Windows 10 Extended Security Error

• Run winver (press Windows+R, type winver, Enter) and paste the exact text it shows (Windows edition and build).
• Is this a personal/home PC or a corporate/managed device (domain, Intune, or company image)? Also tell me whether you have an ESU product key (yes / no / don’t know).

• Confirm system date/time is correct and synced (clock in taskbar).
• Sign out of your account and sign back in (or reboot).
• Try enrolling using a different local admin user (create one temporarily: Settings > Accounts > Family & other users > Add someone else to this PC, make admin). Does the dialog still hang?
• Open Settings > Accounts > Access work or school — do you see any errors there?

• If you can open Settings normally: Settings > Apps > Apps & features > find “Settings” (or “Windows Settings”), click it > Advanced options > Reset. Then try the enrollment again.
• If Settings won’t let you reset, run an elevated PowerShell to re-register the Settings package:
• Open PowerShell as Administrator.
• Run:
  powershell -Command "Get-AppxPackage immersivecontrolpanel | % { Add-AppxPackage -DisableDevelopmentMode -Register \"$($_.InstallLocation)\AppXManifest.xml\" }"
• Reboot and try again.
  Note: that command is safe but if you’re uncomfortable I can walk you through making a restore point first.

• Press Windows+R → msconfig → on the Services tab check “Hide all Microsoft services” → click Disable all.
• On Startup open Task Manager and disable non‑Microsoft startup items.
• Reboot and try the enrollment again. If it works, re-enable services/startup items in groups to find the culprit.

• net stop wuauserv
• net stop bits
• net stop cryptsvc
• netsh winsock reset
• ipconfig /flushdns
• w32tm /resync
• net start cryptsvc
• net start bits
• net start wuauserv
  Reboot and try the enrollment.

• In an elevated PowerShell run:
  Get-WindowsUpdateLog -LogPath C:\Temp\WindowsUpdate.log
  Attach C:\Temp\WindowsUpdate.log here (or paste the final ~100 lines).
• Open Event Viewer and navigate to:
  Applications and Services Logs → Microsoft → Windows → WindowsUpdateClient → Operational
  Export or copy any errors that appear around the time you tried to enroll. Also check System and Application for errors at that time. Paste the Event IDs/messages.
• Run these and paste outputs (in an elevated CMD):
  sc query wuauserv
  sc query bits
  sc query wuasvc
  (these show whether the services are running and their state)

• ESU enrollment sometimes stalls if prerequisites (specific KB updates/SSU or a product key) are missing or if the device is not eligible. If you do have an ESU MAK key and this is an unmanaged device, tell me and I’ll give the exact slmgr / other commands to apply it. If the device is managed by IT, your org may need to complete enrollment (Intune or portal).

• We can run Process Monitor (Procmon) while you reproduce the hang to capture which process or registry call is waiting. This gives a smoking‑gun but produces a large capture — I’ll guide you if you want to do this.

• The winver text (exact edition + build).
• Whether PC is managed and whether you have an ESU key.
• Results of the Settings reset attempt and whether a new admin account reproduces the problem.
• The WindowsUpdate.log (or last 100 lines) and any Event Viewer error IDs/messages.
• Outputs of sc query commands above.

ChatGPT said:

Thanks — I hear you. Since this has been stuck for three weeks and you’ve already tried VPN/firewall removals and the usual tutorials, let’s move to a focused set of diagnostics and a few stronger fixes. I’ll keep it step‑by‑step so you can try one thing at a time and paste results back here.
First — the 2 quick things I need right away

1. Run winver (press Windows+R, type winver, Enter) and paste the exact text it shows (Windows edition and build).
2. Is this a personal/home PC or a corporate/managed device (domain, Intune, or company image)? Also tell me whether you have an ESU product key (yes / no / don’t know).

Then try these steps in order:
A — Very quick checks (if you haven’t already)

1. Confirm system date/time is correct and synced (clock in taskbar).
2. Sign out of your account and sign back in (or reboot).
3. Try enrolling using a different local admin user (create one temporarily: Settings > Accounts > Family & other users > Add someone else to this PC, make admin). Does the dialog still hang?
4. Open Settings > Accounts > Access work or school — do you see any errors there?

B — Reset the Settings app (safe, often fixes hung Settings dialogs)

• If you can open Settings normally: Settings > Apps > Apps & features > find “Settings” (or “Windows Settings”), click it > Advanced options > Reset. Then try the enrollment again.
• If Settings won’t let you reset, run an elevated PowerShell to re-register the Settings package:
  1. Open PowerShell as Administrator.
  2. Run:
     powershell -Command "Get-AppxPackage immersivecontrolpanel | % { Add-AppxPackage -DisableDevelopmentMode -Register \"$($_.InstallLocation)\AppXManifest.xml\" }"
  3. Reboot and try again.
     Note: that command is safe but if you’re uncomfortable I can walk you through making a restore point first.

C — Clean boot (rules out conflicting apps/services)

1. Press Windows+R → msconfig → on the Services tab check “Hide all Microsoft services” → click Disable all.
2. On Startup open Task Manager and disable non‑Microsoft startup items.
3. Reboot and try the enrollment again. If it works, re-enable services/startup items in groups to find the culprit.

D — Network / time / service resets (common causes)
Open an elevated Command Prompt and run these (paste any errors you see):

• net stop wuauserv
• net stop bits
• net stop cryptsvc
• netsh winsock reset
• ipconfig /flushdns
• w32tm /resync
• net start cryptsvc
• net start bits
• net start wuauserv
  Reboot and try the enrollment.

E — Collect the logs we need to debug (if it still hangs)

1. In an elevated PowerShell run:
   Get-WindowsUpdateLog -LogPath C:\Temp\WindowsUpdate.log
   Attach C:\Temp\WindowsUpdate.log here (or paste the final ~100 lines).
2. Open Event Viewer and navigate to:
   Applications and Services Logs → Microsoft → Windows → WindowsUpdateClient → Operational
   Export or copy any errors that appear around the time you tried to enroll. Also check System and Application for errors at that time. Paste the Event IDs/messages.
3. Run these and paste outputs (in an elevated CMD):
   sc query wuauserv
   sc query bits
   sc query wuasvc
   (these show whether the services are running and their state)

F — If this is an ESU licensing/activation issue

• ESU enrollment sometimes stalls if prerequisites (specific KB updates/SSU or a product key) are missing or if the device is not eligible. If you do have an ESU MAK key and this is an unmanaged device, tell me and I’ll give the exact slmgr / other commands to apply it. If the device is managed by IT, your org may need to complete enrollment (Intune or portal).

G — If you want deeper tracing (only if comfortable)

• We can run Process Monitor (Procmon) while you reproduce the hang to capture which process or registry call is waiting. This gives a smoking‑gun but produces a large capture — I’ll guide you if you want to do this.

What to post back here

• The winver text (exact edition + build).
• Whether PC is managed and whether you have an ESU key.
• Results of the Settings reset attempt and whether a new admin account reproduces the problem.
• The WindowsUpdate.log (or last 100 lines) and any Event Viewer error IDs/messages.
• Outputs of sc query commands above.

If you prefer I can give a compressed checklist you can run start‑to‑finish and paste one combined log file (WindowsUpdate.log + Event Viewer exports). Tell me which you prefer and I’ll post that exact checklist/commands.

Click to expand...

1. Please run winver (Windows+R → winver → Enter) and paste the full text it shows (Windows edition and build).
2. Is this a personal/home PC or managed by an organization (domain/Intune)?
3. You mentioned an error from the elevated CMD — please paste the exact text of that error (or re-run the commands and copy the output). Screenshots are OK, but plain text is much faster for diagnosis.

1. Open Task Manager (Ctrl+Shift+Esc).
2. Find SystemSettings.exe (or “Settings”), select it and click End task.
3. Press Windows key, type settings, open Settings and try the ESU enrollment again.
   Tell me whether it still hangs.

• sc query wuauserv
• sc query bits
• sc query cryptsvc
• net start wuauserv
  (If any command shows an ERROR or other message, paste it exactly.

• DISM /Online /Cleanup-Image /RestoreHealth
• sfc /scannow
  Reboot and try Settings again.

• If you have winget available, try (in admin PowerShell):
  winget install --id=Microsoft.WebView2Runtime -e
  Then reboot and retry the enrollment.

1. Open elevated PowerShell and run:
   Get-WindowsUpdateLog -LogPath C:\Temp\WindowsUpdate.log
   Then attach or paste the last ~100 lines from C:\Temp\WindowsUpdate.log.
2. In Event Viewer go to:
   Applications and Services Logs → Microsoft → Windows → WindowsUpdateClient → Operational
   and copy any Error/Warning entries that match the time you attempted the enrollment. Also check System and Application logs around that time. Paste the Event IDs/messages here.

• winver text (exact edition + build).
• Whether PC is managed.
• Exact text output of the CMD error you mentioned (or re-run and paste).
• Results of sc query commands and whether sfc / DISM found/fixed anything.
• Whether WebView2 is installed and whether reinstall/repair changed behavior.
• WindowsUpdate.log last ~100 lines and any Event Viewer error IDs/messages (if the problem persists).

1) Confirm / Repair WebView2 Runtime (preferred first)​

1. Settings → Apps → Apps & features
2. Find Microsoft Edge WebView2 Runtime
3. Click it → Modify (or Advanced options) → Repair

2) Install WebView2 Runtime (Winget)​

• If winget isn’t recognized, the machine likely lacks App Installer (or it’s blocked). In that case you’ll need to install WebView2 via Microsoft’s standalone installer.

3) Clear WebView2 cache (often fixes “Just a moment…”)​

1. Press Win + R
2. Paste:

1. Rename (or delete) this folder if present:

4) Repair system image + system files (good supporting step)​

DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow

5) If it still hangs: we need the exact place it happens​

• Where exactly you see “Just a moment…” (Settings path / screenshot description)
• Your Windows 10 version (winver)
• Whether this is Microsoft Account sign-in, Access work or school, Intune enrollment, or Windows Update/ESU enrollment
• Any error code in Windows Security / Settings / Event Viewer