Windows 10 users have just weeks left to take one critical action—or risk leaving their PCs exposed to unpatched vulnerabilities after October 14, 2025. That’s the hard deadline Microsoft has set for the end of free support for consumer editions of the aging operating system. After that date, the only way to keep receiving security updates is through the company’s Extended Security Updates (ESU) program for consumers, and enrollment must be completed before the cutoff. This program provides a temporary bridge delivering only patches rated Critical or Important, extending coverage for one year—until October 13, 2026.

Microsoft has also confirmed that original Secure Boot certificates will expire in June 2026, adding urgency. Without updating or enrolling, machines may become vulnerable to attacks that exploit expired security mechanisms. For the nearly 1 billion PCs reportedly still running Windows 10 at the end of 2024, the ESU is the last official lifeline.

The ESU at a glance: what you get and what you don’t

The consumer ESU is not a continuation of regular Windows 10 support. It is a strictly limited, security-only mitigation. Enrolled devices will receive fixes for vulnerabilities designated Critical or Important by the Microsoft Security Response Center. There are no new features, no driver or firmware updates, no quality-of-life improvements, and no technical support beyond the patches themselves. Microsoft explicitly states the program is “not intended as a long-term solution but rather as a temporary bridge.”

That bridge is available to any qualifying Windows 10 device, but the clock is ticking. The official end-of-support date—October 14, 2025—is when the regular monthly security updates cease. If you haven’t enrolled by then, your system will go without any official patches for newly discovered flaws. The ESU coverage itself ends on October 13, 2026, at which point all consumer systems are out of support entirely.

Eligibility and prerequisites: a strict checklist

Before you can enroll, your machine must meet a precise set of requirements. Skipping any one of them will block enrollment or cause the wizard to fail.

  1. Windows 10 version 22H2: The ESU program only works on the final feature release of Windows 10. If you are still on an older version such as 21H2, you must upgrade. Check by going to Settings → System → About; the “Version” line should read 22H2.
  2. August 2025 cumulative update KB5063709: This critical patch resolves early enrollment wizard crashes and is the gating item for the rollout. The update brings 21H2-based systems to build 19044.6216 and 22H2 systems to build 19045.6216. Install it via Windows Update and reboot before proceeding.
  3. Administrator privileges and a Microsoft Account (MSA): You must sign into the PC with an MSA that has administrator rights. Local Windows accounts are not eligible—there is no workaround. The MSA ties your ESU entitlement to your identity and can be reused on up to 10 eligible devices.
  4. Working internet connection and Microsoft Store access: The paid enrollment flows through the Store, and even the free paths require connectivity to validate your account and sync settings.

Even if you meet every prerequisite, the enrollment wizard may not appear immediately. Microsoft is staging the rollout and has acknowledged that not all eligible devices will see the “Enroll now” link in Settings → Update & Security → Windows Update right away. After installing KB5063709 and signing in with your MSA, check daily. The phased release means acting early is the safest bet.

How to enroll: step-by-step

Once your system is ready, enrolling takes only a few minutes. Follow these steps before October 14:

  • Open Settings → Update & Security → Windows Update.
  • Look for a banner at the top-right that says “Windows 10 support ends in October 2025” with an “Enroll in Extended Security Updates” link. Click it.
  • The wizard will present three options:
  • Free via OneDrive backup: Sync your PC settings to your Microsoft OneDrive account. This requires enough free space in your OneDrive plan (the free tier offers only 5 GB).
  • Free via Microsoft Rewards: Redeem 1,000 Rewards points. This path has experienced intermittent redemption issues for some early users.
  • Paid $30 license: Pay a one‑time fee through the Microsoft Store. The license covers up to 10 devices linked to the same MSA.
  • Follow the on-screen prompts to complete your choice. If you select the OneDrive backup route, ensure you have adequate storage or be prepared to purchase additional space.
  • After enrollment, confirm that ESU-labeled updates appear in View Update History. You should see security-only updates arriving during the coverage window.

If the “Enroll now” link doesn’t appear, double-check prerequisites and retry over the following days. Microsoft has advised, “We’re working to restore the availability of the Windows 10 Extended Security Updates program in a subset of markets,” so some regions may see delays.

The free paths: caveats and hidden costs

The free enrollment options sound enticing, but they carry practical trade-offs.

  • OneDrive backup route: By choosing this, you give Microsoft permission to sync your Windows settings to your OneDrive cloud storage. The free 5 GB quota may not suffice if you have large amounts of settings data, especially if you already use OneDrive for files. Running out of space could force you to buy a paid OneDrive plan—at which point the “free” option incurs a recurring cost that may exceed the $30 ESU license.
  • Rewards redemption: While cost-free for those with enough points, the redemption system has been unreliable for some testers during the early rollout. If you attempt this path, have a backup plan.
  • Privacy implications: Both free routes tie your ESU enrollment to an MSA and, in the case of OneDrive, to cloud synchronization. Privacy-conscious users who prefer local accounts will find this an uncomfortable trade-off.

Risks of waiting and the importance of early action

Delay is the biggest enemy. Staged rollouts, intermittent wizard availability, and the need to troubleshoot enrollment failures mean that leaving it to the last week is risky. CNET’s testing confirmed that even after installing KB5063709, their test PC still did not show the enrollment link, highlighting the rollout’s unpredictability.

Moreover, the OneDrive quota problem could catch you off guard. If you discover at the deadline that your backup exceeds the free 5 GB, you may be forced to either purchase storage or pay for the ESU license anyway—adding stress and cost. Start the process now to leave time for hiccups.

The bigger picture: Secure Boot and ecosystem pressures

Beyond the immediate patch cutoff, Microsoft’s warning about expiring Secure Boot certificates in June 2026 adds another layer of risk. Secure Boot prevents malicious code from running during startup, and once those original certificates expire, unpatched Windows 10 machines may face new attack vectors. The ESU covers security patches but not firmware-level updates, so enrolling is only part of the defense.

The ESU program also serves Microsoft’s strategic goals. By requiring an MSA and, for the free path, OneDrive sync, the company nudges users deeper into its ecosystem. Critics argue this accelerates vendor lock-in and hardware churn, as many Windows 10 PCs don’t meet Windows 11’s stringent hardware requirements. The $30 fee, while modest, represents a deliberate incentive to eventually upgrade.

Practical recommendations: a 48-hour action plan

To maximize your chances of seamless coverage, follow this prioritized timeline:

  1. Immediately (Day 1): Verify your Windows 10 version is 22H2. Install all pending updates, especially KB5063709, and reboot.
  2. Within 24 hours: Create a full independent backup of critical data to an external drive. Use a disk-imaging tool or at least copy important files. Do not rely solely on OneDrive.
  3. Within 48 hours: Sign in with your Microsoft Account and check Windows Update for the enrollment wizard. Complete enrollment using the option that best fits your privacy and storage situation.
  4. If using the OneDrive free path, assess your OneDrive storage usage ahead of time. If you’re near the 5 GB limit, consider alternatives.
  5. Throughout the ESU year: Test critical applications on Windows 11 (or alternatives like Linux) on a spare machine. Plan a hardware refresh for unsupported devices and responsibly recycle old equipment.

Conclusion: seize the lifeline, plan the migration

Microsoft’s consumer ESU is a rare, time-limited concession that keeps Windows 10 secure for one extra year. For households and small users stuck on older hardware, it is an affordable and essential bridge. But it is not a permanent fix. The strict prerequisites, staged rollout, and potential hidden costs mean that procrastination is your worst enemy. Complete enrollment before October 14, 2025, and use the 12‑month reprieve to prepare your next move. The alternative—unpatched, unsupported systems—is a risk no one should take.