Windows 10 ESU: One-Year Security Bridge After End of Support (22H2)

Microsoft has fixed a last‑minute gap in the plan to keep Windows 10 secure: if you want to keep using Windows 10 beyond the official end‑of‑support date, there is now a one‑year emergency option — but it comes with strict conditions, limited scope, and a clear clock that cannot be ignored.

Background: the deadline and what it means​

After more than a decade as Microsoft’s primary desktop operating system, Windows 10 reaches end of support on October 14, 2025. On that date Microsoft will stop shipping regular feature updates, non‑security fixes, and the standard security updates that patch newly discovered vulnerabilities. Systems will continue to boot and run, but they will no longer be treated as supported platforms. For both home users and businesses, this transition raises immediate security and lifecycle questions: how to keep devices safe, how to migrate user data and settings, and what short‑term and long‑term options exist.
Microsoft has published a consumer path called the Windows 10 Consumer Extended Security Updates (ESU) program that provides a time‑boxed safety net: critical and important security updates only, for a one‑year window after the platform’s end of support. That window runs from October 15, 2025 through October 13, 2026. This is not a permanent solution — it’s a bridge that gives individual users more time to upgrade hardware or plan migrations.

---

Overview: what the consumer ESU actually provides​

The consumer ESU is deliberately narrow in scope. Key points about what ESU includes and what it does not:

• What ESU covers
• Monthly security updates that Microsoft classifies as Critical or Important.
• Coverage is limited to the one‑year extension ending October 13, 2026 for consumer enrollments.
• Consumer ESU is tied to a Microsoft account and to eligible devices running Windows 10 version 22H2.
• What ESU does not cover
• No new feature updates, performance improvements, or general quality fixes.
• No extended Microsoft technical support for Windows 10 issues.
• It is not an alternative to migrating to a supported OS for the long term.
• Eligibility caveats
• Consumer ESU covers Windows 10 version 22H2 only (Home, Pro, Pro Education, Pro for Workstations).
• Devices joined to enterprise domains, managed by enterprise MDM, or configured as kiosks are excluded from the consumer ESU route and must follow enterprise channels if they need ESU.
• Enrollment requires that the device has the necessary cumulative update(s) installed (see the next section).

This is important: ESU is a deliberate security bridge, not a backdoor to keep legacy configurations permanently supported.

---

The crucial patch: KB5063709 and enrollment readiness​

To make ESU enrollment reliable for consumer PCs, Microsoft released an August 2025 cumulative update known as KB5063709 (build numbers 19045.6216 for 22H2 and 19044.6216 for 21H2). That update performs two critical functions for consumers:

• It prepares eligible Windows 10 devices to surface the ESU enrollment flow in Settings → Update & Security → Windows Update.
• It fixes an enrollment‑wizard bug that prevented some users from successfully completing enrollment when the ESU offer first appeared.

If your device is not showing the ESU option, or if the enrollment wizard crashes, installing the latest cumulative update (including KB5063709 and any required servicing stack updates) is the first troubleshooting step. Ensure Windows Update reports a build equal to or newer than the aforementioned builds for 22H2.
Note: KB build numbers and cumulative update availability are time‑sensitive; check Windows Update and confirm you’re on the 22H2 baseline before attempting enrollment.

---

How consumers can enroll: three consumer pathways​

Microsoft intentionally provided multiple enrollment options for individuals. All require a Microsoft account during the enrollment flow. The three consumer routes are:

• Free enrollment by enabling Windows Backup / Settings sync (uses OneDrive).
• This uses the built‑in Windows Backup feature to sync certain device settings to the cloud.
• It leverages your OneDrive account for settings and metadata; the free OneDrive tier provides 5 GB of cloud storage.
• This is effectively Microsoft’s “no money” option if you are willing to bind a Microsoft account and use cloud sync.
• Redeem 1,000 Microsoft Rewards points.
• If you participate in Microsoft Rewards and have enough points, you can redeem them to cover ESU enrollment.
• Practical caveat: Rewards redemption can be region‑ and account‑dependent and has seen sporadic glitches for some users; plan ahead and verify point balances early.
• One‑time paid purchase (approx. $30 USD) tied to your Microsoft account.
• The consumer ESU one‑time fee covers up to 10 eligible devices associated with the same Microsoft account.
• The price is billed in local currency and may vary by region and applicable taxes.
• Even for the paid path, enrollment requires signing into a Microsoft account during the wizard — local accounts cannot complete the enrollment alone.

The enrollment link appears in Settings → Update & Security → Windows Update as an “Enroll now” prompt when your device meets prerequisites. Each device still needs to be individually enrolled, though one paid license covers up to ten devices on the same Microsoft account.

---

Immediate actions to take right now (checklist)​

If you run Windows 10 and aren’t ready to migrate, follow this prioritized checklist to reduce risk and preserve options:

• Confirm your Windows 10 edition and build:
• Go to Start → Settings → System → About (or run winver).
• Confirm you are on Windows 10 version 22H2 and the OS build is up to date.
• Install pending Windows updates:
• Run Windows Update and install cumulative updates and servicing stack updates (KB5063709 or later if available).
• Reboot and re‑check Windows Update to confirm no outstanding patches remain.
• Prepare a Microsoft account:
• If you use a local sign‑in, create or link a Microsoft account (you will need it for enrollment).
• Avoid using child or restricted accounts for ESU enrollment.
• Choose an enrollment path and enroll:
• If cost is a concern, enable Windows Backup / Settings sync or ensure you have 1,000 Microsoft Rewards points before October 14, 2025.
• If paying, have your payment method ready and enroll via the Settings wizard.
• Back up your data:
• Use Windows Backup, a full image tool, or external drives. Relying on OneDrive’s free 5 GB tier may not be sufficient for large profiles — plan for a full backup strategy.
• Export product keys, license information, and application installers.
• Decide your long‑term plan:
• Test your machine for Windows 11 compatibility (TPM 2.0, Secure Boot, CPU requirements).
• If hardware is unsupported, research replacement options, virtualization, or supported OS alternatives.
• Document and inventory:
• Record hardware models, drivers, and any legacy peripherals that may not work on Windows 11.
• Note business‑critical apps and whether vendors support them on Windows 11.

Completing the checklist gives you the best chance to enroll successfully and buy time for a deliberate migration.

---

Migration options after ESU — realistic paths and technical tradeoffs​

ESU buys a year of breathing room; it does not solve long‑term compatibility. Consider these migration strategies:

• Upgrade to Windows 11 on supported hardware:
• Best long‑term path for a supported, modern desktop experience.
• Check system compatibility with the official health check tool and address TPM/Secure Boot requirements where possible.
• Acquire a new PC with Windows 11 preinstalled:
• Recommended if existing hardware is old, unreliable, or incompatible with Windows 11.
• Newer devices also often include firmware‑level protections and better performance.
• Move workloads to cloud or virtualized environments:
• Consider Windows 365 Cloud PCs or Azure Virtual Desktop solutions that include ESU rights for hosted images (depending on licensing).
• Cloud options remove reliance on local hardware while preserving a familiar Windows environment.
• Migrate to Linux or macOS for older hardware:
• For tech‑savvy users, modern Linux distributions can extend usable life for unsupported hardware, but application compatibility and user expectation must be managed.
• Continue using Windows 10 long‑term (not recommended):
• If you choose to run unsupported Windows 10 after October 14, 2025 without ESU, accept the elevated security risk.
• Mitigate by segmenting the machine from sensitive networks, using strong endpoint protections, and minimizing internet‑facing roles.

Each route has cost, usability, and security tradeoffs. Enterprises will typically choose volume licensing ESU or coordinated migrations; consumers must weigh convenience against risk.

---

Security and operational risks of staying on Windows 10​

Remaining on Windows 10 after support ends — even with ESU for a year — exposes users to several risks:

• Narrow patch coverage: ESU only includes patches Microsoft deems Critical or Important. Other stability or less‑critical vulnerabilities will not be fixed.
• No feature or performance updates: Over time, compatibility and performance will degrade relative to newer OS releases.
• Application lifecycle mismatches: Third‑party vendors may stop supporting older OS versions; you may find newer apps or services require a supported platform.
• Credential and account exposure: If core OS components are unpatched, attackers can exploit vulnerabilities to escalate privileges or persist.
• Regulatory and compliance issues: For small businesses handling regulated data, running an unsupported OS can conflict with compliance frameworks and insurance requirements.
• Higher cost of delayed migration: Delaying migration often increases complexity and cost later, as hardware ages and support channels close.

ESU reduces immediate risk of critical exploitation but does not eliminate risk. Treat ESU as short‑term risk management.

---

Common enrollment problems and troubleshooting tips​

Users have reported a handful of issues when signing up for consumer ESU. Practical steps to address them:

• If you don’t see the “Enroll now” option:
• Verify you are on Windows 10 version 22H2 and that KB5063709 (or a later cumulative update) is installed.
• Run Windows Update → Check for updates and reboot after installations.
• Confirm you are an administrator on the PC and that you signed into a Microsoft account when prompted.
• If Microsoft Rewards redemption fails:
• Ensure your Rewards account has sufficient points and that Rewards is available in your region.
• Try redeeming from another browser or device; Rewards redemption can be quirky early in a rollout.
• If the wizard crashes or throws an error:
• Install the latest cumulative and servicing stack updates, then retry.
• Use the Microsoft account sign‑in instead of staying on a local account.
• If you are in a managed environment:
• Domain‑joined or MDM‑enrolled devices are excluded from the consumer ESU path; work with IT to acquire enterprise ESU or plan migrations.

If enrollment still fails, keep a screenshot of the error and record the build number. These details help technical support and community troubleshooting.

---

Cost analysis: is the $30 option worth it?​

The paid consumer ESU option is a one‑time fee — roughly $30 USD — that covers up to ten eligible devices linked to the same Microsoft account. For households with several older PCs that cannot upgrade, this can be a relatively inexpensive bridge for one year.
However, consider hidden costs and opportunity costs:

• Security tradeoff: ESU covers only critical/important patches; you may still need to invest in endpoint protection, backups, and monitoring.
• Migration costs: The $30 buys time, not a migration. Plan whether that time will be used to replace hardware or to perform a controlled upgrade.
• Rewards and privacy: The free options require syncing settings to OneDrive or linking a Microsoft account; some users may view that as an unacceptable privacy or policy tradeoff.
• Regional variability: Local taxes and currency differences affect the final cost.

For many households, the combination of one paid ESU license (covering up to ten devices) plus a small budget for backups and a replacement plan is a reasonable short‑term approach. For organizations, enterprise ESU and migration planning remain the more robust choices.

---

Final verdict and recommended timeline​

The consumer ESU offering is a pragmatic and measured response: it recognizes that a portion of Windows users cannot immediately or easily transition to Windows 11 and that a short, managed extension can reduce mass‑exposure to critical threats. Microsoft’s August cumulative update and the KB5063709 patch addressed early rollout issues and helped make enrollment broadly available.
That said, the offering is intentionally temporary and constrained. Recommended timeline and priorities:

• By now: confirm your device is on Windows 10 version 22H2 and install the latest cumulative updates (including KB5063709 if not already present).
• Within 30 days: back up critical data and enroll in ESU if you need the one‑year bridge — choose your enrollment path after weighing privacy and account tradeoffs.
• Over the next 3–9 months: use the ESU window to test Windows 11 compatibility, collect application compatibility data, and budget for new hardware or alternative platforms.
• No later than October 13, 2026: complete a migration to a supported OS or accept the heightened risks of running an unsupported Windows 10 system.

ESU should be treated as a deliberate, short‑term safety net — buy time, not complacency.

---

Practical migration checklist (30–90 day plan)​

• Inventory: list hardware, peripherals, drivers, applications, and licenses.
• Backup: create a full system image and an off‑device copy of important files.
• Compatibility test: run the Windows 11 PC Health Check and test critical apps in a sandbox or VM.
• Evaluate options: cost out new hardware, Windows 365 Cloud PCs, and OS alternatives.
• Pilot migration: perform one or two controlled migrations to test user experience and restore procedures.
• Rollout schedule: build a migration calendar with milestones and contingency plans.
• Education: prepare user documentation and training for changed workflows or UI differences.

---

Closing assessment​

Windows 10’s consumer ESU program is a responsible stopgap: it’s affordable, available via multiple enrollment paths, and designed to reduce immediate mass‑exposure risk. The program’s architecture — Microsoft account binding, eligibility limits, and the single‑year timeframe — makes one thing clear: the era of Windows 10 mainstream support is ending. Treat ESU as a tactical retreat to buy time for a strategic migration.
For home users, the best outcome is to use the ESU window to secure, inventory, and migrate thoughtfully rather than to delay indefinitely. For organizations, ESU buys planning time but should not replace disciplined migration programs. The costs of postponing a move to a supported platform — in security, compatibility, and ultimately money — will rise over time. Prioritize data protection, informed choices about account and backup tradeoffs, and an actionable schedule to exit the Windows 10 lifecycle gracefully.

---

Source: 24matins.uk Windows 10: The Crucial Step to Take Before Support Ends