Cons: application compatibility (Windows-only apps), driver support for very recent or niche hardware, learning curve.
- Keep Windows 10 under ESU for one year
- Pros: security patches for known critical issues, time to plan and test migration.
- Cons: limited scope, periodic account checks in EEA, potential for compatibility degradation over time.
Practical checklist before Oct 14 — an actionable timeline
- Immediately (within 24 hours)
- Full disk image backup + file copy.
- Confirm Windows 10 version 22H2 and install all updates (especially August 2025 cumulative).
- Decide your ESU path (OneDrive sync + MSA, Redeem 1,000 Rewards, or pay $30).
- Within 48 hours
- Sign in with the Microsoft Account you will use for ESU and enable Windows Backup if you choose the free sync option.
- Open Settings → Update & Security → Windows Update and enroll if the option is present.
- If you cannot enroll because the wizard is not yet visible, keep updating and retry — the rollout was phased.
- Within a week
- If you plan to upgrade to Windows 11, run PC Health Check, test compatibility for drivers and critical apps, and schedule the upgrade.
- If you choose ESU, verify that Windows Update is delivering security-only patches after enrollment.
- If you enroll via EEA free path
- Set a calendar reminder to sign in with the same Microsoft Account at least once every 60 days to keep ESU active.
Financial and practical notes
- The paid ESU one-time purchase is approximately $30 USD (local equivalent and tax may apply). That purchase can be used on up to 10 devices tied to the same Microsoft Account.
- Redeeming 1,000 Microsoft Rewards points is a free option if you already have points.
- The OneDrive sync free option can be the quickest route for many home users, but it does require signing in and, depending on your backup footprint, may require OneDrive storage beyond the free 5 GB tier.
Regulatory, privacy and consumer concerns
Microsoft’s consumer ESU choices expose clear policy tensions:- Pushing an MSA and cloud sync for free security updates is a business decision with privacy implications. That decision raised pushback from consumer groups in Europe and led to a regional concession for the EEA.
- The EEA concession removes the OneDrive sync requirement but retains the Microsoft Account requirement and introduces an active 60‑day re‑authentication rule to prevent circumvention.
- The outcome is a pragmatic compromise that avoids an immediate security cliff for many European users, but it preserves Microsoft’s account-centric control model for entitlements.
Final verdict — what WindowsForum readers should do now
- If your PC can run Windows 11 and your applications/drivers are compatible: plan and schedule the upgrade — this is the cleanest long-term route.
- If your PC cannot run Windows 11 and you must remain on Windows 10 for now: enroll in ESU before October 14, 2025. The fastest, most frictionless routes are signing into a Microsoft Account and enabling Windows Backup (free path) or using the paid one-time purchase (if you want to avoid ongoing cloud sign-ins).
- Whatever you choose: backup, patch, verify. Install the latest cumulative updates now, create a full disk image, and make sure you have a tested recovery plan.
- Treat ESU as time to migrate, not as a long-term strategy. Use the year to move to a supported platform or carefully migrate to alternative environments.
Quick reference: the two hard calendar dates
- October 14, 2025 — Last day Microsoft provides free routine security updates for Windows 10 consumer editions.
- October 13, 2026 — Final day of consumer ESU security updates for enrolled Windows 10 devices.
Microsoft set a firm deadline; the technical facts and the enrollment mechanisms are now public. The next few days are the critical window to avoid an immediate exposure to unpatched vulnerabilities: update your machine, back everything up, sign in with the Microsoft Account you intend to use, and enroll if you plan to keep Windows 10 for the extra year. The ESU year is a lifeline — use it deliberately to migrate, not as an excuse to delay indefinitely.
Source: Forbes Microsoft’s Free Windows Offer Ends In Days: You Need To Act Right Now