Microsoft’s decade-old Windows 10 will stop receiving free monthly security updates on October 14, 2025—but the company is offering a one-year consumer lifeline that few expected: a free Extended Security Updates (ESU) program accessible through three distinct enrollment paths. For millions of PC owners who cannot immediately upgrade to Windows 11, this program provides a crucial security bridge through October 13, 2026, offering a pragmatic middle ground between immediate migration and unprotected risk.

Windows 10’s end of mainstream support marks a turning point for the operating system that still runs on roughly 60% of Windows devices worldwide. After October 2025, machines that don’t enroll in ESU or upgrade will be cut off from critical vulnerability patches, leaving them exposed to an ever-growing array of exploits. Microsoft’s lifecycle policy has always been rigid: feature updates, quality fixes, and free security patches dry up on the cutoff date. But the newly announced consumer ESU program, officially detailed in Microsoft’s lifecycle documentation and echoed by multiple community reports, introduces a one-time escape hatch for home users and small businesses.

What the Consumer ESU Actually Is

The consumer Extended Security Updates (ESU) program is a security-only stopgap modeled after Microsoft’s long-standing enterprise ESU offerings. It delivers Critical and Important security fixes as classified by the Microsoft Security Response Center for qualifying Windows 10 devices for one additional year. Enrollment is tied to a Microsoft account rather than a product key, and a single consumer ESU license can be applied to up to 10 devices linked to the same account. Critically, it excludes feature updates, non-security bug fixes, and standard technical support—it is not a substitute for migration but a planned runway.

Microsoft’s own documentation stresses three defining characteristics: the updates are security-only, the program is time-limited from October 15, 2025 to October 13, 2026, and enrollment is bound to a Microsoft account rather than a device. This means that after the ESU year ends, no further patches will be available for Windows 10, even for enrolled users. Community forums and independent technical write-ups unanimously agree: ESU is a bridge, not a destination.

Three Enrollment Routes to Free (or Low-Cost) Protection

Microsoft has designed three consumer enrollment paths, all granting access to the same set of security fixes. Two are free; one is a modest paid option.

Free Route 1: Enable Windows Backup via OneDrive
When a user signs into Windows 10 with a Microsoft account and enables the Windows Backup tool to sync PC settings, folders, or credentials to OneDrive, the device becomes eligible for free ESU enrollment. This path nudges users toward cloud-backed backups, and while OneDrive’s free 5 GB tier is sufficient for settings and critical small items, it’s inadequate for full system backups. Users should plan local backups alongside this option.

Free Route 2: Redeem 1,000 Microsoft Rewards Points
Existing Microsoft Rewards participants can exchange 1,000 points to obtain ESU coverage. This option appears in the enrollment wizard where available. However, community reports indicate intermittent redemption failures during the staged rollout, with some users on Microsoft Q&A threads noting success after multiple attempts. If redemption fails, the paid alternative remains open.

Paid Route: One-Time Purchase (≈$30)
For a straightforward, no-strings-attached path, consumers can purchase a one-year ESU license for approximately $30 (local taxes and regional pricing may vary). One license can be reused on up to 10 eligible devices tied to the same Microsoft account, making it cost-efficient for households with several older PCs. This paid license is a flat fee, not a subscription, and unlocks the same security updates.

All three routes are surfaced through a staged wizard in Settings > Update & Security > Windows Update. Microsoft has rolled out the enrollment experience in waves, advising users to complete enrollment before October 14, 2025 to avoid any gap in protection.

Eligibility, Prerequisites, and Limits

Before attempting to enroll, verify that the device meets these strict requirements:

  • Windows 10 version 22H2: Only the latest feature update (Home, Pro, Pro Education, or Workstation editions) qualifies. Older builds are not eligible.
  • Fully patched: The device must have all cumulative updates and servicing stack updates applied as of mid-2025. Microsoft issued preparatory updates to enable the enrollment flow.
  • Microsoft account sign-in: Enrollment is tied to the Microsoft account used by a local administrator. Local-only accounts will be prompted to switch. Child accounts are excluded.
  • Not domain-joined or managed: Domain-joined, Azure AD-joined with MDM, kiosk, and enterprise-managed endpoints are ineligible. Organizations must use volume licensing for enterprise ESU.
  • Device cap: Up to 10 devices per Microsoft account.

If any condition fails—for instance, a PC running an older Windows 10 build or joined to Active Directory—the consumer wizard will not offer enrollment. Community threads and Microsoft’s lifecycle documentation both underscore that eligibility checks are stringent and that missing updates are a frequent cause of failed enrollments.

Step-by-Step: How to Enroll a Typical Home PC

  1. Open Settings > Update & Security > Windows Update and look for the “Enroll now” prompt in the ESU enrollment wizard.
  2. Sign in with the Microsoft account you want to bind the ESU license to (admin rights required).
  3. Choose one of the three enrollment methods: enable Windows Backup (OneDrive sync), redeem 1,000 Microsoft Rewards points, or purchase the ESU license.
  4. Follow on-screen instructions. Once complete, confirm that Windows Update shows “Registered for Extended Security Updates.”

If the wizard does not appear, ensure you’re on version 22H2, install all pending updates, and recheck Windows Update after a day or two—the rollout is staged. Microsoft recommends enrolling well before the October 14 deadline to prevent any exposure window.

Costs, Tradeoffs, and Limits of the ESU Lifeline

The consumer ESU’s pricing is strategically modest—about $30 once—but it only buys one year. Enterprises face a much steeper, multi-year model where costs double in later years under the classic enterprise ESU. For households, the free OneDrive path seems attractive but forces reliance on cloud backups; the 5 GB free tier won’t cover large photo libraries or extensive documents. The Rewards option assumes you’ve already gathered points, and early rollout glitches may require patience.

Crucially, ESU does not restore full vendor support. Microsoft will not add new features, fix non-security bugs, or provide regular technical assistance beyond the specific security updates delivered. Users who rely on ESU must treat it as a temporary runway to migrate—not an indefinite license to stay on Windows 10.

Security Implications and Why Governments Are Sounding Alarms

An unsupported operating system is a magnet for attackers. Without monthly patches, every new vulnerability in Windows 10 becomes a permanent open door. India’s Computer Emergency Response Team (CERT-In) recently issued an advisory urging users to upgrade or enroll in ESU, warning that unsupported systems “quickly become vulnerable to cyber-attacks, placing personal and professional data at risk.” The advisory explicitly recommends moving to Windows 11 for continued security.

Beyond patching, there are secondary timelines that reinforce the urgency. Microsoft has warned that Secure Boot certificates used across Windows platforms will begin expiring in June 2026, creating additional update and firmware implications for older hardware. Keeping devices in a fully supported state simplifies continuity for those certificate updates—another reason to treat ESU as a short bridge.

Practical Migration Planning: A Checklist for Households and Power Users

Use the ESU year to execute a careful, staged migration. Below is a prioritized checklist distilled from community advice and official guidance.

Immediate Actions (This Week)
- Run the PC Health Check tool to determine Windows 11 eligibility and pinpoint upgrade blockers (TPM, Secure Boot, processor).
- Ensure the device is on Windows 10 version 22H2 and fully patched.
- Back up personal data to two locations: OneDrive (cloud) and an external disk or full-image backup.
- Consider enrolling in ESU before October 14 if immediate upgrade is impossible.

Short-Term Planning (30–90 Days)
- For eligible PCs, test the Windows 11 upgrade on a single machine and verify that essential apps and drivers work.
- For ineligible machines, evaluate hardware upgrades (enable TPM, switch to UEFI/GPT, add RAM or SSD) versus replacing the device.
- Inventory critical applications and contact vendors to confirm Windows 11 compatibility.

Longer-Term (90–365 Days)
- If you opted for ESU, use the coverage window to complete migrations and retire old hardware before October 13, 2026.
- For businesses or advanced users, build a multi-PC rollout plan, verify licensing (one consumer license for up to 10 devices), and evaluate cloud desktop alternatives like Windows 365 or Azure Virtual Desktop if hardware replacement is cost-prohibitive.

Alternatives and Reality Checks for Ineligible Hardware

Not every PC can run Windows 11. For these, practical alternatives exist:

  • Replace hardware: A new Windows 11 PC is the simplest long-term solution.
  • Component upgrades: Many motherboards support TPM (Intel PTT or AMD fTPM) but ship with the feature disabled. Microsoft documents how to check and enable TPM, and converting from legacy BIOS to UEFI/GPT can unlock the upgrade path.
  • Linux migration: For modest use cases, a beginner-friendly Linux distribution can extend hardware life, but it requires different skills and may not support all software.
  • Cloud desktops: Windows 365 or Azure Virtual Desktop can stream a fully patched Windows environment to aging hardware as a stopgap for critical apps.

Beware of unofficial workarounds that promise indefinite security for unsupported systems. These often involve unsupported hacks or third-party images that void vendor support and increase long-term risk.

Controversy and Optics: Why the ESU Rollout Has Been Contentious

Microsoft’s consumer ESU has drawn predictable criticism. Some observers label it programmed obsolescence, arguing that Windows 11’s stricter hardware requirements force unnecessary upgrades. Others view it as a pragmatic bridge for a vast installed base that can’t immediately move. Independent reporting has explored the economic incentives: ESU revenue could be substantial, but the free options suggest Microsoft also wants to reduce the number of unprotected devices. Meanwhile, community groups have called for more generous migration assistance—perhaps extending support further or relaxing hardware checks.

Despite the debate, regulators and national CERTs emphasize the security reality over corporate optics. Unsupported systems increase national cyber risk, and governments want citizens to move to patched platforms. CERT-In’s advisory is a clear example of that public-interest emphasis, framing the upgrade not as a preference but as a security imperative.

Common Troubleshooting and Enrollment Snags

Several practical issues have emerged during the staged rollout:

  • ESU wizard not appearing: Microsoft advises keeping the device fully updated and retrying Windows Update periodically. The feature is being released in phases.
  • Microsoft Rewards redemption failures: Some users report declined or failed redemptions in the initial rollout. If this occurs, the $30 paid option remains available.
  • Domain-joined or managed devices: These will not see the consumer wizard. Organizations must use enterprise ESU channels through volume licensing.

If enrollment problems persist, confirm the Windows 10 version and build, install all updates, and sign in with the intended Microsoft account before retrying the wizard.

Final Verdict: Use ESU Judiciously—Then Migrate

Treat October 14, 2025, as a firm deadline for free updates. Microsoft’s lifecycle page confirms the date, and every technical and policy signal points toward the necessity of moving to a supported platform. If your PC can run Windows 11, upgrade as soon as practical after testing application compatibility. For those who need more time, consumer ESU is a valuable, accessible safety valve—especially with two free enrollment options. But it is not a permanent home.

Enroll before the deadline, back up your data, and use the extra year to plan and execute a migration. Microsoft has provided a one-year runway; responsible users will use it not to linger but to land safely on a supported operating system.