Microsoft's decision to end mainstream support for Windows 10 is no longer theoretical — the company has published a concrete, time‑boxed path that lets many remaining Windows 10 PCs keep receiving critical security updates for one additional year, and in many cases that extension can be obtained for free.
Background / Overview
Microsoft set a firm end‑of‑support date for Windows 10: after October 14, 2025 Microsoft will stop delivering free, routine security and quality updates to consumer Windows 10 editions. That hard calendar cutoff created an immediate problem for the large share of PCs that remain on Windows 10 but cannot upgrade to Windows 11 because of hardware, firmware, or software constraints.
To bridge that gap, Microsoft launched a consumer Extended Security Updates (
ESU) program that delivers
security‑only updates for eligible Windows 10 devices through
October 13, 2026. The ESU offering is explicitly temporary and scoped—security patches only, not feature updates or full technical support—and it is tied to device eligibility and enrollment requirements. This article walks through what ESU means for home and small‑office users, the practical steps to enroll (including the free options), the technical prerequisites you must meet, and the trade‑offs and risks you should weigh as you decide whether to buy time or move on.
The essentials: who’s eligible and what ESU provides
- Coverage window: ESU provides security updates through October 13, 2026 (one additional year after Windows 10’s last free patch).
- Eligible editions: Windows 10, version 22H2 for Home, Pro, Pro Education and Workstation editions. Devices must be fully patched to the latest cumulative updates before enrollment becomes available.
- Scope of updates: Only Critical and Important security fixes as defined by Microsoft’s Security Response Center—no feature updates, quality improvements, or general tech support.
- License portability: A single enrolled ESU license can be used on up to 10 devices tied to the same Microsoft account.
These are the foundational facts — cross‑checked against Microsoft’s own support documentation and independent reporting. Treat ESU as a planning tool: it buys time, not a permanent safety net.
How to enroll in ESU (the real world steps)
1. Confirm prerequisites before you start
Make sure your PC meets the technical requirements:
- Running Windows 10 version 22H2 (check Settings → System → About or winver).
- All available cumulative updates installed — Microsoft rolled an August 2025 cumulative (build bump) that fixed ESU enrollment issues; install the latest servicing stack + LCU packages first.
- You have administrator privileges on the machine.
If your PC fails the 22H2 requirement, update it before attempting to enroll — ESU enrollment checks the OS version and will not proceed on older builds.
2. Where the enrollment prompt appears
When your device is eligible and fully updated, Microsoft surfaces an
“Enroll now” option inside Settings → Update & Security → Windows Update. Clicking this opens the ESU enrollment wizard which validates eligibility and presents your enrollment choices. Rollout of the enrollment wizard is phased, so some users will see the link earlier than others. If the option is not visible, double‑check updates, reboot, and try again later.
3. The three enrollment paths
When the wizard runs you’ll be offered three ways to enroll:
- Free — Back up your PC settings (Windows Backup / sync to OneDrive): This ties the ESU entitlement to your Microsoft account and requires you to enable settings backup to OneDrive. Microsoft uses that link to validate the free enrollment. Expect the wizard to guide you through turning on the backup/sync flow.
- Free via Microsoft Rewards: Redeem 1,000 Microsoft Rewards points within the enrollment flow to obtain ESU on that device. Rewards redemptions are final and non‑refundable.
- Paid option: A one‑time purchase of $30 USD (or local equivalent plus tax) per device grants the ESU license. You can cancel a pre‑order before October 14, 2025 in certain cases; check the Microsoft Store refund rules if needed.
Microsoft’s consumer documentation and multiple outlets reported the same three enrollment routes — this is not a rumor. If you prefer not to enable cloud sync or don’t have Rewards points, the one‑time purchase is the straightforward paid option.
Important technical patch: KB5063709 and the enrollment rollout
A key August 2025 cumulative update —
KB5063709 (builds 19044.6216 / 19045.6216) — included a fix for an ESU enrollment wizard bug that caused the wizard to crash for some users and also introduced Secure Boot anti‑rollback protections. Installing that update (and the servicing stack) is one of the prerequisites for smooth enrollment on many devices. Independent reporting and Microsoft’s notes confirm KB5063709 addressed the enrollment glitch and helped generalize the ESU rollout. If you had enrollment problems before, installing KB5063709 and then checking Windows Update again is the first troubleshooting step. Be mindful that some users reported post‑update profile issues in a small number of cases; follow standard backup and recovery precautions before installing cumulative updates.
The Microsoft account requirement and regional differences
Microsoft ties the consumer ESU license to a
Microsoft account. If you use a local sign‑in, the ESU enrollment flow will prompt you to sign in with a Microsoft account during enrollment — the ESU license is associated with that account. Microsoft’s documentation is explicit: the account must be an administrator account and cannot be a child account. That requirement has prompted pushback, and regulators and consumer groups in Europe forced Microsoft to adjust some mechanics. For users in the
European Economic Area (EEA), Microsoft relaxed the Windows Backup prerequisite — EEA residents can enroll for free without enabling full settings backup to OneDrive, but they still must sign in with a Microsoft account and periodically reauthenticate (reports indicate a check‑in about every 60 days). Outside the EEA, the free route still requires enabling Windows Backup/OneDrive sync unless you use Rewards or pay the fee. These regional distinctions are important and were clarified in Microsoft’s follow‑ups and subsequent reporting. Flag: rollout details and the precise cadence of Microsoft account check‑ins vary by region and may change; check Settings → Windows Update on your PC for the definitive enrollment experience.
Privacy, storage and practical trade‑offs of the free path
The free path is tempting — no payment, and most home users can complete it quickly — but it’s worth understanding the trade‑offs:
- OneDrive storage limits: Microsoft provides 5 GB of free OneDrive storage on consumer accounts. Enabling Windows Backup / settings sync typically consumes very little space, but if you intend to back up large settings or other files you may hit the free cap and be nudged to buy more storage. This can become an unexpected cost for users who rely on the “free” ESU path if they exceed the 5 GB limit.
- Account binding and telemetry: The ESU license is tied to your Microsoft account, which means Microsoft can enforce license checks and requires periodic sign‑ins (especially in the EEA carve‑out rules). For users who prefer local accounts for privacy reasons, this is a change in operational practice. Microsoft states the program is tied to the account for entitlement purposes; independent outlets confirmed the account requirement.
- Data residency and EU rules: European consumer protections limited how Microsoft could condition free ESU on enabling cloud backup. The EEA concession reduces pressure to enable broader sync settings, but users should read the in‑device prompts carefully because regional behavior differs.
Bottom line: the free option is genuinely free for many users, but it introduces account linkage and potential OneDrive storage considerations that users should accept knowingly.
Risks and limitations of ESU — why you should view it as a bridge, not a destination
- Time‑boxed security: ESU protects for one extra year only — until October 13, 2026 — and Microsoft is explicit that this is not a long‑term solution. Businesses can purchase additional years under enterprise programs, but consumer ESU is one year. Plan hardware or OS migration during that period.
- No feature or compatibility fixes: ESU only covers Critical and Important security updates. Driver updates, firmware fixes, or feature improvements that maintain long‑term compatibility are not included. Over time, new apps and drivers may not be tested against Windows 10, increasing compatibility risk.
- Account dependence and reauthentication windows: The Microsoft account tie and periodic validation are operational dependencies. If you rely on local accounts or offline workflows, ESU may force changes to how you sign in and manage devices.
- Supply chain / hardware limits: Some older machines simply cannot meet Windows 11 requirements (TPM 2.0, Secure Boot, supported CPU families). ESU buys time but doesn’t solve hardware incompatibility or long‑term security architecture deficiencies. Use the ESU year to evaluate options, not as an indefinite stay of execution.
Practical recommendations — a short checklist
- Immediately confirm your PC’s Windows 10 version is 22H2 and install all pending updates (including KB5063709 and the latest SSU).
- Back up critical files externally (local disk image + cloud copy) before enrolling or applying major cumulative updates. Short‑term glitches post‑update are rare but not impossible.
- If you cannot or do not want to sign in with a Microsoft account, evaluate alternatives now: upgrade eligible machines to Windows 11, migrate to a lightweight Linux distribution, or consider ChromeOS Flex for older laptops. ESU is a bridge — not a replacement for long‑term security.
- If you plan to stay on Windows 10 through ESU, choose an enrollment path that matches your privacy and cost calculus (OneDrive backup, 1,000 Rewards points, or $30 purchase). Document the Microsoft account used so you can manage up to 10 devices under the same entitlement.
- For business or high‑risk devices (financial data, customer systems), prioritize migration to supported platforms or purchase enterprise ESU options where applicable; do not rely on consumer ESU for critical infrastructure.
Alternatives to buying ESU time
- Upgrade to Windows 11 where hardware permits — retains full support and modern security features. Use the PC Health Check tool to identify whether enabling fTPM / Secure Boot in the firmware is enough to qualify.
- Move to a supported lightweight OS (popular Linux distributions, ChromeOS Flex) if the device is otherwise capable but fails Windows 11 checks. This can extend usable life and reduce security risk for web‑centric usage.
- Isolate legacy devices behind segmented networks, minimize internet exposure, and only use them for offline or narrowly scoped tasks while migrating critical functions to supported systems. ESU helps, but network isolation reduces attack surface more directly.
Strengths of Microsoft’s approach — what’s done well
- Predictable bridge: A one‑year, explicit ESU window is clearer and less chaotic than an indefinite “we’ll see” approach — it gives consumers a measurable runway to plan.
- Multiple enrollment paths: Offering a paid option, reward redemption, and a free sync‑based path gives users, especially households, flexibility to pick the least painful route for their situation.
- Rapid bug fixes: Microsoft fixed the enrollment wizard crash via cumulative updates (KB5063709), which was an important operational issue that blocked enrollment for some users. That responsiveness removed the single biggest technical barrier for many.
Weaknesses and real risks
- Account‑centric enforcement: Tying the program to Microsoft accounts forces changes for privacy‑conscious users and those who prefer local accounts. That requirement is a material shift and was highlighted by independent reporting and user reaction.
- Regional inconsistency and perception of conditioning: Conditioning free ESU on enabling cloud backup in some regions—and then modifying that policy after regulatory pressure in the EEA—created distrust and the appearance of tying services together. Even with the EEA concession, the program remains regionally fractured.
- Short duration and limited scope: One year of security patches is helpful, but many users will face the same migration decisions the following year. ESU does not address long‑term compatibility or feature needs.
Closing analysis — the sensible path forward
For millions of Windows 10 users the
ESU program is a rational, measured bridge that reduces immediate risk, but it carries non‑trivial operational trade‑offs: account linkage, potential cloud storage implications, and a hard deadline. The single clearest truth is this: ESU buys planning time — it does not replace an upgrade or migration strategy.
Action priorities for responsible users:
- Confirm your device is running Windows 10 version 22H2 and that KB5063709 (or later) is installed.
- Choose an enrollment route that matches your privacy and budget constraints. Document the Microsoft account used and the devices covered (up to 10 per account).
- Use the ESU year strategically: test Windows 11 on eligible hardware, budget replacements where necessary, and harden or isolate legacy devices that must remain on Windows 10.
If you already read recent coverage and felt uneasy about being forced into cloud sync for free updates, the good news is Microsoft has modified the approach for EEA residents — but always verify the prompts on your own device because the enrollment experience is being rolled out in phases and can vary by market. Microsoft’s ESU program is a practical stopgap. Use it to buy time and sanity; use the extra year to move to a currently supported platform. The clock is explicit — October 13, 2026 — and the safest long‑term option remains moving onto a supported OS and hardware stack rather than relying on successive, temporary workarounds.
(If you need a concise, step‑by‑step checklist tailored to a single PC — including how to check your build, apply KB5063709, and complete ESU enrollment with the OneDrive or Rewards route — a focused how‑to can be provided.
Source: CNET
Still Using Windows 10? These Free Updates Will Help Keep Your PC Secure