Windows 10 users who were locked out of signing up for Microsoft’s Extended Security Updates (ESU) program finally have a working enrollment wizard, thanks to the August 2025 cumulative update KB5063709. The patch squashes a bug that caused the “Enroll now” setup to crash immediately upon launch, effectively blocking consumer sign-ups for the one-year security extension. With this fix, eligible PCs can once again secure critical patches through October 13, 2026—a safety net that buys time for millions of users not ready to abandon the aging OS.

The bug emerged in July 2025, shortly after Microsoft began surfacing the consumer ESU enrollment interface inside Windows Update settings. Instead of guiding users through a simple sign-up flow, clicking “Enroll now” often did nothing at all. The wizard would flash onto the screen and instantly disappear, or fail to load entirely. For users already wrestling with the looming October 14, 2025 end-of-support deadline, encountering a dead enrollment path felt like a cruel joke. “Score one for angry computer people,” wrote a VICE journalist covering the issue, capturing the mix of relief and lingering frustration among Windows 10 loyalists. The fix, though late, restores the intended flow and validates that Microsoft is serious about delivering on its consumer ESU promise.

What KB5063709 Actually Changes

KB5063709 is a cumulative security update that lands on Windows 10 22H2 systems as Build 19045.6216. (Older 21H2 devices receive a corresponding build in the 19044.x range.) Beyond routine security patches, it carries a specific quality fix: it corrects a defect in the ESU enrollment wizard that prevented users from completing the sign-up process. Installing this update should immediately repair the broken UI for affected machines, allowing the wizard to open, accept account credentials, and finalize enrollment as originally designed.

Under the hood, KB5063709 is often packaged with a Servicing Stack Update (SSU)—a combination that improves the reliability of Windows Update itself. Microsoft notes that when an SSU is bundled with a cumulative update, traditional uninstallation via wusa.exe may not remove the SSU portion; advanced users and IT admins should be aware of this layering. The update also draws attention to Secure Boot certificate lifecycle matters, warning that some devices may encounter boot issues as platform certificates age or change, particularly if firmware hasn’t been updated in a timely manner. These platform-level fixes are secondary to the enrollment repair but critical for administrators testing deployments.

Who Can Enroll and What You Get

Eligibility for the consumer ESU program is intentionally narrow. Only devices running Windows 10, version 22H2 (Home, Pro, Pro Education, or Workstation SKUs) qualify. They must be fully up to date and not domain-joined, managed by an MDM server, configured as kiosks, or already licensed through the enterprise ESU channel. Critically, every enrollment path requires a Microsoft account—local account users cannot complete the process. The ESU license is tied to that Microsoft account, not the device, which allows the paid option to cover up to 10 devices linked to the same account.

What ESU provides—and what it does not—is crucial to understand. It covers only Critical and Important security updates through October 13, 2026. No feature updates, general bug fixes, or technical support are included. Think of it as a stopgap: your PC will receive patches for known vulnerabilities, but the underlying OS will continue to age without improvements. It’s a temporary safety net, not a long-term servicing plan.

Microsoft exposes three consumer enrollment paths, all of which required the same account sign-in:

  • Free via Windows Backup settings sync: Enabling the built-in Windows Backup feature that syncs settings to OneDrive grants free ESU enrollment. It leverages settings sync rather than a full file backup, but it does tie your device state to the cloud.
  • Microsoft Rewards redemption: You can redeem 1,000 Microsoft Rewards points to enroll. This option is non-refundable and bound to the account that holds the points.
  • One-time paid purchase: A one-off payment—reportedly $30 per license—purchased through the Microsoft Store. That single license can be applied to up to 10 eligible devices associated with the same Microsoft account.

How to Install KB5063709 and Enroll

If you’re running Windows 10 and plan to stick around past October 2025, here’s the straightforward drill:

  1. Open Settings → Update & Security → Windows Update.
  2. Click Check for updates and install any available updates, specifically KB5063709 or the latest cumulative update that pushes your build to 19045.6216 (22H2). Reboot when prompted.
  3. Return to the Windows Update page and look for the Enroll now link or an ESU enrollment banner. It should be visible after the update is applied and the OS has restarted.
  4. Click Enroll now, sign in with your Microsoft account when prompted, and choose your enrollment method—free, rewards points, or purchased license.
  5. Follow the on-screen prompts to finalize. If you opt for the paid route, note that you can reuse the same ESU license on up to ten devices tied to the same account.

A pro tip for local account diehards: you won’t need to convert your entire login to a Microsoft account. During enrollment, Windows will ask you to sign in with a Microsoft account just for the ESU licensing step. Once the process completes, you can continue signing into Windows with your local account—though the ESU entitlement remains linked to that Microsoft account.

The Real-World Impact of a Broken Sign-Up

When the enrollment wizard crashed, the consequences were more than a nuisance. Users who saw the “Enroll now” prompt but couldn’t progress were left with a visible but non-functional path to security coverage. That’s arguably worse than not offering the option at all; it bred confusion and eroded trust at a critical moment. Households relying on aging Windows 10 PCs—often hardware that can’t meet Windows 11’s strict TPM 2.0 and CPU requirements—faced the real prospect of living without security patches after October 14, 2025.

KB5063709 eliminates that barrier, restoring a pragmatic safety net. For users who need more time to test Windows 11 hardware compatibility, schedule upgrades, or even explore Linux and Mac alternatives, an extra year of critical updates reduces immediate exposure to exploits. It’s a temporary but meaningful reprieve.

Strengths, Tradeoffs, and Privacy Concerns

Strengths
- Practical safety net: The program is simple, time-boxed, and covers the essentials. Having multiple enrollment paths—free, rewards, paid—makes it accessible to a wide audience.
- Servicing hygiene: Bundling the SSU with the LCU in KB5063709 strengthens update reliability and prevents future installation failures. The fix for the enrollment UI also addressed underlying app registration issues that caused the crash.
- Multi-device licensing: A single $30 purchase covering up to 10 devices is a genuinely user-friendly concession for households with several older machines.

Tradeoffs and Risks
- Microsoft account requirement: Every route to ESU locks you into a Microsoft account, forcing centralized authentication and cloud linkage. This will anger privacy-conscious users who deliberately run local accounts to limit telemetry and data sharing.
- Short-term only: After October 13, 2026, patches stop. No ifs, ands, or buts. Users who treat ESU as a permanent solution will be caught flat-footed.
- Limited update scope: Non-security bugs, driver enhancements, and performance improvements are not included. Your Windows 10 experience will remain frozen in time, except for vulnerability fixes.
- Firmware and Secure Boot caveats: The KB’s Secure Boot certificate lifecycle reminders matter. Older devices with outdated firmware could face boot problems when certificate validity periods shift. IT pros should test before mass deployment.
- Rollout confusion: VICE’s coverage noted that Microsoft’s web pages still carried outdated “support ends Oct 2025” language weeks after the ESU announcement, while the enrollment bug persisted. This gap between marketing and tech execution amplified user frustration. Microsoft has since updated its messaging, but the damage was done.

Privacy Implications
The free enrollment path demands that users enable Windows Backup settings sync to OneDrive—a move that sends your PC’s preferences and layout to Microsoft’s cloud. For those who recoil at the thought of their personal settings being collected and stored, this is an unacceptable exchange. The Rewards path similarly ties you deeper into the Microsoft ecosystem, while even the paid option requires account binding. There is no anonymous, local-only way to purchase ESU. Microsoft’s design philosophy here is clear: even when paying for security, users must consent to account-driven tracking.

Troubleshooting: If “Enroll Now” Is Still Missing

After installing KB5063709, most users will see the enrollment banner reappear. If you don’t, run through these checks:

  • Confirm build number: Go to Settings → System → About and verify that you’re on Build 19045.6216 or later (for 22H2). If not, open Windows Update again and scan for updates—you may need a later cumulative release.
  • Reboot again: SSU and LCU installations sometimes require an extra reboot to fully register UI changes and app registration fixes.
  • Verify eligibility: Double-check that your device is not domain-joined, MDM-enrolled, or configured as a kiosk. Consumer ESU doesn’t support those scenarios.
  • Run the Update Troubleshooter: Built into Windows 10, this tool can resolve stubborn servicing stack issues.
  • For advanced users: The original bug was linked to incomplete app registration states in the servicing stack. If you’re comfortable with the command line, consult Microsoft’s documentation on resetting the Windows Update components and checking the CBS.log for errors. But for most, a clean install of the latest cumulative update followed by a reboot does the trick.

If all else fails, Microsoft support or community forums can offer tailored help. The fix in KB5063709 has resolved the wizard crash for the vast majority of affected users, so persistent failures are likely due to environmental issues rather than a remaining code defect.

Broader Implications for Windows Users

The enrollment bug and its correction spotlight several enduring themes in modern Windows servicing.

First, the cumulative update + servicing stack model accelerates patch deployment but concentrates risk. A single SSU or LCU can leave a system in a subtly broken state that only reveals itself weeks later, when a dependent feature like the ESU wizard fails. KB5063709 itself is a testament to this model’s fragility and its self-correcting nature: Microsoft shipped a combined SSU+LCU to quickly undo the damage.

Second, the relentless push toward Microsoft account integration continues to clash with consumer expectations formed over decades of local-account Windows usage. The ESU program, despite being a paid service, offers no offline enrollment path. This is not an oversight—it’s a deliberate strategy to boost account adoption and gather data. For privacy advocates and IT professionals who value control, it’s a bitter pill.

Third, communication gaps between Microsoft’s product teams and its web/content teams remain a weak link. The outdated support webpage language, flagged by VICE and community posters, lingered for weeks while users were already wrestling with the broken sign-up. Clear, real-time coordination could have prevented some of the anger.

What You Should Do Right Now

  • Install KB5063709 via Windows Update or the Microsoft Update Catalog. Reboot. Check that your build number advances to 19045.6216.
  • Enroll before October 14, 2025. Don’t wait. The enrollment flow is now functional, and delaying risks forgetting entirely. Decide which path works for you: free settings sync, Rewards points, or the $30 paid plan. Factor in how many devices you’ll cover.
  • If privacy is paramount, skip the free sync route. The paid option still ties an account but avoids automatically syncing your settings. Better yet, begin migration planning immediately—Windows 11, a Chromebook, a Mac, or a Linux distribution. ESU is a bridge, not a destination.
  • For power users and IT admins: Test KB5063709 and the enrollment process on a representative system or in a lab. Pay attention to Secure Boot certificate lifecycle impacts on older hardware, and document the SSU + LCU interaction for offline servicing scenarios.

Microsoft’s late-breaking fix turns what could have been a catastrophic trust failure into a manageable—if inconvenient—pause. The technical repair is welcome, but the larger questions about account dependence, the limited scope of security-only updates, and the inevitability of migration remain. The responsible course for consumers is straightforward: install the update, secure that extra year if you need it, and spend it preparing for life after Windows 10. The clock is ticking, and the “Enroll now” button finally works. Use it.