Microsoft set a hard deadline for Windows 10 support — October 14, 2025 — and has offered a narrowly scoped lifeline for holdouts: the consumer Extended Security Updates (ESU) program that extends security-only patches for one additional year, through October 13, 2026. This article explains exactly what that means, who qualifies, how to enroll, the technical and privacy trade‑offs, important gotchas (including a critical August patch you must install), and a practical checklist to protect your PC before the deadline. (support.microsoft.com) (support.microsoft.com)
Windows 10 has served as the default Windows desktop for a decade, but Microsoft’s lifecycle calendar is unambiguous: regular security updates, feature updates, and standard technical support end on October 14, 2025. Microsoft recommends upgrading eligible machines to Windows 11; for machines that cannot or will not upgrade, the consumer ESU program buys an additional year of critical and important security updates only. That consumer ESU window runs until October 13, 2026. (support.microsoft.com) (learn.microsoft.com)
Microsoft designed the consumer ESU path to be simple and broadly accessible: enrollment appears in Settings → Update & Security → Windows Update for qualifying devices, and consumers can choose one of three enrollment routes — free (sync your PC settings to a Microsoft account/OneDrive), redeem 1,000 Microsoft Rewards points, or one-time purchase for $30 (USD) that can cover up to ten devices tied to the same Microsoft account. The free path and rewards option make this an unusually consumer-friendly approach for what was historically an enterprise-only program. (support.microsoft.com)
Independent outlets and community reporting have documented rollout friction: users in some regions have not yet seen the enrollment wizard, and early testers encountered a crashing enrollment UI that Microsoft addressed via the August 2025 cumulative update KB5063709. That patch both delivers fixes and prepares the enrollment experience in Windows Update, so installing it is a critical prerequisite. (support.microsoft.com, techradar.com)
Microsoft has provided a realistic, if limited, bridge for Windows 10 users who need time — but that bridge is short and not without strings. Install updates now, back up your data, and decide whether to upgrade to Windows 11 (if eligible), purchase replacement hardware, migrate to an alternative platform, or enroll in ESU before the October 14 cutoff. The one‑year window buys time; use it to move to a supported platform rather than to postpone the inevitable. (support.microsoft.com, learn.microsoft.com)
Source: CNET If You're Still Running Windows 10, You Need to Do This One Thing Before Oct. 14
Background / Overview
Windows 10 has served as the default Windows desktop for a decade, but Microsoft’s lifecycle calendar is unambiguous: regular security updates, feature updates, and standard technical support end on October 14, 2025. Microsoft recommends upgrading eligible machines to Windows 11; for machines that cannot or will not upgrade, the consumer ESU program buys an additional year of critical and important security updates only. That consumer ESU window runs until October 13, 2026. (support.microsoft.com) (learn.microsoft.com)Microsoft designed the consumer ESU path to be simple and broadly accessible: enrollment appears in Settings → Update & Security → Windows Update for qualifying devices, and consumers can choose one of three enrollment routes — free (sync your PC settings to a Microsoft account/OneDrive), redeem 1,000 Microsoft Rewards points, or one-time purchase for $30 (USD) that can cover up to ten devices tied to the same Microsoft account. The free path and rewards option make this an unusually consumer-friendly approach for what was historically an enterprise-only program. (support.microsoft.com)
Why this matters now
Running an operating system that no longer receives security updates is a material security risk. Unpatched vulnerabilities are attractive to attackers and are often weaponized rapidly after disclosure; businesses with compliance obligations could find themselves exposed legally or financially if they keep unpatched Windows 10 machines in production. ESU is security-only — it does not deliver new features, non-security bug fixes, or broad technical support — but it does reduce immediate exposure for machines that need time to migrate. (learn.microsoft.com)Independent outlets and community reporting have documented rollout friction: users in some regions have not yet seen the enrollment wizard, and early testers encountered a crashing enrollment UI that Microsoft addressed via the August 2025 cumulative update KB5063709. That patch both delivers fixes and prepares the enrollment experience in Windows Update, so installing it is a critical prerequisite. (support.microsoft.com, techradar.com)
Who is eligible — the rules, spelled out
Eligibility for the consumer ESU is tightly scoped. To enroll a device you must meet all of the following:- Device is running Windows 10, version 22H2 (Home, Pro, Pro Education, or Workstation editions). (support.microsoft.com)
- All pending updates are installed — specifically the August 2025 cumulative (commonly referenced as KB5063709), which fixes enrollment bugs and adds the “Enroll now” flow to Settings → Windows Update. (support.microsoft.com)
- You sign into the device with a Microsoft account (MSA) with administrative privileges during enrollment; the ESU license is bound to that account. Local-only accounts are not supported for consumer ESU enrollment. (support.microsoft.com)
- The device must not be domain‑joined (Active Directory), Entra‑joined in some enterprise modes, in kiosk mode, or managed by enterprise MDM — those devices must use commercial ESU channels instead. (support.microsoft.com)
What Microsoft fixed (and why KB5063709 matters)
The August 2025 cumulative update KB5063709 is the practical gatekeeper for most consumer enrollments. It:- Installs the updated servicing components that enable the ESU enrollment option in Settings. (support.microsoft.com)
- Fixes a crash that prevented the ESU enrollment wizard from completing in early rings. (igorslab.de)
- Includes release-health advisories — notably, Microsoft called out a Secure Boot certificate expiration lifecycle item in the update documentation that owners should review because it may affect certain devices in mid‑2026 if firmware updates are not applied. Administrators and power users should inventory firmware updates now. (support.microsoft.com)
How to enroll — step-by-step (consumer)
Follow these steps exactly to enroll a consumer device in ESU. Complete them before Oct 14, 2025 if you want continuous coverage into the ESU window.- Confirm Windows 10 version: open Settings → System → About and verify Windows 10, version 22H2. If not, install the 22H2 update first. (support.microsoft.com)
- Install all pending updates: Settings → Update & Security → Windows Update → Check for updates. Ensure KB5063709 (August 2025 cumulative) or later is installed. Reboot if prompted. (support.microsoft.com)
- Back up everything: create a full disk image and copy critical files to at least one independent destination (external drive or another cloud), then verify the backup by restoring a few files. Do not rely on a single copy.
- Sign in with a Microsoft account (MSA) with admin rights on the PC. The enrollment flow is tied to the MSA. If you use a local account, the wizard will prompt for sign‑in during enrollment. (support.microsoft.com)
- Open Settings → Update & Security → Windows Update. Look for messaging that reads something like “Windows 10 support ends in October 2025” and an Enroll in Extended Security Updates link in the upper right. Click Enroll now to start the wizard. (support.microsoft.com)
- Choose how to enroll:
- Start Windows Backup and sync PC settings to OneDrive (free).
- Redeem 1,000 Microsoft Rewards points (if available).
- Pay a one‑time $30 USD purchase (covers up to 10 devices tied to the same MSA). (support.microsoft.com)
- Complete the wizard and confirm your account shows the ESU entitlement. The enrolled device will receive security updates from Microsoft Update during the ESU window (Oct 15, 2025 through Oct 13, 2026).
What the free OneDrive/Backup route actually requires (and its limits)
The free enrollment option requires enabling Windows Backup (the PC Settings sync) and linking that backup to a Microsoft Account and OneDrive. A few practical notes:- OneDrive free storage is 5 GB — if your settings backup is large you'll either need to free space or pay for additional OneDrive storage. Don’t rely on the free tier if you have extensive app credentials or settings to preserve.
- The free path ties your ESU license and backups to the MSA, which some privacy‑conscious users may not want. If you prefer not to use an MSA or OneDrive, the paid $30 option or redeeming Microsoft Rewards are alternatives — but the enrollment process still requires signing in to an MSA to attach the ESU license. (support.microsoft.com)
- The OneDrive route is convenient for households with multiple machines: once the MSA holds an ESU license it can be used to enroll up to 10 devices. That’s especially useful for families or small, non-domain environments. (support.microsoft.com)
Enterprise customers and businesses — different rules and pricing
Businesses cannot use the consumer ESU path. Commercial organizations have separate ESU channels available through Volume Licensing, Cloud Solution Providers (CSP), or as part of Windows 365/Azure offerings. Key enterprise facts:- Pricing for commercial ESU begins at $61 per device for Year 1, and historically Microsoft’s model doubles the price for Year 2 and Year 3 (Year 2 = $122, Year 3 = $244 per device) to encourage migration. Cloud-based activation options and Windows 365/Azure pathways may offer discounted or included ESU activation for eligible subscriptions. (learn.microsoft.com, theverge.com)
- Enterprises can obtain ESU coverage for up to three years beyond the official end‑of‑support date via the commercial program. That is an explicitly time‑bound option and intended for organizations needing a longer migration runway. (learn.microsoft.com)
Risks, trade‑offs, and practical concerns
The ESU program solves an urgent security problem, but it introduces trade‑offs you must consider.- Privacy and account entanglement. The consumer ESU ties active security coverage to a Microsoft account. For users who intentionally avoid MSAs, this is a meaningful shift. If privacy is paramount, consider migrating to a supported OS, switching to a non‑Windows OS for older hardware, or paying the $30 option while recognizing account binding occurs at enrollment. (support.microsoft.com)
- Not a long‑term fix. ESU is security-only and lasts one year for consumers. Plan migrations or hardware refreshes during the ESU window; do not treat it as indefinite support. (learn.microsoft.com)
- Rollout reliability. Microsoft shipped KB5063709 to address early wizard failures, but the staged rollout means some users still don’t see the enrollment prompt. Don’t procrastinate. Update now and enroll as soon as the option appears. (support.microsoft.com, techradar.com)
- Firmware and boot risk. The August cumulative includes guidance about Secure Boot certificate lifecycles; older machines may require vendor firmware updates to avoid future boot issues. Inventory firmware and ensure OEM updates are applied where available. This is especially important for PCs that will remain on Windows 10 into 2026. (support.microsoft.com)
- Third‑party impacts. Some third‑party software vendors may tie continued support to Microsoft’s lifecycle cadence. Over time, you may find drivers, apps, or services no longer tested on Windows 10. That increases maintenance burden even with ESU in place.
Alternatives to ESU — practical migration options
If you decide ESU isn’t right for you, your main alternatives are:- Upgrade the PC to Windows 11 if it meets the hardware requirements (TPM 2.0, UEFI Secure Boot, supported CPU, 4 GB RAM, 64 GB storage). Use the PC Health Check tool or Windows Update to determine eligibility. Upgrading typically preserves apps and files but test critical applications and drivers first. (support.microsoft.com)
- Replace the PC with a new Windows 11 machine — often the most future‑proof route and recommended for long-term reliability. Factor trade‑in or recycling programs to lower net cost. (support.microsoft.com)
- Migrate older machines to a supported Linux distribution or ChromeOS Flex for machines that don’t require Windows‑only apps. For users who primarily browse and use web apps, this can be a low‑cost, secure alternative.
- Use cloud-based Windows instances (Windows 365, Azure Virtual Desktop) to run a supported Windows environment from older hardware; some cloud plans include ESU activation for Windows 10 virtual machines. This is more complex and often better for organizations than individual consumers. (learn.microsoft.com)
A pragmatic checklist — what to do this week
- Verify Windows 10 version (Settings → About). If not 22H2, update now. (support.microsoft.com)
- Install all pending updates, especially KB5063709 (August 2025 cumulative). Reboot. (support.microsoft.com)
- Create a verified backup (full disk image + important files to an independent medium). Don’t rely on a single cloud copy.
- Decide: will you upgrade to Windows 11, buy/replace hardware, enroll in consumer ESU, or migrate to an alternate OS? Prioritize machines that handle sensitive data.
- If using ESU: sign in to a Microsoft account and go to Settings → Update & Security → Windows Update for the Enroll now wizard. Choose OneDrive backup (free), Rewards points (1,000), or the $30 purchase. Confirm entitlements across devices if you plan to enroll multiple PCs. (support.microsoft.com)
- If you manage multiple devices, document which machines are enrolled, which are upgraded, and which will be retired. For businesses, contact your licensing partner about commercial ESU if needed. (techcommunity.microsoft.com)
Final assessment — the tradeoff in one paragraph
Microsoft’s consumer ESU program is a practical, time‑boxed safety valve: it substantially reduces immediate systemic risk from mass unpatched Windows 10 devices, and the options (free via OneDrive backup, Rewards, or a modest $30 fee) are consumer-friendly. But it ties you to a Microsoft account, is explicitly security-only, and is short — one year for consumers — so it must be used as a migration window, not a destination. The rollout was imperfect, and early update bugs and firmware lifecycle issues underscore why the safest approach is to update, back up, and plan migration now rather than wait for last‑minute enrollment hassles. (support.microsoft.com)Quick reference — essential dates and numbers
- Windows 10 end of support (no more free security updates): October 14, 2025. (support.microsoft.com)
- Consumer ESU coverage window (if enrolled): through October 13, 2026. (support.microsoft.com)
- Consumer ESU cost options: free (Windows Backup/OneDrive sync), 1,000 Microsoft Rewards points, or $30 USD one‑time purchase (one license covers up to 10 devices tied to the same Microsoft account). (support.microsoft.com)
- Enterprise ESU pricing (Year 1 starting point): $61 USD per device (cloud activation and Windows 365 pathways may offer different pricing and discounts). Commercial ESU can extend support up to three years. (learn.microsoft.com, theverge.com)
- Critical update to install for consumer ESU enrollment: KB5063709 (August 2025 cumulative). (support.microsoft.com)
Microsoft has provided a realistic, if limited, bridge for Windows 10 users who need time — but that bridge is short and not without strings. Install updates now, back up your data, and decide whether to upgrade to Windows 11 (if eligible), purchase replacement hardware, migrate to an alternative platform, or enroll in ESU before the October 14 cutoff. The one‑year window buys time; use it to move to a supported platform rather than to postpone the inevitable. (support.microsoft.com, learn.microsoft.com)
Source: CNET If You're Still Running Windows 10, You Need to Do This One Thing Before Oct. 14