Microsoft has closed the mainstream support chapter for Windows 10 but left a practical — if strictly temporary — lifeline in place: Extended Security Updates (ESU). Organizations and consumers can continue to receive security-only fixes through October 13, 2026, provided devices meet specific technical baselines, activation flows are followed, and account/entitlement rules are respected. This feature-length report breaks down the requirements, the activation IDs and commands you need, the Windows 365/Cloud PC entitlements and registry checks, the consumer enrollment options (including the free routes), and the operational risks every admin and power user must understand before committing to ESU as a migration bridge.
Background / Overview
Microsoft ended mainstream support for Windows 10 on October 14, 2025, and released the final broadly‑distributed cumulative package identified as KB5066791 (OS builds 19044.6456 and 19045.6456) to establish the servicing baseline for ESU enrollment and validation. Devices that are not enrolled in ESU will no longer receive regular security updates after the vendor’s cutoff. The ESU program is intentionally time‑boxed and focused on delivering only security‑classified fixes (Critical and Important) — it is not a substitute for migration to a supported OS. Two distinct ESU tracks exist:
- Consumer ESU (one-year window through Oct 13, 2026): Offers three enrollment routes — a no‑cost path when a device is signed into a Microsoft Account and uses Windows Backup / Settings sync, a Microsoft Rewards redemption (1,000 points), or a one‑time paid purchase (about US$30). The consumer entitlement is account‑bound and can often be applied across multiple eligible devices tied to the same Microsoft Account within published limits.
- Commercial / Volume ESU (up to three years): Sold through Microsoft volume licensing channels or CSPs, licensed per device and activated with a 5x5 Multiple Activation Key (MAK). Enterprises must obtain the MAK from the Microsoft 365 admin center and activate devices using Microsoft’s documented volume activation commands.
Treat ESU as a temporary bridge — essential for remediation windows, legacy apps, and slow hardware refresh cycles — but costly and operationally brittle if relied upon long term.
Requirements: Minimum Baselines and Hardware/Software Preconditions
Operating system and servicing baseline
- Devices must be running Windows 10, version 22H2 (consumer SKUs such as Home, Pro, Pro Education, and Workstation are included) and be patched to the October 14, 2025 servicing baseline (KB5066791 or later) before ESU activation will succeed. Attempts to activate ESU on systems that do not meet the baseline will fail.
- The KB5066791 combined package includes the latest Servicing Stack Update (SSU) and an LCU; administrators should ensure SSUs are installed first if servicing images are being prepared offline.
Accounts and enrollment rules
- Consumer ESU enrollment is tied to a Microsoft Account (MSA). Local, offline accounts will not complete the consumer enrollment route; the enrollment wizard will prompt for sign‑in. The one‑time paid purchase, Rewards redemption, or free Windows Backup route all bind entitlement to an MSA.
- Commercial ESU requires appropriate admin roles in the Microsoft 365 admin center to access MAKs (Product Key Reader or VL Administrator), and devices must have administrative rights to run the activation commands unless you push automation through management tooling.
Network and activation endpoints
- ESU activation and validation require outbound access to Microsoft activation and licensing endpoints. Do not attempt to allowlist static IPs; allow domain and URL egress for the relevant Microsoft services because IP ranges can change. Failure to permit these endpoints (activation.sls.microsoft.com, activation‑v2.sls.microsoft.com, validation*.sls.microsoft.com, and related licensing/purchase endpoints) is among the most common causes of activation failures in enterprise networks.
Windows 365 / cloud entitlement nuance
- Microsoft provides automatic ESU coverage for many Microsoft‑hosted cloud scenarios (for example, Azure Virtual Desktop, Azure VMs, Windows 365 Cloud PCs). However, local physical endpoints that connect to Windows 365 Cloud PCs can also be entitled if they meet the enrollment and sign‑in requirements and relevant registry flags are set. Microsoft’s guidance for verifying Windows 365 ESU eligibility includes a registry check and an event log entry (ClipESU Event ID 113). The required registry key for subscription checking is HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\ESU with the EnableESUSubscriptionCheck value set to 1, and an eligibility flag Win10CommercialW365ESUEligible set to 1 on devices that completed enrollment.
Activation IDs, Keys and The Activation Process
Published Activation IDs
Microsoft published fixed
Activation IDs for Year 1, Year 2 and Year 3 commercial ESU programs that must be used when performing activation via slmgr.vbs. Use the Activation ID corresponding to the ESU year you purchased:
- Win10 ESU Year 1: f520e45e-7413-4a34-a497-d2765967d094
- Win10 ESU Year 2: 1043add5-23b1-4afb-9a0f-64343c8f3f8d
- Win10 ESU Year 3: 83d49986-add3-41d7-ba33-87c7bfb5c0fb
These Activation IDs are consistent across eligible Windows ESU editions and devices. Use the year‑exact ID to avoid activation problems.
How to retrieve the MAK (commercial ESU)
Administrators with the right roles can retrieve the
MAK (5x5 Multiple Activation Key) in the Microsoft 365 admin center under Billing → Your products → Volume licensing → View contracts → View product keys. If the key is not visible, verify admin role assignments and purchase mapping or contact your reseller/Microsoft support. Document the MAK and control access to avoid leakage.
Activation steps (canonical online flow)
- Open an elevated Command Prompt on the client.
- Install the ESU MAK:
slmgr.vbs /ipk <ESU MAK>
(A Windows Script Host dialog confirms successful key install.
- Activate with the correct Activation ID for your purchased ESU year:
slmgr.vbs /ato <Activation ID>
(This invokes online activation against Microsoft activation servers.
- Verify activation:
slmgr.vbs /dlv
The output should list the ESU program name and show License Status = Licensed.
For offline or air‑gapped devices, Microsoft supports phone activation or proxy activation using the Volume Activation Management Tool (VAMT). VAMT is also recommended for bulk activation tracking and for environments that require a proxy to Microsoft activation endpoints.
Windows 365 and Registry Verification: What To Check
When relying on Windows 365 entitlements or Cloud PC-linked coverage, run these checks to verify enrollment and update readiness:
- Registry flag to enable ESU subscription checks (on the physical endpoint that connects to the Cloud PC):
- Key: HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\ESU
- Name: EnableESUSubscriptionCheck
- Type: REG_DWORD
- Value: 1.
- Eligibility flag once the device has completed enrollment:
- Name: Win10CommercialW365ESUEligible (REG_DWORD = 1).
- Event log: Applications and Services Logs → Microsoft → Windows → ClipESU → Event ID 113 indicates successful Windows 365 ESU license installation for the user/device scenario.
A policy/MDM toggle exists (EnableESUSubscriptionCheck) that admins can deploy via
Intune or other MDM solutions; the Policy CSP entry and ADMX/Group Policy equivalents are documented on Microsoft Learn. Use these managed policy channels to automate subscription checks and to scale verification across fleets.
Consumer Enrollment Options — Free, Rewards, or Paid
Microsoft provided three consumer routes to receive ESU updates through October 13, 2026:
- Free (no cash): Sign into Windows with a Microsoft Account and enable Windows Backup / Sync your settings to OneDrive. This path often registers the device to the user’s MSA and grants ESU entitlement with no monetary charge. Enrollment is phased and depends on preparatory updates being installed.
- Microsoft Rewards: Redeem 1,000 Microsoft Rewards points to enroll. This is useful for users who have accumulated points.
- One‑time purchase via Microsoft Store: A roughly US$30 one‑time purchase binds ESU entitlement to the purchaser’s Microsoft Account and is often presented as a small Store token (roughly 0.1 MB) rather than a bulk download. This purchase can typically cover multiple devices tied to the same MSA (implementation limits apply).
Important consumer caveats:
- The free and paid consumer flows require an MSA. Local accounts are not supported for consumer ESU enrollment; users will be prompted to sign in with an MSA during the enrollment wizard.
- In some regions the backup requirement or the periodic sign‑in cadence has been modified for regulatory or privacy compliance reasons; the EEA received specific adjustments. Verify the regional messaging shown by the enrollment wizard on your device. Some Microsoft documentation and partner guidance recommend stricter sign‑in cadences (for example, 22 days) than the publicly documented at least once every month, so implement the stricter cadence where operationally feasible and monitor for entitlement lapses. Flag: this cadence varies across documentation and community reports — validate the exact requirement for your tenant or consumer account scenario before relying on it.
Deployment at Scale: Tooling, Automation and Verification
Enterprises should treat ESU deployment as a controlled project. Recommended operational approach:
- Inventory and classify endpoints by OS build, upgradeability, internet exposure, and business criticality. Prioritize internet‑facing and regulated systems for ESU coverage.
- Apply prerequisites and KBs first, ensuring systems are on 22H2 + KB5066791 (or later). Test deployments of KB5066791 across representative device models and driver stacks.
- Obtain MAKs and store them securely; assign visibility only to required admin roles in Microsoft 365 admin center.
- Use management tools for activation:
- Intune: deploy scripts that run slmgr.vbs /ipk and slmgr.vbs /ato; use Policy CSPs to enforce EnableESUSubscriptionCheck and to query registry flags.
- Configuration Manager (SCCM) or RMM: push elevated scripts to install keys and run activation.
- VAMT (Volume Activation Management Tool): recommended for offline or segmented networks to proxy activation and track MAK consumption.
- Verify enrollment and activation:
- For MAK activations: slmgr.vbs /dlv → License Status must be Licensed and show the ESU program name.
- For Windows 365 entitlements: query the registry keys shown earlier and check Event ID 113 in ClipESU logs. Automate these checks and feed results into your CMDB or SIEM for auditability.
- Test the update delivery pipeline end‑to‑end (pilot -> ring -> prod), validate update installation, and capture rollback points (images/snapshots) before mass activation. Maintain a clear expiration and migration timetable — ESU is finite and renewal prices typically escalate year‑over‑year.
Troubleshooting and Known Gotchas
- Fake “end of support” banners: Some devices showed an incorrect EOL notification in Settings after KB5066791. Microsoft confirmed this was a UI bug and deployed a cloud fix; do not rely on the Settings banner as the final authority — check slmgr.vbs /dlv, ClipESU logs, and the registry keys for authoritative verification.
- Network/proxy issues: TLS interception, strict egress filtering, or missing allowlist entries for Microsoft activation and validation endpoints will block activation. Test egress connectivity from representative endpoints before broad activation.
- Wrong Activation ID or mis‑typed MAK: Using the wrong year’s Activation ID or a mis‑entered key will prevent activation. Keep a centrally auditable runbook with exact slmgr commands and the exact Activation ID strings to avoid human error.
- Driver and application vendor support: ESU covers Microsoft’s platform security updates only. Independent software and hardware vendors may stop delivering Windows 10 drivers or compatibility updates, which can leave systems functionally or operationally compromised even if they receive ESU patches. Evaluate vendor support lifecycles before buying ESU.
- Compliance limitations: ESU provides security‑only fixes. Regulated environments that require full vendor support or lower‑severity fixes may find ESU insufficient for compliance obligations. Consult legal/compliance teams before purchasing ESU as a long‑term compliance measure.
- Sign‑in cadence confusion: Microsoft documentation for many Windows 365 and consumer flows refers to periodic sign‑ins; some partner guidance and administrative notes reference a 22‑day re‑authentication cadence while Microsoft’s public guidance for consumer ESU uses phrasing like at least once every month or regional variants. This discrepancy matters because missed re‑authentication can drop entitlement; adopt the stricter cadence in policy until your tenant’s exact behavior is confirmed. Flag: verify the cadence for your exact environment because the guidance differs across documents and regions.
Practical Step‑By‑Step Guides
For enterprise admins: compact checklist
- Inventory and classify endpoints by risk and upgradeability.
- Confirm devices are on Windows 10 22H2 and fully updated with KB5066791 (or later).
- Obtain MAK from Microsoft 365 Admin Center (Product Key Reader or VL Admin role).
- Test activation in pilot using slmgr.vbs /ipk and /ato with the correct Activation ID.
- Verify with slmgr.vbs /dlv and check ClipESU logs or registry keys for Windows 365 scenarios.
- Automate via Intune/SCCM/VAMT, monitor activation logs and update delivery, and record MAK consumption.
- Plan and budget migration to Windows 11 or alternate platforms; treat ESU as a temporary bridge.
For consumers: quick enrollment path
- Confirm you’re on Windows 10, version 22H2 and apply all available Windows Updates (reboot if required).
- Sign in with a Microsoft Account (MSA) and enable Windows Backup / Sync your settings if you want the no‑cost route.
- Open Settings → Update & Security → Windows Update and look for the Enroll now banner to walk through the wizard. If it isn’t visible, confirm the device meets the prerequisites and that preparatory updates are applied.
- Choose the enrollment method: free (backup), Microsoft Rewards (1,000 points), or the Store purchase (~US$30).
Strengths, Risks and Final Assessment
Strengths
- Microsoft published explicit, scriptable activation commands and fixed Activation IDs — enabling automation and auditable activation flows for enterprises. This makes mass deployment achievable with modern endpoint management tooling.
- The consumer enrollment options (free sync, rewards, Store purchase) lower the barrier to receiving critical security updates for many home users that cannot upgrade immediately.
- Cloud entitlements for Azure/Windows 365 hosted scenarios provide a no‑cost path for many virtualized workloads, simplifying coverage for cloud-first estates.
Risks and limitations
- Time‑boxed and narrow scope: ESU supplies security‑only fixes through October 13, 2026 (consumer) or for the limited commercial term purchased; it is not a long‑term strategy. Migration planning is still required.
- Operational brittleness: Strict servicing baselines (KB prerequisites), network dependencies, account sign‑in cadence requirements and regional nuance introduce fragile points of failure that require testing and monitoring.
- Cost and compliance: Commercial ESU pricing escalates and may not satisfy compliance needs that demand full vendor support or older‑severity patches. For regulated environments, ESU’s narrow scope can be insufficient.
- Third‑party support erosion: Driver and application vendors can stop supporting Windows 10 even when ESU is active, creating compatibility or security gaps outside Microsoft’s patching scope.
- Ambiguous sign‑in cadence: Conflicting wording across Microsoft content and partner guidance about re‑authentication cadence (22 days vs. monthly) introduces operational ambiguity. Treat this as an operational risk and implement stricter checks until the tenant‑specific behavior is validated.
Conclusion
Extended Security Updates for Windows 10 are a practical, well‑documented stopgap: Microsoft provided the activation IDs, the slmgr‑based commands, registry/telemetry checks for Windows 365, and consumer enrollment paths that include a free option and modest paid alternative. However, ESU is finite, narrow in scope, and operationally demanding — it requires careful baseline compliance (22H2 + KB5066791), network preparation, and strict verification. For enterprises, automation via Intune, SCCM, or VAMT plus a robust verification runbook is essential. For consumers, the free MSA‑based path or a one‑time $30 purchase may offer a short window to migrate critical devices.
Use ESU as breathing room — not a destination. Document every activation action, verify entitlement status with slmgr and registry/event checks, pilot exhaustively, and prioritize migrations away from Windows 10 before the ESU coverage window closes.
Source: Windows Report
Windows 10 ESU: Requirements, Activation IDs & Installation Process