The Update BureauFree support for Windows 10 22H2 ended on October 14, 2025. Since then, Windows 10 PCs keep receiving security updates only if they are enrolled in the Extended Security Updates (ESU) program. A PC that is not enrolled still works, but it no longer gets security fixes from Windows Update. See Windows 10 for the latest updates.
What ESU includes, and what it does not
ESU delivers the Critical and Important security updates, as rated by the Microsoft Security Response Center. It does not bring new features, non-security fixes or technical support. Updates arrive through Windows Update like a normal monthly update, so the monthly pages on this site apply to ESU devices too.
Two programs, two sets of rules
| Consumer ESU | Commercial ESU | |
|---|---|---|
| For | Home, Pro, Pro Education and Workstations PCs for personal use | Enterprise, Education and Pro editions in commercial use |
| Coverage ends | October 12, 2027 | Year 1 to October 13, 2026, Year 2 to October 12, 2027, Year 3 to October 10, 2028 |
| How to join | Settings › Update & Security › Windows Update › Enroll now | Buy ESU licences and activate the key on each device |
| Cost | Free if you sync PC settings (Windows Backup), or 1,000 Microsoft Rewards points, or a one-time $30 | Annual licence per device |
Good to know:
- A Consumer ESU licence covers up to 10 devices on the same Microsoft account. It is not offered on domain-joined, Microsoft Entra-joined or MDM-enrolled devices, or in kiosk mode.
- Commercial licences are annual, and Year 2 and Year 3 can only be bought after the previous year. We are now in Year 2 (since October 14, 2026).
- ESU costs nothing extra on Windows 10 virtual machines in Azure Virtual Desktop, Azure, Azure Local and Windows 365 Cloud PCs, with no key needed. A physical Windows 10 PC that connects to a Windows 365 Enterprise or Flex (dedicated) Cloud PC is entitled automatically if the user signs in with the same Entra ID account at least every 22 days.
For IT admins: install and check the key
Update the device first (22H2 with KB5066791 or later, then the ESU licensing preparation package). Get the multiple activation key (MAK) from the Microsoft 365 admin center (the Product Key Reader or VL Administrator role is required), then in an elevated prompt:
> slmgr.vbs /ipk <ESU MAK>> slmgr.vbs /ato <Activation ID>> slmgr.vbs /dlv
/dlv shows the Name of the ESU program and the License Status, which should read Licensed. Each year has its own Activation ID in Microsoft's documentation. Consumer ESU is tied to a Microsoft account and does not use a MAK. Windows 10 LTSC editions follow other rules: see Windows LTSC and IoT Enterprise LTSC.
What to plan
ESU is a bridge. The lasting fix is a PC that can run Windows 11; see the calendar for key dates.
Sources
Edited by the site editor. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake