Microsoft has started rolling out an "Enroll now" button inside Windows 10's Windows Update settings, a pivotal step that gives users a path to receive security patches after the operating system's October 14, 2025 end-of-support deadline. The button, tied to the August 2025 cumulative updates (KB5063709), began appearing on devices running Windows 10 version 22H2 in late August, with a broader rollout expected before the deadline. It launches an enrollment wizard for the Consumer Extended Security Updates (ESU) program, which offers a one-year lifeline of critical and important security updates until October 13, 2026.

The Clock Is Ticking: Why ESU Matters

Windows 10's retirement has been on the calendar for years, but millions of PCs still run the decade-old OS. After October 14, 2025, Microsoft will stop providing free security updates, technical support, and feature improvements for all editions. The company's primary recommendation is to upgrade to Windows 11, but many devices lack the required TPM 2.0, Secure Boot, or compatible CPU. Faced with this compatibility gap, Microsoft introduced the Consumer ESU program as a temporary bridge – a paid (or incentive-driven) way to keep Windows 10 machines secure for another year while users plan hardware refreshes or migrations.

What the "Enroll Now" Button Actually Does

The new enrollment entry appears directly beneath the familiar "Check for updates" area in Settings > Update & Security > Windows Update. Clicking it opens a wizard that detects whether the device is using a local or Microsoft account. Users are then presented with three paths to obtain ESU coverage:

  • Free enrollment via Microsoft account and OneDrive sync: Enable Windows settings sync to OneDrive. This essentially grants a free ESU license tied to the account.
  • Redeem 1,000 Microsoft Rewards points: Users who have accumulated points through Bing searches, Xbox activities, or Microsoft Store purchases can spend them instead of cash.
  • One-time purchase of the consumer ESU license: Priced at around $30 USD plus tax, this option still requires signing into a Microsoft account to associate the license. The purchased license covers up to ten devices linked to the same account.

All paths lead through a Microsoft account, a detail that has drawn sharp criticism. Even the paid option mandates account sign-in, which Microsoft says is necessary for license validation and management across multiple devices. For the free route, the requirement nudges users toward OneDrive and cloud syncing, effectively turning a security update into a product-placement opportunity.

What ESU Delivers – and What It Doesn't

The Consumer ESU program is deliberately limited. It provides monthly patches only for vulnerabilities rated Critical or Important. Non-security bug fixes, feature enhancements, and general technical support are excluded. This is a stopgap, not a continuation of full servicing. The coverage runs from the day after end-of-support (October 15, 2025) until October 13, 2026, giving consumers exactly one extra year of protection.

It's crucial to distinguish this from enterprise ESU agreements, which have historically offered multi-year options with escalating annual costs. The consumer offer is a single-year, three-option model; there is no second year for consumers. Microsoft's official documentation frames ESU as a "last resort" for devices that cannot be upgraded immediately, not a long-term strategy.

Real-World Risks: Lessons from August 2025's Update Turmoil

As if to illustrate the peril of running unsupported software, Microsoft's August 2025 Patch Tuesday brought a cascade of issues on both Windows 10 and 11. Cumulative updates broke recovery and reset workflows, interfered with certain SSDs, and even tanked streaming performance due to NDI-related networking problems. Microsoft had to issue out-of-band fixes and acknowledgments, leaving many users frustrated.

These incidents serve as a stark reminder: security patches – the very thing ESU promises – can still introduce regressions. Enrolling in ESU doesn't insulate a machine from update-related breakage. Prudent users should maintain full system image backups, separate recovery media, and offline copies of critical files before applying any post-retirement patches. The risk is amplified for aging hardware, where driver incompatibilities may be more common.

How to Check and Enroll: A Step-by-Step Guide

  1. Open Settings > Update & Security > Windows Update.
  2. If your device is eligible, you'll see an Enroll now (or similar) link beneath the "Check for updates" area. The feature is being staged; if missing, wait for the rollout or ensure you have installed the August 2025 servicing updates.
  3. Click the link. The wizard will detect your account type. If you're on a local account, you'll be prompted to sign in with a Microsoft account to proceed.
  4. Choose your enrollment method:
    - Sync settings to OneDrive to activate free enrollment.
    - Redeem 1,000 Rewards points if you have them.
    - Purchase the $30 license if neither of the above works.
  5. Confirm enrollment. Afterward, the device is tagged to receive ESU security patches automatically through Windows Update. Verify installations via Update history.

Note: ESU licenses are bound to the Microsoft account, not the device. This means you can use the same license for up to 10 PCs signed into the same account – a boon for households with multiple aging machines.

Cost, Scale, and License Mechanics

  • Consumer ESU: $30 (one-time) for up to 10 devices per account. Free with OneDrive sync, or redeemable with 1,000 Rewards points.
  • Enterprise ESU: Separate pricing with volume licensing, multi-year options, and per-device fees that increase yearly. This program is designed for organizations and is not part of the consumer enrollment button.

For small-scale users, $30 for a year of critical patches is cheap compared to the cost of a new PC or a security breach. But the forced Microsoft account linkage has privacy-conscious users balking. Microsoft's documentation clarifies that the account is used solely for license verification and management, not for additional data harvesting, but skepticism remains.

The Bigger Picture: Microsoft's Strategic Play

The ESU enrollment button is more than a convenience; it's a strategic lever. By making a Microsoft account essentially mandatory for continued security, Microsoft:

  • Drives account adoption among holdouts who still use local profiles.
  • Boosts OneDrive and Rewards engagement by tying free ESU to these services.
  • Accelerates the transition to Windows 11 implicitly, by giving users only a short reprieve rather than extended support.
  • Avoids a massive ecosystem security crisis – leaving 400+ million unpatched Windows 10 machines online would be a disaster for the internet as a whole.

Critics call it coercive, arguing that security should not be behind a gate that forces cloud sign-in. Defenders point out that account-based licensing is standard industry practice and that Microsoft is offering a low-cost, flexible safety net where it could have simply abandoned the platform. Either way, the button symbolizes the shift from a world of standalone PCs to one where online identity is central to the Windows experience.

Recommendations for Windows 10 Users

  1. If your PC is eligible for Windows 11, upgrade now. The free upgrade path remains the best long-term security strategy. Use the PC Health Check app or Windows Update to verify compatibility.
  2. If you're ineligible, start planning a hardware migration. ESU buys one year – use that time to budget, select a new device, and transfer data. Microsoft's trade-in program and third-party recycling offers can offset costs.
  3. Enroll in ESU as a safety net, but don't rely on it indefinitely. Whether you choose the free sync route, spend Rewards points, or pay $30, make sure you are covered past October 14, 2025.
  4. Mind the account trade-off. If you abhor Microsoft accounts, consider creating a throwaway account solely for ESU licensing, or accept the privacy concession for one year. The Rewards route avoids direct payment but still requires an account.
  5. Bolster your backup discipline. Before applying any patches after end-of-support, have a full disk image and separate file backups. Test recovery procedures on a spare machine if possible.

What to Watch Next

  • Enrollment availability: Microsoft says the button will reach all eligible Windows 10 22H2 devices before the October 14 deadline. If you haven't seen it by early October, manually check for updates and monitor the Windows Release Health dashboard.
  • Patch quality: Post-retirement security updates may not receive the same rigorous testing. Pay attention to Microsoft's known-issue lists and enthusiast forums before installing.
  • Potential policy shifts: User backlash over the account requirement could prompt Microsoft to offer a local-only paid option or clarify data handling. Keep an eye on the official ESU FAQ page for updates.

Final Assessment: A Welcome Lifeline with Strings Attached

The Consumer ESU enrollment button is a practical, long-awaited feature that formalizes the post-retirement patching process. With a staged rollout that began in late August 2025, it promises a simple workflow starting directly in Windows Update. For the millions who cannot or will not move to Windows 11 immediately, it's a necessary relief.

Yet the program's strings are impossible to ignore. Mandatory Microsoft account sign-in, the nudge toward OneDrive and Rewards, and the one-year-only duration all point to a vendor strategy of controlled attrition. Microsoft isn't selling an indefinite Windows 10 subscription; it's offering a measured exit ramp. For users, the choice is now explicit: embrace the account, accept the temporary patch pipeline, and use the borrowed time to plan a real migration. The "Enroll now" button is less an invitation and more a countdown timer – one that everyone still on Windows 10 should take seriously.