Windows 10 ESU Enrollment: Why It May Not Appear and How to Fix

Windows 10 still receives a lifeline — but only if your PC is eligible and the enrollment UI finds you. Many users who expected the “Enroll now” option for the Windows 10 Extended Security Updates (ESU) reported it missing, hidden, or briefly flashing and closing; the reality is the ESU enrollment experience is gated behind specific requirements, a phased rollout, and a handful of fragile client-side checks. This guide explains exactly why the ESU option might not appear, verifies the technical prerequisites you must meet, walks through safe, reversible fixes (including the registry and command-line options circulating in support communities), and assesses the privacy, reliability, and long-term implications of relying on ESU to buy time while you plan an upgrade. Key claims and technical details below are cross-checked against Microsoft’s documentation and independent reporting to ensure accuracy.

Background / Overview​

Microsoft made a limited consumer ESU program available to eligible Windows 10 devices after mainstream support ended on October 14, 2025. The consumer ESU gives enrolled Home, Pro, Pro Education, and Workstation devices running Windows 10, version 22H2 access to critical and important security updates through October 13, 2026. Enrollment is presented in-OS through a staged Settings wizard (Settings → Update & Security → Windows Update), and Microsoft documented three consumer paths: a free route (back up / sync settings to OneDrive while signed in with a Microsoft account), redeeming Microsoft Rewards points, or a paid one-time purchase. Enrollment availability is phased and depends on servicing updates and account/device state. The visible symptoms users experience when the ESU option “is not showing” fall into a short list of root causes. In order of likelihood:

• The device is not on Windows 10 version 22H2 or lacks the required cumulative / servicing stack updates (notably mid-2025 fixes).
• You’re signed in with a local account or a non-administrator user; consumer enrollment paths generally require a Microsoft account (MSA) with admin rights.
• The machine is domain-joined or MDM-managed (enterprise devices must use volume-licensing ESU channels).
• Microsoft’s rollout is staged and the enrollment wizard hasn’t reached your device yet; or a client UX bug prevented the wizard from appearing until certain patches were applied (community threads and Microsoft updates documented a necessary fix).

Below is a step-by-step breakdown — what to check first, safe fixes to make the enrollment UI appear, how to verify entitlement, and what to avoid.

---

What Microsoft requires (verified)​

Minimum OS and edition​

• Device must run Windows 10, version 22H2 (consumer SKUs: Home, Pro, Pro Education, Workstation). Devices on earlier builds or LTSC variants are not eligible for the consumer ESU enrollment wizard.

Updates and servicing​

• The device must have the latest cumulative updates and the appropriate Servicing Stack Update (SSU) applied. Microsoft shipped mid-2025 fixes that made the enrollment wizard stable; missing those updates is the most common reason the ESU control won’t appear. Independent community tracking named specific cumulative patches that remedied enrollment failures.

Account and device state​

• For the free consumer route, Microsoft requires signing in with an administrative Microsoft account on the device. Local accounts are not eligible for the free backup-backed enrollment path (paid and Rewards routes are alternatives that are also tied to a Microsoft account). Devices joined to Active Directory or managed via enterprise MDM must use commercial ESU methods instead.

Program timeline​

• Consumer ESU coverage runs through October 13, 2026. Enrollment is available at no charge via the sync option (or via issues described in your region) or via a paid/Rewards option per Microsoft’s published guidance.

---

Quick checklist — confirm these first​

Before you make changes, run this fast verification list. Each item is quick and often resolves the missing enrollment UI without further tweaks.

• Confirm Windows build: Run winver and verify Version 22H2 (build 19044 / 19045 family). If not 22H2, update to 22H2 first.
• Open Settings → Update & Security → Windows Update and install all available updates, including SSUs. Reboot.
• Ensure you are signed in with an MSA that has administrator privileges. If you’re on a local account, sign in or add an MSA.
• Confirm the device is not domain-joined or MDM-managed: Settings → Accounts → Access work or school. Remove any stale organization connections if this is a personal device.
• Wait a short time after applying updates — Microsoft’s rollout is phased; some devices needed hours or days for the ESU control to appear.

If the enrollment option still doesn’t appear after the above, proceed with the safe troubleshooting flows below.

---

Safe, reversible troubleshooting (step-by-step)​

These are the common, community-validated steps used by Microsoft support staff and experienced administrators to force Windows to re-evaluate ESU eligibility and surface the enrollment UI. They are reversible and widely tested — but treat registry edits and service configuration changes with the usual care: back up the registry or create a restore point first.

1) Ensure sign-in services and key Windows services are running​

The enrollment wizard relies on a few Windows services used for sign-in and entitlement checks. Open an elevated PowerShell and run:

• Get-Service wlidsvc, VaultSvc, LicenseManager
• If any is stopped or disabled, make them startable:
• Set-Service -Name wlidsvc -StartupType Automatic; Start-Service -Name wlidsvc
• Set-Service -Name VaultSvc -StartupType Manual; Start-Service -Name VaultSvc
• Set-Service -Name LicenseManager -StartupType Manual; Start-Service -Name LicenseManager

Community troubleshooting repeatedly shows fixing these service states resolved the “wizard opens then closes” symptom.

2) Apply the enrollment-fix cumulative/SSU (if missing)​

Identify whether your system has the mid-2025 cumulative that fixed enrollment crashes (community reports referenced KB numbers such as KB5063709 and later out-of-band patches). If Windows Update isn’t offering the required LCU/SSU, download the matching SSU and LCU from the Microsoft Update Catalog and install them, following the published SSU-first rule. Reboot and re-check Windows Update for the ESU enrollment banner.

3) Enable telemetry briefly (DiagTrack) and use the feature-override​

Some enrollment checks depend on feature-flag signals that use the Connected User Experiences and Telemetry service. The sequence below is a widely used, reversible method to force the local enrollment UI to run:

• Open an elevated Command Prompt and run:
• sc.exe config DiagTrack start=auto
• sc.exe start DiagTrack
• Add the Feature Management override that triggers the local UI:
• reg.exe add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 4011992206 /t REG_DWORD /d 2 /f

This specific numeric override (4011992206) is the community-documented feature flag used to tell the local system to treat the ESU enrollment UI as enabled; it does not provision a license by itself — it only forces the local eligibility check to run.

• Reboot.
• After reboot, run the built-in consumer eligibility tool as admin:
• cmd /c ClipESUConsumer.exe -evaluateEligibility
• Reboot again and open Settings → Update & Security → Windows Update. The “Enroll now” banner should appear if all prerequisites are met.

If you want to undo the override: reg delete "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 4011992206 /f
Notes: enabling DiagTrack re-enables a limited telemetry channel; disable it after enrollment (sc.exe config DiagTrack start=disabled & sc.exe stop DiagTrack) if you prefer, but do not disable it until the enrollment completes successfully.

4) The registry “ConsumerESU” visibility trick (user-account level)​

Some help articles and troubleshooting guides — and the Guiding Tech how-to — describe creating a ConsumerESU key under the current user registry hive that can make the enrollment prompt appear or let you confirm the evaluation result. Steps (Admin privileges required to make some checks):

• Open regedit (Win + R → regedit).
• Navigate to:
• HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
• Create a new key named ConsumerESU if it doesn’t exist.
• Under ConsumerESU create two DWORD (32-bit) values:
• ESUEligibility — set Value data to 2
• ESUEligibilityResult — set Value data to 1
• Restart Windows and check Settings → Update & Security → Windows Update.

This method appears in multiple community write-ups as a local way to show the ESU prompt or to inspect the ConsumerESU evaluation values that ClipESUConsumer.exe writes. It is primarily diagnostic and should be used carefully — it does not by itself entitle you to updates if your device fails the real eligibility checks on Microsoft’s servers.

5) Repair sign-in and Store components if the wizard launches then quits​

If the enrollment wizard opens but fails during sign-in, the cause is often corrupted in-app sign-in components, WebView2, or Store/AAD broker packages. Actions that have fixed this for many users include:

• Reset the Microsoft Store (wsreset.exe) and re-register Store/AAD broker packages with PowerShell Add-AppxPackage.
• Clear Windows credentials for Microsoft accounts in Credential Manager and re-add the account.
• Reinstall or repair the WebView2 runtime.
• Add your MSA explicitly under Settings → Accounts → Email & accounts.

---

How to verify ESU enrollment (authoritative checks)​

After completing enrollment, confirm entitlement with these practical checks:

• Windows Update history: Settings → Update & Security → View update history. ESU-labeled rollups will appear once Microsoft begins delivering ESU updates to your device.
• Event Viewer: Applications and Services Logs → Microsoft → Windows → ClipESU → Operational. Successful evaluation events (Event ID examples exist in community diagnostics) indicate the device accepted the ESU evaluation.
• Activation / licensing tools for on-device checks (advanced): Run slmgr.vbs /dlv in an elevated Command Prompt and inspect the output for ESU-related add-on license entries when manual keys are used. Note: consumer in-OS enrollment attaches an entitlement to the Microsoft Account; license shows differently for volume or key-based activations.

If you have followed the enrollment flow and ESU rollups are not offered, revisit your update history, check ClipESU logs, and ensure the MSA used for enrollment remains signed in on the device (some enrollment paths require periodic account check-ins in certain regions).

---

Practical cautions, privacy, and costs​

• OneDrive storage trap: The free sync/back-up route uses OneDrive to bind the ESU entitlement to your Microsoft account. Free OneDrive accounts include only 5 GB of storage; if your backup requires more, Microsoft will prompt for paid storage — making the “free” ESU path potentially lead to a storage cost. Consider the Rewards or paid one-time purchase alternative if you don’t want cloud sync.
• Telemetry and privacy: Some troubleshooting steps require enabling the DiagTrack service, which enables a telemetry channel for feature-management signals. This channel is limited for the enrollment flow, but privacy-conscious users should be aware of it and may want to disable it after enrollment completes. Do not disable it during enrollment.
• Registry and service edits: The override and registry tweaks described are reversible and act only on the local UI/eligibility evaluation. They do not create back-end entitlements or bypass Microsoft’s eligibility rules. Do not attempt to bypass management or licensing policies on enterprise devices — doing so risks policy violations.
• Managed devices and compliance: If your PC is or was ever enrolled in a work/school tenant, leftover configuration or registry traces can misclassify it as a managed device and block consumer ESU. In that case, the correct path is enterprise/licensing channels — coordinate with IT. Do not attempt to override enterprise classification on corporate machines.

---

What Microsoft did right — and where the model is fragile (analysis)​

Strengths:

• Microsoft offered a pragmatic consumer path to get at least one more year of security patches for eligible Windows 10 systems, using a low-friction in-OS enrollment UX and multiple enrollment choices (sync, Rewards, paid). That gave users time to plan upgrades.
• When enrollment UI bugs appeared early in the rollout, Microsoft issued out-of-band fixes and cumulative patches quickly, reducing the window in which eligible devices were blocked from receiving updates. Independent community reporting and Microsoft guidance confirm the mid-2025 fixes remedied most problems.

Risks and fragility:

• The enrollment UX acts as a single gate for updates; minor regressions or missing client-side updates can leave many devices exposed. The reliance on staged rollouts, feature flags, and client telemetry makes the path surprisingly brittle for consumer systems with stricter privacy settings or unusual configurations.
• Tying a free security path to cloud sync introduces an awkward privacy and cost trade-off: the free entitlement can require enabling cloud backups and potentially purchasing OneDrive storage. This undermines the “free” promise for users who deliberately avoid cloud services.

Conclusion of analysis: ESU is a practical stopgap and Microsoft has been responsive, but the consumer path is intentionally constrained and dependent on multiple client-side factors. It’s a tool to buy time — not a substitute for migrating to a supported OS.

---

Troubleshooting quick-reference (copy/paste checklist)​

• Check winver → Must be Windows 10, version 22H2.
• Windows Update → Install all updates (SSU + LCU). Reboot.
• Sign in with an administrator Microsoft Account (MSA).
• If still no “Enroll now”: Run as admin:
• sc.exe config DiagTrack start=auto
• sc.exe start DiagTrack
• reg.exe add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 4011992206 /t REG_DWORD /d 2 /f
• Reboot
• cmd /c ClipESUConsumer.exe -evaluateEligibility
• Reboot and check Settings → Update & Security → Windows Update.
• If wizard opens then fails: Reset Store (wsreset.exe), re-register AAD/Store packages, repair WebView2, and clear Microsoft credentials in Credential Manager. Reboot and retry.
• Verify enrollment: Check Windows Update history, ClipESU event logs, and slmgr output if needed.

---

When to escalate to Microsoft Support or IT​

• If your PC is legitimately domain-joined or enterprise-managed: consumer enrollment is blocked — coordinate with your organization’s licensing/IT.
• If ClipESUConsumer.exe returns no useful output or event logs show failures after prerequisites are met: gather logs and escalate to Microsoft Support or a Microsoft Q&A thread with exact error messages and winver output.
• If you cannot install a critical cumulative because it breaks essential hardware or apps: consider repair install or consult vendor support before applying patches. Community experiences show in-place repair installs fixed stubborn enrollment issues, but always back up first.

---

Final words: Use ESU to buy time — plan to migrate​

If the ESU option is not showing, the correct first move is to verify build, install required servicing updates, and sign in with an MSA. Only after those steps should you use the feature-override or registry techniques to force a re-evaluation; those methods are widely used and reversible, but they are diagnostic triggers rather than licensing shortcuts. ESU provides a valuable safety cushion for eligible Windows 10 PCs, but it is explicitly time-limited and lower in scope (security-only) than full support. Treat ESU as a bridge, not a destination — use it to secure devices temporarily while you plan and execute an upgrade to Windows 11 or a supported alternative. If the enrollment UI is still missing after following the documented steps above (confirming 22H2, installing the required LCUs and SSUs, signing in with an admin MSA, and running the ClipESUConsumer evaluation), collect the exact winver build string, the update KBs installed, and any ClipESU / WindowsUpdate log artifacts before opening a support request — that information will dramatically shorten diagnostics and lead to a resolution faster.

---

---

Source: Guiding Tech Windows 10 ESU Option Not Showing – What to Do