Windows 10 ESU Guide: Security Updates Through October 2026

Microsoft has set a hard end to free, routine support for Windows 10—security and quality updates stop on October 14, 2025—but there is a short, official lifeline for home users: the Windows 10 Consumer Extended Security Updates (ESU) program, which can keep eligible PCs receiving critical security-only patches through October 13, 2026.

Background / Overview​

Windows 10 launched in 2015 and for a decade has been the default desktop OS for a very large install base. Microsoft’s lifecycle calendar set October 14, 2025 as the end-of-support date for mainstream Windows 10 editions; after that date Microsoft will no longer deliver routine monthly cumulative updates, non-security quality fixes, or standard technical support for those editions. Devices will continue to boot and run, but unpatched vulnerabilities accumulate over time and create growing security risk.
To reduce the immediate impact on households and lone users who can’t move to Windows 11 or replace hardware quickly, Microsoft created the consumer ESU as a time‑boxed bridge: security-only updates for eligible Windows 10, version 22H2 devices through October 13, 2026. This is explicitly a temporary mitigation—not a permanent alternative to upgrading.

---

What is Windows 10 ESU?​

Extended Security Updates (ESU) is a program that supplies security-only patches—Critical and Important fixes as defined by Microsoft—to covered Windows 10 devices after the OS reaches its end-of-support date. ESU does not provide new features, non-security quality updates, or general technical support. For consumers, the ESU window runs from the end of mainstream support (October 14, 2025) through October 13, 2026; enterprises have separate multi-year ESU purchase options under volume licensing.
Why Microsoft offered ESU to consumers

• It minimizes immediate security exposure for users with perfectly functional hardware that simply doesn’t meet Windows 11 requirements.
• It provides a predictable, priced runway for households and small organizations to plan upgrades, migrations, or hardware replacements.
• It preserves support momentum for ecosystems that still rely on older hardware while encouraging migration to the more secure, modern Windows 11 platform.

---

Who can enroll (eligibility)​

The consumer ESU is not an automatic entitlement; devices must meet specific prerequisites:

• Be running Windows 10, version 22H2 (the servicing baseline required for ESU patches). If you are on an earlier build, update to 22H2 first.
• Be one of the supported consumer editions: Windows 10 Home, Pro, Pro Education, or Pro for Workstations as described in Microsoft’s consumer ESU guidance.
• Have the latest available updates and servicing stack installed before enrolling.
• Be signed in with a Microsoft account that has administrator rights on the PC for the in‑device enrollment flows that are offered to consumers.

Important exclusions and notes

• Domain-joined, enterprise-managed devices are generally expected to use the enterprise ESU channels (volume licensing and commercial agreements); the consumer ESU is targeted at personal devices.
• Enrollment after October 14, 2025 is possible, but the coverage window does not extend; for example, enrolling in January 2026 still only provides updates through October 13, 2026. Enrolling before—or on—the end‑of‑support date gives the most value.

---

How to enroll: step-by-step (consumer paths)​

Microsoft exposed consumer ESU enrollment through the Windows Update UI for eligible PCs. There are three consumer enrollment paths depending on preference and region:

• Free enrollment if your PC settings are synced with your Microsoft account (backup/sync enrollment).
• Redeem 1,000 Microsoft Rewards points to cover enrollment.
• One-time direct purchase for $30 USD (or local-currency equivalent) to purchase the ESU license for a Microsoft account.

Each ESU license purchased/activated via a Microsoft account can cover up to 10 devices linked to that same account (subject to Microsoft’s account/device limits at the time of activation).
To enroll on an eligible PC:

• Open Settings → Update & Security → Windows Update.
• If your device qualifies, you should see an “Enroll now” or similar ESU prompt.
• Follow the on‑screen wizard to choose enrollment via account sync, Rewards points, or purchase.
• After enrollment completes, Windows Update will begin delivering qualifying security-only updates for the ESU coverage window.

Caveats:

• Regional differences can apply (some EEA / regulatory regions had variant enrollment rules). Check the in‑device prompt for specifics.

---

Cost and coverage — what you’re actually buying​

What ESU covers

• Security-only updates deemed Critical or Important by Microsoft, delivered via Windows Update to enrolled devices. No feature updates, no quality (nonsecurity) updates, and no general technical support are included.

Cost options

• Free via Microsoft account sync method for eligible PCs.
• 1,000 Microsoft Rewards points (effective “cost” depends on how you earn points).
• One-time $30 purchase per Microsoft account (covers up to 10 devices under that account), where available. Pricing and purchase flow may vary by region and by time; enterprise licensing differs.

Important financial note: ESU is a short grace period. For consumers, Microsoft designed ESU as a one-year bridge. For organizations with many machines, enterprise ESU (purchased through volume licensing) can cover devices for up to three years at progressively increasing pricing. Treat consumer ESU as a cost-effective, temporary stopgap—not a substitute for planned hardware refresh or full upgrades.

---

If you don’t enroll: realistic risks and mitigations​

Once a Windows 10 PC is unenrolled and outside support, it will no longer receive OS-level security patches for new vulnerabilities. That increases risk over time, particularly for internet‑facing activities like banking, email, and work with sensitive data. Key consequences:

• New kernel or service vulnerabilities discovered after October 14, 2025 will remain unpatched on unenrolled Windows 10 PCs. Attackers tend to focus on unsupported platforms because they are easier to exploit.
• Some apps, drivers, or modern services may drop support over time; compatibility and performance may degrade.

If you can’t or won’t enroll, practical mitigations reduce—but do not eliminate—risk:

• Keep a modern, reputable antivirus with real‑time protection (Microsoft Defender will continue to receive definition updates for a period, but that’s not a replacement for OS patches).
• Use supported browsers (Edge, Chrome, Firefox) and keep them updated. Browser updates will likely continue for a while on Windows 10, but vendors may drop support eventually.
• Avoid using unsupported machines for high‑risk activities (online banking, tax filing, business email). Use a supported device for sensitive tasks or adopt an isolated workflow.
• Harden the PC: enable BitLocker, use non-admin day-to-day accounts, disable legacy network services (SMB v1), and isolate the device on a separate network segment or guest Wi‑Fi.
• Back up regularly and keep full disk images for recovery. Test restores.

These measures help but do not replace vendor-supplied OS patches. The safest long-term decision remains migrating to a supported platform.

---

Upgrading to Windows 11: requirements, reality and the unsupported route​

Microsoft’s recommended long-term solution is to move eligible devices to Windows 11. Windows 11 enforces stricter hardware baselines than past upgrades—key minimums are:

• Processor: 1 GHz or faster, 2 or more cores on a compatible 64-bit CPU on Microsoft’s approved list.
• RAM: 4 GB minimum.
• Storage: 64 GB minimum.
• System firmware: UEFI with Secure Boot capable.
• TPM 2.0 (Trusted Platform Module version 2.0).
• Graphics: DirectX 12 compatible GPU with WDDM 2.0.

Check compatibility with the PC Health Check (PC Integrity Check) tool or consult your OEM. Many otherwise-capable PCs only fail the TPM or Secure Boot checks because those features are disabled in UEFI and can be enabled with a firmware change or BIOS update. In other cases, the CPU simply isn’t on Microsoft’s supported-CPU list.
Unsupported installations

• It is technically possible to install Windows 11 on unsupported hardware (workarounds exist using registry edits, modified install media, or tools like Rufus), but Microsoft warns that unsupported systems may not receive future updates and may experience driver or stability issues. This route is for advanced users comfortable with troubleshooting and accepting support limitations.

Practical trade-offs:

• If your machine meets the hardware minimums (or can be made to meet them via firmware enabling), upgrading in-place preserves apps and files and keeps you on supported update channels.
• If your machine cannot meet requirements, consider buying a new Windows 11 PC, repurposing the old device for offline uses, or migrating it to an alternative OS (ChromeOS Flex, Ubuntu, etc.) where appropriate.

---

A pragmatic, security-first migration checklist​

Below is a practical checklist that turns the lifecycle milestone into an organized plan you can execute in days-to-weeks rather than panic.

• Inventory and verify (day 0–2)
• Run PC Health Check on every Windows 10 machine. Record Windows edition, build (must be 22H2 for ESU), and why it fails or passes Windows 11 checks.
• Back up everything (day 0–2)
• Full file backup to cloud and an offline full-disk image (external SSD or NAS). Test restore to confirm backups are usable.
• If eligible for Windows 11: test upgrade (day 3–7)
• Pick a non-critical machine to do an in-place upgrade via Windows Update or Installation Assistant. Confirm drivers and key apps work.
• If not eligible: consider ESU enrollment (day 3–14)
• Update the device to Windows 10, version 22H2 and install all cumulative updates. Check Settings → Windows Update to see ESU enrollment prompts. Decide which consumer path (free sync, Rewards, or $30 purchase) is best. Enroll before October 14, 2025 if you want the full year.
• Harden and isolate unenrolled machines (ongoing)
• Use strong antivirus, disable unnecessary services, segment the network, and avoid sensitive tasks on these devices.
• Plan hardware refresh (30–180 days)
• For machines that cannot be upgraded, budget for replacement or plan migration to ChromeOS Flex/Linux depending on workload requirements. Include trade‑in or recycling options.
• For businesses: map out enterprise ESU (if needed) and migration waves (quarterly milestones)
• Use inventory tools to prioritize endpoints; purchase enterprise ESU only as a pragmatic bridge while rolling out new hardware.

---

Strengths and limitations of Microsoft’s consumer ESU approach (critical analysis)​

Strengths

• Low-friction bridge: The consumer ESU offers a low-cost, simple way for households to preserve basic security protections while they plan upgrades. The free sync option and Rewards path lower financial friction for many users.
• Targeted scope: By limiting ESU to security-only patches, Microsoft avoids the engineering burden of maintaining large backports while still reducing catastrophic risk from major vulnerabilities.

Limitations and risks

• One-year life‑span: Consumer ESU is deliberately time‑boxed (through October 13, 2026). Relying on ESU more than a year increases long-term exposure and eventual technical debt.
• Coverage gaps: ESU only covers Critical and Important OS security fixes. Non-security quality fixes and feature updates are absent, which can leave compatibility issues unresolved.
• Account/Device policies: Enrollment depends on Microsoft account linkage and specific device prerequisites. Households with shared or fragmented device ownership may find management awkward.
• Environmental and equity concerns: Stricter Windows 11 requirements force hardware churn for some users; although ESU tempers immediate pressure, it doesn’t solve the underlying mismatch between functioning hardware and platform security baselines.

---

What we verified and what remains uncertain​

Verified with multiple official and independent sources:

• Windows 10 end-of-support date is October 14, 2025.
• Consumer ESU exists and extends security-only updates through October 13, 2026 for eligible Windows 10 version 22H2 devices.
• Eligibility requires Windows 10, version 22H2 and specific editions; enrollment flows include the free account-sync path, 1,000 Microsoft Rewards points, or a one-time purchase (pricing/availability may vary by market).
• Windows 11 minimum system requirements include TPM 2.0 and Secure Boot among other items.

Claims to treat cautiously / flagged as time-sensitive:

• Pricing and enrollment UI details may vary by country, and promotional / regional differences can change over time. Confirm the current enrollment options on the device’s Windows Update page before purchasing. The enrollment window and local terms are the definitive authorities for final cost and device limits.

---

Bottom line — the practical plan​

• If your PC is eligible for Windows 11 and you want long-term, low-maintenance security: upgrade using official paths and keep the device on the supported update channel.
• If your PC is not eligible and you need more time: enroll eligible devices in Windows 10 Consumer ESU before or on October 14, 2025 to receive security updates through October 13, 2026, but use that time to plan a hardware refresh or migration.
• If you choose not to enroll, harden and isolate the device, avoid sensitive activities on it, and keep critical applications and browsers updated; but recognize this is a risk mitigation—not a safe long-term strategy.

The ESU program buys a clear, finite runway to upgrade or replace hardware. Treat it as what it is: a pragmatic, time-limited safety net. Plan now—inventory, back up, evaluate eligibility, and act before the deadlines to avoid gaps in protection.

---

Source: The Business Standard Don't want Windows 11 yet? Here is how to keep updates on Windows 10