Microsoft just gave Windows 10 users one last lifeline — but the window to grab it is small, conditional, and full of trade-offs you need to understand before you act.
Microsoft will stop regular security updates for consumer editions of Windows 10 on October 14, 2025, but it is offering a time‑boxed consumer Extended Security Updates (ESU) program that provides one additional year of security-only patches through October 13, 2026. The enrollment mechanics are unusual: eligible consumers can get the ESU at no extra charge by syncing their Windows settings to OneDrive via Windows Backup, or they can redeem 1,000 Microsoft Rewards points, or make a one‑time $30 USD purchase. Enrollment is performed from the Windows Update page in Settings, but Microsoft is rolling that enrollment wizard out gradually and has required a specific August 2025 cumulative update (KB5063709) to fix early enrollment bugs and surface the option reliably.
This article explains the technical prerequisites, the enrollment choices, the security and privacy trade‑offs, the migration alternatives (including upgrading to Windows 11), and a practical, prioritized checklist to make sure you don’t get left unpatched after the cutoff. It cross‑checks Microsoft’s docs with major independent outlets and flags claims that require caution.
Why this matters: an unpatched OS is a rising risk vector for malware, ransomware, and zero‑day exploitation. For users who cannot, will not, or prefer not to upgrade hardware or the OS, ESU is a defined — and limited — mitigation: a one‑year runway to migrate safely or replace hardware. Microsoft emphasizes ESU is not a long‑term solution but a temporary bridge.
Microsoft has provided a limited, pragmatic escape hatch for the many PCs that will still run Windows 10 at the end of mainstream support. The business logic is straightforward — a short, security‑only extension in exchange for encouraging users to sign in with a Microsoft Account and, if they choose the free route, to use OneDrive. The operational reality is also clear: act early, verify prerequisites, keep independent backups, and treat the ESU year as a migration window, not a permanent fix. If you value uninterrupted security and want to avoid scrambling when the deadline arrives, follow the checklist now rather than later.
Source: CNET You're About to Miss the Windows 10 Deadline. Here's Your Last Chance to Act
Overview
Microsoft will stop regular security updates for consumer editions of Windows 10 on October 14, 2025, but it is offering a time‑boxed consumer Extended Security Updates (ESU) program that provides one additional year of security-only patches through October 13, 2026. The enrollment mechanics are unusual: eligible consumers can get the ESU at no extra charge by syncing their Windows settings to OneDrive via Windows Backup, or they can redeem 1,000 Microsoft Rewards points, or make a one‑time $30 USD purchase. Enrollment is performed from the Windows Update page in Settings, but Microsoft is rolling that enrollment wizard out gradually and has required a specific August 2025 cumulative update (KB5063709) to fix early enrollment bugs and surface the option reliably. This article explains the technical prerequisites, the enrollment choices, the security and privacy trade‑offs, the migration alternatives (including upgrading to Windows 11), and a practical, prioritized checklist to make sure you don’t get left unpatched after the cutoff. It cross‑checks Microsoft’s docs with major independent outlets and flags claims that require caution.
Background: Why Microsoft is doing this (and what it covers)
Windows 10 has been a dominant desktop platform for a decade. Microsoft’s lifecycle policy set a firm end‑of‑support date — October 14, 2025 — after which mainstream consumer updates and fixes cease unless a device is enrolled in ESU. The consumer ESU program is explicitly security‑only: it delivers only Critical and Important fixes identified by Microsoft’s Security Response Center (MSRC). It does not include feature updates, general non‑security quality fixes, or technical support.Why this matters: an unpatched OS is a rising risk vector for malware, ransomware, and zero‑day exploitation. For users who cannot, will not, or prefer not to upgrade hardware or the OS, ESU is a defined — and limited — mitigation: a one‑year runway to migrate safely or replace hardware. Microsoft emphasizes ESU is not a long‑term solution but a temporary bridge.
Market context (what the adoption numbers mean)
Different telemetry providers report different Windows 10 install base figures. Some outlets have cited figures in the low‑to‑mid 40s percent range for Windows 10’s desktop share in mid‑2025; StatCounter and related trackers show Windows 10 and Windows 11 swapping positions depending on the measurement window. Treat single percentage claims (for example, “nearly 43% still on Windows 10”) as indicative rather than definitive — market share numbers vary month‑to‑month and by measurement method.What you must do to be eligible (technical prerequisites)
Before enrolling, verify all of the following. Missing any step may prevent the ESU option from appearing.- Your PC must be running Windows 10, version 22H2 (Home, Pro, Pro Education, or Workstation).
- Install all pending Windows updates — Microsoft explicitly calls out the August 2025 cumulative patch (KB5063709) as required to fix enrollment issues and ensure the wizard shows up. Reboot after updates.
- The account used to enroll must be a Microsoft Account (MSA) with administrator privileges. Local Windows accounts are not accepted for consumer ESU enrollment — even if you plan to pay.
- Devices joined to Active Directory, Entra ID (AAD domain‑joined), managed through MDM, in kiosk mode, or using certain commercial channels are excluded from the consumer wizard and must use business/volume licensing paths.
The enrollment options — what you get and the catches
When the enrollment wizard appears, Microsoft offers three consumer choices:- Back up your PC settings to OneDrive using Windows Backup (free). This sync-of-settings route grants ESU at no additional cost. Catch: OneDrive’s free tier includes only 5 GB of storage; heavy settings or profile data may require paid OneDrive storage. Also, this requires linking your device to a Microsoft Account and syncing settings to Microsoft’s cloud.
- Redeem 1,000 Microsoft Rewards points (free if you have them). Rewards points can be earned through Microsoft services (search, Edge, Xbox, etc.) but are not uniformly available to everyone.
- Make a one‑time purchase of $30 USD (local equivalents may apply) that enrolls a Microsoft Account and can be used across up to 10 devices tied to that account. Microsoft requires sign‑in with an MSA even when paying.
Strengths of Microsoft’s approach
- Practicality and accessibility: Microsoft created a straightforward path for consumers to stay patched for one more year without requiring per‑device long-term contracts or complex licensing. The free OneDrive sync route and the 1,000‑point Rewards option lower the barrier.
- Clear timeline and scope: The ESU window is time-boxed and documented — October 14, 2025 end of support and October 13, 2026 end of consumer ESU — which allows households and independent users to plan migrations or hardware replacements deliberately.
- Rollup fixes and improved UX: Microsoft patched early wizard problems (KB5063709) and provided an in‑OS enrollment experience rather than a complex purchase process, simplifying consumer action.
Risks, trade‑offs and things to watch
- Privacy and cloud lock‑in: The free option requires synchronizing PC settings to OneDrive under a Microsoft Account. That’s a deliberate nudge toward Microsoft’s cloud and may be unacceptable for privacy‑conscious users. If you avoid MSAs or cloud sync, the free route is unavailable.
- Limited coverage — security only: ESU provides only security updates (Critical and Important). It does not include feature updates, functional bug fixes, or technical support. If you rely on non‑security updates or expect new functionality, ESU is insufficient.
- Last‑minute rollout and enrollment failures: Because Microsoft is doing a staged rollout and required a bug fix (KB5063709), many users reported not seeing the Enroll option even after applying updates. Waiting until the last days risks missing the window or facing enrollment errors when updates are needed most. Act early.
- Microsoft Account requirement: Even paying the $30 fee requires an MSA sign‑in. Users who intentionally use local accounts to avoid cloud tracking face a forced trade‑off.
- OneDrive storage limits: The free OneDrive allotment (5 GB) can be quickly exhausted; you may be forced to either reduce the backup footprint, buy extra storage, or choose a paid enrollment path.
- False sense of permanence: ESU is a one‑year bandage, not a sustainable long‑term solution. Relying on ESU indefinitely increases risk of software rot, compatibility gaps, and unsupported third‑party drivers over time.
Step‑by‑step: How to check and enroll (practical walkthrough)
- Confirm your Windows version:
- Settings → System → About → OS version should read Windows 10, version 22H2.
- Install updates:
- Settings → Update & Security → Windows Update → Check for updates.
- Confirm the August 2025 cumulative update (KB5063709) is installed. Reboot.
- Ensure you’re signed into a Microsoft Account that has administrator privileges on the PC.
- Open Windows Update and look for the enrollment prompt:
- Settings → Update & Security → Windows Update.
- Look for text about "Windows 10 support ends in October 2025" and an Enroll in Extended Security Updates link or Enroll now button.
- Run the enrollment wizard and choose one of:
- Back up PC settings to OneDrive (free) — follow prompts to enable Windows Backup.
- Redeem 1,000 Microsoft Rewards points (if available).
- Purchase the one‑time $30 consumer ESU license.
- Confirm enrollment:
- After the wizard completes, check Update History for an ESU confirmation or look for ESU status in Windows Update. If you see ESU‑labeled updates being made available, enrollment succeeded.
Migration alternatives and long‑term options
ESU buys time; it is not the destination. Use the ESU year to pick a migration strategy:- Upgrade to Windows 11 (if your hardware supports it):
- Windows 11 requires UEFI, TPM 2.0, Secure Boot, and recent CPUs. Use Microsoft’s PC Health Check or third‑party tools to determine compatibility.
- Advantages: ongoing feature updates, modern security features (hardware‑based isolation, virtualization‑based security), Microsoft 365 compatibility.
- Replace or refresh hardware:
- For older PCs lacking TPM 2.0 or modern CPUs, a hardware refresh may be the most cost‑effective route if you need continued vendor support and compatibility.
- Consider alternative OSes:
- Linux distributions (Ubuntu, Mint, Fedora) or ChromeOS Flex could be viable for older machines used for browsing and light productivity. Expect a learning curve and software‑compatibility differences, especially for Windows‑only legacy applications.
- Use cloud alternatives:
- Windows 10 devices that access Windows 11 Cloud PCs via Windows 365 may receive ESU coverage automatically in some configurations; cloud/VM routes can ease transitions for specific workloads.
- For businesses:
- Discuss volume licensing ESU or seek third‑party extended support vendors; enterprises can buy multiple years of ESU under different pricing schedules.
A prioritized action plan — what to do today
- 1) Immediately verify you are on 22H2 and have installed KB5063709. Reboot and repeat the update check.
- 2) Make a full independent backup (disk image + file copy) to external media before you alter accounts or do cloud backups. ESU is not a substitute for proper backups.
- 3) Sign in with a Microsoft Account if you plan to enroll (even if you intend to pay). If you refuse MSA, plan migration away from Windows 10 entirely.
- 4) Open Settings → Windows Update and look for Enroll now. If it appears, enroll immediately — don’t wait until the last week.
- 5) If you choose the free OneDrive route, check your OneDrive quota; buy additional storage if needed or use the paid $30 option.
- 6) Use the ESU year to test Windows 11 upgrades on non‑critical systems, assess hardware needs, and budget for replacements. DO NOT treat ESU as indefinite security.
Common pitfalls and troubleshooting tips
- “Enroll now” not present despite meeting prerequisites:
- Ensure KB5063709 is installed and you’re signed in with an MSA. The rollout is phased; wait 24–72 hours and check again. If the option never appears, gather update logs and contact Microsoft support.
- Payment or Rewards redemption failure:
- Check the Microsoft Account transaction history and ensure region/payment methods match. Keep screenshots and receipts if you buy the ESU license. A single $30 license can cover up to 10 devices on the same Microsoft Account, but each device still needs manual enrollment.
- OneDrive storage shortfall:
- Trim what you back up (exclude large folders), or buy OneDrive storage. If you can’t or won’t purchase storage, consider the Rewards or paid license options.
- Domain‑joined or company‑managed devices:
- These devices won’t be eligible for the consumer wizard. Talk to your IT or use enterprise ESU channels.
How to interpret headlines and numbers (a note on claims you’ll read elsewhere)
Tech headlines over the past months have sometimes quoted varying percentages of PCs “still on Windows 10” (for example, figures near the low‑to‑mid 40s). Those numbers come from different trackers (StatCounter, NetMarketShare, internal telemetry) and are sensitive to sampling methods, regions, and the date of measurement. Use these numbers as a directional signal: a large portion of the installed base still runs Windows 10, and Microsoft’s consumer ESU is designed with that reality in mind — but don’t treat any single percent figure as a precise count.Final assessment: Is ESU worth it?
- For users with a clear migration plan, compatibility needs for legacy software, or hardware that cannot run Windows 11, ESU is a useful, low‑friction safety net — especially when taken early to avoid rollout problems. The free OneDrive‑sync option and the $30 multi‑device license make the cost of staying patched for a year very low for most consumers.
- For privacy‑conscious users who refuse Microsoft Accounts or cloud sync, ESU is less attractive; paying is not an escape from the MSA requirement. If you won’t use an MSA, plan for migration away from Windows 10 before October 14, 2025.
- For those hoping ESU will let you “put off forever” migrating: that’s a risky bet. ESU stops in October 2026 for consumers, and remaining on Windows 10 beyond that point produces growing security and compatibility debt. Treat ESU as runway, not a destination.
Closing checklist (quick reference)
- [ ] Confirm Windows 10 22H2.
- [ ] Install all updates and KB5063709. Reboot.
- [ ] Sign into an admin Microsoft Account.
- [ ] Back up externally (disk image + files).
- [ ] Open Settings → Windows Update → Enroll now and choose OneDrive / Rewards / $30.
- [ ] Verify ESU status in Update History.
Microsoft has provided a limited, pragmatic escape hatch for the many PCs that will still run Windows 10 at the end of mainstream support. The business logic is straightforward — a short, security‑only extension in exchange for encouraging users to sign in with a Microsoft Account and, if they choose the free route, to use OneDrive. The operational reality is also clear: act early, verify prerequisites, keep independent backups, and treat the ESU year as a migration window, not a permanent fix. If you value uninterrupted security and want to avoid scrambling when the deadline arrives, follow the checklist now rather than later.
Source: CNET You're About to Miss the Windows 10 Deadline. Here's Your Last Chance to Act
