Microsoft’s long-anticipated axe will fall on Windows 10 on October 14, 2025, but a one-year escape hatch is now open for anyone not ready to jump to Windows 11. The consumer Extended Security Updates (ESU) program, confirmed during mid-2025, gives eligible users a strictly time-boxed bridge: security-only patches until October 13, 2026, no features, no bug fixes, just a lifeline against critical vulnerabilities. Enrollment is already rolling out through Windows Update, but few users have noticed the quiet link tucked beneath the “Check for updates” button. Here’s what the program delivers, what it costs (hint: not necessarily a dime), and the hard truths every Windows 10 household needs to confront before the calendar flips.

The End of an Era: Windows 10 Support Ceases Free Coverage

After a decade of dominance, Windows 10 is being put out to pasture. Microsoft’s official lifecycle policy draws a hard line: after October 14, 2025, the operating system will no longer receive feature updates, routine quality patches, or technical support. That’s not a drill. Devices left unpatched become sitting ducks for exploits that emerge after the deadline, and security researchers have already warned that attackers stockpile vulnerabilities to use once patches stop flowing. Microsoft’s solution isn’t a reprieve—it’s a paid bridge for consumers and a far pricier one for enterprises.

The consumer ESU program first surfaced in early 2025 and was detailed in a series of support documents and cumulative updates. Its scope is deliberately narrow: only security bulletins rated Critical or Important by the Microsoft Security Response Center (MSRC) are delivered. No design changes, no driver updates, no performance tweaks. And it’s temporary—after October 13, 2026, the tap turns off completely.

This isn’t the first time Microsoft has sold post-retirement patches. Windows 7 ESUs were an enterprise-only affair, but the Windows 10 variant marks the first time individual consumers can buy extra time. The move acknowledges a stark reality: hundreds of millions of PCs can’t officially upgrade to Windows 11 because of hardware requirements like TPM 2.0 and newer CPUs, and many users are simply not ready to replace functional machines.

Understanding the Consumer ESU Program: Security Only, No Frills

The consumer ESU is not a support contract. It’s a licensing tweak that tells Windows Update to continue serving certain security patches after the general support cutoff. Microsoft’s support pages stress that ESU‑covered machines will not get new features, performance improvements, or fixes for non-security bugs. If a driver conflict makes your printer stop working, ESU won’t help. If a third-party app breaks after a security patch, you’re on your own.

The updates are the same security fixes that enterprises receive under their own ESU plans, but the consumer version is stripped of any extended support calls. Microsoft offers only activation and installation assistance. Everything else falls outside the scope.

Crucially, the program’s coverage ends abruptly on October 13, 2026. There is no consumer path beyond that date. Organizations needing longer coverage must negotiate enterprise ESU agreements, which are sold as annual subscriptions with escalating costs. For home users, it’s a one-and-done arrangement: enroll now, get updates for one year, then move on.

Who Qualifies? The Strict Eligibility Checklist

Not every Windows 10 machine can enroll. Microsoft published a tight set of prerequisites that must be met before the “Enroll now” option appears in Settings:

  • Version 22H2 only: Your device must run Windows 10, version 22H2 (Home, Pro, Pro Education, or Pro for Workstations). Older feature updates are not supported, so machines still on 21H2 or earlier must upgrade to 22H2 first.
  • Fully updated: The latest cumulative updates and servicing stack updates must be installed. Microsoft specifically pointed to August 2025 patches (including KB5063709) as essential for enrollment readiness.
  • Microsoft account required: A Microsoft account with administrator privileges is mandatory. Local accounts will be prompted to sign in; child accounts are excluded.
  • Not domain-joined or managed: The consumer ESU path is blocked for devices that are domain-joined, managed via MDM, or running in kiosk mode. Those machines must rely on enterprise ESU channels or be upgraded.

These conditions make the consumer ESU a distinctly individual affair. It’s aimed at households, freelancers, and small offices that need a short runway to replace hardware or migrate to Windows 11.

Three Paths to Enrollment: Free, Points, or $30

Microsoft designed three enrollment routes, all delivering identical security coverage. The choice boils down to how much you’re willing to share or pay:

  • Free via Windows Backup syncing: By linking your PC to a Microsoft account and enabling Windows Backup to sync settings to OneDrive, you earn a no-cost enrollment. This route directly ties the security lifeline to cloud integration, which has sparked privacy debates.
  • Redeem Microsoft Rewards points: Users can exchange 1,000 Microsoft Rewards points for one year of ESU. Accumulating points requires using Bing, shopping at the Microsoft Store, or completing other activities within the Rewards ecosystem.
  • One-time purchase for $30: A straightforward payment of $30 USD (plus applicable tax) buys a single license that covers up to 10 devices linked to the same Microsoft account. This is the simplest route for those who don’t use Rewards and don’t want to sync to OneDrive.

All three options appear in the enrollment wizard, which is accessed through Windows Update settings. Microsoft rolled out the wizard gradually, and early glitches prevented some users from signing up until the August cumulative update landed.

Step-by-Step Enrollment Walkthrough

If your machine meets the prerequisites, follow these steps to lock in ESU:

  1. Verify edition and build: Go to Settings > System > About and confirm you’re on Windows 10, version 22H2. If not, run Windows Update until 22H2 is installed.
  2. Install all pending updates: Check Settings > Update & Security > Windows Update and install everything. The August 2025 cumulative update (KB5063709) is critical—it fixed an enrollment wizard crash. Restart if required.
  3. Sign in with a Microsoft account: If you’re using a local account, sign in or create a Microsoft account with administrator rights.
  4. Find the enrollment link: In Windows Update, look for a line that says “Enroll now” or “Enroll in Extended Security Updates” beneath the “Check for updates” button. Click it.
  5. Choose your enrollment method: The wizard presents the three options: enable Windows Backup sync for free, redeem 1,000 Rewards points, or purchase a $30 license. Follow the prompts to complete enrollment.
  6. Confirm status: After enrollment, revisit Windows Update. Successful sign-up means your device will receive ESU patches when they become available. No immediate update is delivered.

If the “Enroll now” option doesn’t appear, ensure all updates are installed, restart, and sign in with a Microsoft account. Microsoft’s phased rollout means the option may take time to appear for some. Community forums like r/Windows10 and Windowslatest.com noted that users on older builds or with pending updates were most likely to encounter a missing link.

What ESU Actually Delivers – And What It Doesn’t

Let’s be blunt: ESU is not a substitute for upgrading. Here’s the fine print:

You get:
- Security updates classified as Critical and Important by the MSRC, delivered via Windows Update.
- A maximum of one year of coverage from October 14, 2025 to October 13, 2026.

You do not get:
- New features, quality improvements, or performance fixes.
- Non-security bug fixes, even if they cause crashes or application issues.
- Technical support beyond installation and activation.
- Any updates after October 13, 2026.

Think of ESU as a time-limited security umbrella. It will keep you dry from known critical storms, but it won’t patch the leaky roof. And when the year expires, the umbrella vanishes.

The KB5063709 Patch: How Microsoft Fixed Enrollment Glitches

Early ESU adopters hit roadblocks. The enrollment wizard either failed to launch or crashed mid-way through the process. Microsoft acknowledged the problem in August 2025 and released cumulative update KB5063709, which specifically targeted ESU enrollment bugs. Independent outlets like BleepingComputer and Windows Latest confirmed that after installing the patch, the “Enroll now” link appeared and the wizard completed successfully for most users.

The patch is now part of the mandatory updates required for eligibility. Even if you don’t see the enrollment link, installing KB5063709 (or a subsequent cumulative update that subsumes it) is a key troubleshooting step. Microsoft’s release notes for the update describe it as addressing “reliability improvements for the ESU enrollment experience.”

Security vs. Cloud: Privacy Concerns Around the Free Route

The free enrollment path—enable Windows Backup syncing to OneDrive—raised eyebrows among privacy advocates. To secure no-cost updates, users must not only sign into a Microsoft account but also actively sync their settings to the cloud. This deepens device telemetry and ties the security benefit to Microsoft’s ecosystem. For users who have resisted cloud integration on principle, the choice feels like a forced tradeoff.

Microsoft’s rationale, as explained in support documents, is that account linkage simplifies license management and device identification. But it also nudges users toward OneDrive adoption and data syncing, which can be seen as a soft prerequisite for Windows 11 migration. Those uncomfortable with the arrangement can opt for the $30 payment or use Rewards points, but the privacy calculus remains a sore spot in community discussions.

Enterprise vs. Consumer: Different Games for Different Users

It’s important to note that the $30 and free consumer ESU options do not extend to businesses or managed environments. Domain-joined or MDM-enrolled devices must use enterprise ESU channels, which are licensed differently and cost significantly more—pricing escalates each year. Enterprise ESU also covers older versions like Windows 10 Enterprise LTSC and can run for up to three years. But for a small office with a handful of machines that happen to be on a domain, the consumer program is off-limits. Those admins must either remove machines from the domain (not recommended) or budget for commercial ESU.

Expert Advice: Should You Enroll or Upgrade?

For most users, the decision tree is straightforward:

  • If your PC supports Windows 11 and you’re comfortable with the interface changes, upgrade now. The free upgrade offer remains available, and moving to a fully supported OS eliminates the need for ESU altogether. This is the long-term secure path.
  • If you can’t upgrade because of hardware incompatibility (missing TPM 2.0, unsupported CPU) or because of legacy software, enroll in ESU immediately. Choose the enrollment method that aligns with your privacy tolerance. The $30 payment is a small price for peace of mind, especially if you manage multiple devices.
  • If you’re undecided, enroll anyway. You can always upgrade later, but once the October 2025 deadline passes, unenrolled machines won’t receive any updates. Enrolling now gives you a safety net while you plan.

Security practitioners urge users not to treat ESU as a permanent solution. The clock is ticking. Every month after October 2025, your device will miss non-security fixes, and application compatibility will gradually erode. Use the year to replace hardware, migrate workflows, or adopt alternative operating systems where appropriate.

The Bigger Picture: E-Waste and the Windows 11 Mandate

The ESU program has reignited debates about planned obsolescence. Windows 11’s strict hardware requirements—TPM 2.0, 8th-gen Intel or newer CPUs—mean that many perfectly functional PCs from 2017 or earlier are officially left behind. Environmental groups and consumer advocates decry the e-waste implications, while Microsoft argues that baseline security features like virtualization-based security and secure boot require modern hardware.

ESU offers a Band-Aid, but it doesn’t solve the underlying tension. Independent reporting has documented that unofficial workarounds exist to install Windows 11 on unsupported hardware, but those come with their own risks and uncertainty. For now, the consumer ESU is the only official way to keep older hardware patched for one more year.

Final Recommendations: Act Now, Plan Ahead

The consumer ESU program is real, functional, and already accepting enrollees. But it is a bridge, not a destination. Here’s what to do today:

  • Run Windows Update immediately and install every available patch, including KB5063709.
  • Look for the “Enroll now” link in Windows Update settings. If it’s there, walk through the wizard and choose your payment path.
  • Back up your data before making system changes, even if you’re just enrolling in ESU.
  • Audit your device fleet if you manage multiple machines. Identify which can upgrade to Windows 11, which need ESU, and which should be retired or isolated.
  • Start budgeting for hardware refreshes if you’re running unsupported PCs. October 2026 will arrive faster than you think.

For Windows 10 loyalists, this is the final call. The updates won’t last forever, but with a few clicks—and perhaps a $30 payment—you can squeeze one more year of safety out of an aging favorite.