Windows 10 ESU 2027: How to Enroll and Keep Getting Security Updates

Windows 10 support ended on October 14, 2025, but eligible personal PCs can still receive important security fixes through Microsoft’s Consumer Extended Security Updates (ESU) program. Microsoft’s current guidance keeps consumer ESU coverage available through October 12, 2027.

That date does not mean Windows 10 has received a full support extension. ESU is a narrow security bridge: it can deliver critical and important security updates, but it does not add new features, provide general bug fixes, or create a new technical-support period. It is useful for buying time, not for avoiding an eventual move to Windows 11 or another supported operating system.

This guide explains who can enroll, what the program costs, where to find the enrollment control, why the option may be missing, and how to decide whether ESU is the right temporary plan for your PC.

The short answer

• Windows 10 Consumer ESU runs through October 12, 2027 for eligible devices enrolled under Microsoft’s consumer program.
• The PC must normally run Windows 10 version 22H2 and an eligible edition such as Home, Pro, Pro Education, or Pro for Workstations.
• The latest Windows updates and the ESU Licensing Preparation Package KB5126256 are required before enrollment can appear.
• Enrollment is intended for personal, non-commercial devices. Domain-joined, Microsoft Entra joined, MDM-enrolled, and kiosk scenarios can be excluded.
• Microsoft currently lists three consumer enrollment routes: sync PC settings at no additional charge, redeem 1,000 Microsoft Rewards points, or buy ESU for $30 in the United States, plus applicable tax or the local equivalent.
• ESU supplies security updates only. It does not supply feature updates, ordinary quality fixes, compatibility guarantees, or technical support.
• If the Enroll now option is absent, check the version, edition, update state, account type, device management state, and regional availability before assuming the program is broken.

What Windows 10 ESU actually is

Extended Security Updates are a post-support security program. They allow Microsoft to continue releasing selected security updates for supported Windows 10 configurations after the normal operating-system support date has passed.

For a consumer PC, the important distinction is between security coverage and product support. ESU is designed to reduce exposure to newly discovered security issues while you prepare a longer-term plan. It does not turn Windows 10 into a normally supported operating system again.

Microsoft’s consumer page describes ESU as coverage for critical and important security updates. Microsoft also says the program does not include new features, non-security fixes, general product enhancements, or technical support. In practical terms, ESU may close an important security hole while leaving an unrelated printer bug, application incompatibility, or missing feature unchanged.

The program is therefore best viewed as a controlled transition period. Use it to move files, test Windows 11, replace incompatible hardware, or plan a new PC. Do not treat the enrollment date as permission to keep an unmaintained computer indefinitely.

Why the dates are easy to confuse

There are two dates to keep separate:

The second date is not a new Windows 10 lifecycle. It is the end of the consumer security bridge described by Microsoft. Existing consumer enrollment is expected to continue through that date under the program rules, while new enrollment is available only while the offer and eligibility conditions apply.

Consumer ESU is also different from commercial or organizational licensing. A work computer managed by an employer may be governed by a separate agreement, and the consumer enrollment path is not intended to replace that process. If the PC belongs to a company, school, or other organization, ask the administrator which licensing route applies.

Eligibility checklist before you open Settings

Use this checklist first. It explains the most common reasons a Windows 10 PC does or does not show the enrollment option.

How to check the Windows version

Press the Windows key, type winver, and open the result. The dialog should identify Windows 10 and show version 22H2. If it shows an earlier version, open Settings > Update & Security > Windows Update, install all available updates, restart, and check again.

Do not use a registry edit or an unofficial script to force an older release into the ESU flow. A device that appears enrolled but is not supported by Microsoft is a poor security plan, especially when the goal is reliable security updates.

How to think about a personal PC with work access

A personal PC may still be used to access work email or a company service. That alone does not necessarily make it a commercial device. The important distinction is how the PC is registered and managed. A device that is fully joined to an organization or controlled by mobile-device management can follow different rules from a personal PC that merely has a work account added to an application.

If your organization controls Windows Update, security policy, or device enrollment, stop at the consumer flow and check with the administrator. Do not remove management controls just to make a button appear.

How much Windows 10 ESU costs

Microsoft’s current consumer guidance lists three ways to enroll. The exact offer displayed can depend on region, account, and the condition of the PC.

Microsoft notes that regional variations may apply. The wording and price shown in Windows Update are more relevant to your purchase than a price copied from another country. Take a screenshot or save the order confirmation for your own records, but do not post account, order, or device identifiers publicly.

Microsoft also says one ESU license can be used for up to 10 eligible devices. Read the terms shown for your account before enrolling several PCs, because a device still needs to meet the technical and account requirements.

The price should be weighed against the time you actually need. Paying for a short transition can make sense when a PC is otherwise usable and a Windows 11 replacement is scheduled. It is less attractive if the computer is already unreliable, cannot run current applications, or will remain on Windows 10 well beyond 2027.

How to enroll in Windows 10 ESU

The consumer enrollment flow is exposed through Windows Update. The labels can change slightly with rollout and region, so use the text you see on your own device as the final authority.

Step 1: Install all available Windows 10 updates

Open Start > Settings > Update & Security > Windows Update. Select Check for updates, install everything offered for the PC, and restart when Windows asks.

Repeat the check after restarting. A pending cumulative update, servicing-stack update, or restart can prevent the ESU offer from being displayed even when the PC is otherwise eligible.

Step 2: Confirm the PC is on version 22H2

Open winver again. If the PC is not on Windows 10 version 22H2, finish the supported update path first. Also confirm that the edition is one of the consumer editions listed above.

Step 3: Look for the enrollment card

Return to Settings > Update & Security > Windows Update. If Microsoft has made the offer available and the PC passes the checks, Windows should show an ESU enrollment prompt with an Enroll now action.

If the computer uses a local Windows account, the flow may ask you to sign in with a Microsoft account. Use an administrator account that is not a child account. If the offer asks you to turn on settings sync, review the choice before continuing.

Step 4: Choose an available enrollment route

Follow the route offered on the screen: sync the relevant PC settings, redeem Microsoft Rewards points, or complete the one-time purchase. Do not enter payment details on a third-party page claiming to activate ESU. Start from Windows Update or Microsoft’s official Windows 10 ESU page.

The official program page is Microsoft’s Windows 10 Extended Security Updates guide. It is the right place to check the current consumer rules and regional notes.

Step 5: Finish the confirmation and restart

Complete the account or payment flow, then restart if Windows requests it. Return to Windows Update and look for the enrollment or coverage status. Keep the confirmation email or order record if you used Rewards or the paid option.

There is no universal third-party “activation code” that should be typed into Command Prompt. If a guide tells you to bypass Microsoft’s enrollment checks, it is describing an unsupported workaround rather than the consumer ESU program.

Screenshot note for this guide

Microsoft’s enrollment control is account-, region-, rollout-, and device-state dependent. The current official guidance describes the flow in text, but it does not provide one fixed screen that every reader will see. For that reason, this guide uses verified menu paths and decision checks instead of showing a fabricated or stale screenshot with labels that may not match your PC.

When “Enroll now” is missing

Treat a missing button as a diagnostic clue, not as proof that ESU is unavailable. Check the causes below in order.

A fast troubleshooting order

1. Restart the PC.
2. Open winver and record the edition and version.
3. Install all Windows Update items and restart again.
4. Check update history for KB5126256.
5. Sign in with an administrator Microsoft account.
6. Check whether the PC is organization-joined or MDM-enrolled.
7. Reopen the Windows Update page and wait for the card to reload.

If the PC is eligible but the offer still does not appear, do not repeatedly purchase a code from a reseller. Use Microsoft’s support or account channels with the device’s enrollment state and update history ready. A reseller cannot make an unsupported device eligible.

What ESU includes—and what it does not

The easiest way to set expectations is to separate security coverage from general maintenance.

This is why a security update can be available while a separate Windows 10 issue remains untouched. The program is narrowly scoped by design.

ESU, Windows 11, or staying unsupported?

Use the following comparison to choose a transition plan rather than choosing only by price.

Before upgrading, back up documents and verify that critical applications, printers, scanners, accessibility tools, and VPN software work on the target system. Before replacing a PC, check that your files, browser passwords, license keys, and recovery options are documented.

How to confirm that enrollment is active

After enrollment, use the Windows Update page as the primary status location. Open Settings > Update & Security > Windows Update and review the message shown for the device.

Also check the following:

• The Microsoft account used for enrollment is still available to the person who manages the PC.
• Windows Update can check for and install normal updates without errors.
• The PC is not later changed into an organization-managed state that suspends consumer enrollment.
• Purchase or Rewards confirmation is saved if you used one of those routes.
• The PC continues to receive update notifications and is restarted when required.

Do not rely on a random command-line screenshot from an old guide as proof of consumer ESU status. Microsoft’s current status wording and the account portal are more useful than a command that was written for a different licensing channel.

If more than one person uses the same PC, Microsoft says one enrolled user can protect the other users on that same device under the consumer arrangement. Separate PCs normally need their own eligibility check and enrollment. This is especially important in a household with several Windows 10 computers.

Safety practices while you remain on Windows 10

ESU reduces the operating system’s security gap, but it does not make the rest of the computer maintenance-free.

• Keep your browser, password manager, PDF reader, office apps, and other third-party software current.
• Leave Microsoft Defender and the Windows firewall enabled unless a qualified administrator has a documented reason to change them.
• Use a separate backup drive or cloud backup and test that you can restore a file.
• Use a standard daily account where practical, with an administrator account available for maintenance.
• Remove unused remote-access tools and review browser extensions.
• Avoid pirated activation tools, registry bypasses, and scripts promising free ESU.
• Maintain an exit date. A PC that reaches October 2027 without a replacement plan will be back at the same decision point.

The backup recommendation matters because ESU is not a recovery service. It cannot undo ransomware, a failed disk, accidental deletion, or a damaged Windows installation.

What to do if your PC cannot enroll

Start with the reason, not a workaround. If the device is on an older version, update it through the supported Windows path. If it is an organization-managed PC, ask the administrator about commercial licensing. If the edition or region is not eligible, check the Windows 11 compatibility path or plan a supported replacement.

If Windows 11 is blocked by hardware requirements, compare the cost of a supported PC with the cost of keeping an aging machine alive. A low-cost replacement that receives current security updates may be safer and simpler than stacking unsupported patches on old hardware.

Do not confuse a third-party “Windows 10 security patch” with Microsoft Consumer ESU. The benefit of ESU is that it is tied to Microsoft’s own update and enrollment system. A separate patch source can create additional security, privacy, and update-integrity risks.

A practical transition plan through 2027

Use ESU as a schedule, not a destination.

Now

Confirm the version, edition, update state, and account type. If the PC is eligible, choose the enrollment route that matches your budget and privacy preferences. Make a backup before changing the operating system later.

During the bridge period

Keep Windows Update active, update third-party applications, and test the replacement path. If you are moving to Windows 11, verify hardware and application compatibility before the deadline becomes urgent.

Before October 12, 2027

Move the PC to Windows 11 or another supported operating system, replace it, or transfer daily work to a supported device. Export files and settings, confirm backups, and remove the old PC from sensitive accounts when it is retired.

Related Horus Valley coverage

For the next step, read Horus Valley’s guide to Windows 11 version 24H2 support ending on October 13, 2026 and the explainer on the Windows 11 October 2026 update. Those articles cover a different intent: planning Windows 11 support and updates rather than enrolling a Windows 10 PC in ESU.

Sources and editorial scope

This guide was checked against Microsoft’s official Windows 10 Extended Security Updates page on October 24, 2026. Microsoft’s offer, regional terms, Windows Update labels, and account requirements can change, so readers should treat the official page and the enrollment screen on their own PC as the final authority.

The article intentionally focuses on consumer eligibility, enrollment, cost, and decision-making. It does not present commercial volume licensing, unofficial bypasses, or a full Windows 11 installation tutorial as substitutes for the consumer ESU process.