Microsoft has officially begun enrolling Windows 10 users in its long-awaited Extended Security Updates (ESU) program, granting consumers up to two more years of critical security patches after the operating system hit end of support on October 14, 2025. The program runs until October 12, 2027, a longer window than many had expected, but it imposes a firm new requirement: every enrolled device must be linked to a Microsoft account. That condition, plus a patchwork of enrollment options that include a free path, a Microsoft Rewards redemption, and a one-time purchase, has ignited both relief and frustration across the Windows community.

What Exactly Does the ESU Program Deliver?

The ESU program for consumers addresses the single biggest risk of sticking with Windows 10 after support lapses: unpatched vulnerabilities. Devices enrolled in ESU receive monthly security updates classified by the Microsoft Security Response Center as “Critical” or “Important.” These patches are delivered through Windows Update just like regular updates were before the end-of-support date. What users won’t get are feature updates, quality-of-life improvements, new tools, or access to Microsoft technical support. In effect, ESU preserves the security posture of a Windows 10 PC, but the operating system remains frozen in time — no new File Explorer upgrades, no Copilot integrations, and no fresh driver optimizations.

Crucially, the program is not a backdoor to indefinitely prolong Windows 10. Microsoft states unequivocally that ESU is a transitional solution: “The ESU programme helps reduce the risk of malware and cybersecurity attacks … while they transition to Windows 11.” It offers breathing room for users who cannot immediately upgrade, whether because of hardware incompatibility, application dependencies, or budget constraints.

The Enrollment Options: Free, Points, or Paid

What makes this consumer ESU rollout unique is the trio of enrollment paths Microsoft has built into the Windows Update settings page. Eligible devices running Windows 10 version 22H2 see a new “Enroll in Extended Security Updates” link inside Settings > Update & Security > Windows Update. From there, users choose one of three ways to activate coverage:

  • Free via Windows Backup: If the device is already syncing PC settings to OneDrive through Windows Backup, ESU enrollment is offered at no additional cost. For users who haven’t enabled backup, starting the sync during enrollment qualifies them for the free option. This ties security to Microsoft’s cloud ecosystem and nudges more people toward OneDrive.
  • Microsoft Rewards points: 1,000 Rewards points can be redeemed per device. While not free in the strictest sense, it allows anyone who has accumulated points through Edge searches or purchases to offset the cost entirely.
  • One-time purchase: Users who don’t want to use OneDrive sync or lack Rewards points can pay a flat fee. The official Australian pricing is AU$44.95, while early reports from U.S. outlets pegged the cost at $30 USD. The exact U.S. price will be shown during enrollment and is expected to be the local currency equivalent of $30.

A single license can cover up to 10 devices — as long as all are enrolled using the same Microsoft account. That makes the deal particularly attractive for households with multiple older PCs.

The Microsoft Account Requirement and Privacy Trade-Offs

The most contentious part of the program is the absolute requirement to sign in with a Microsoft account during enrollment. Even users who pay the one-time purchase must link the license to a Microsoft account. This rule, Microsoft explains, is necessary to enforce the 10-device limit and to tie the ESU license across devices. But it forces users who have long relied on local accounts — a group that includes many privacy-conscious individuals and small-office setups — into an online identity model they may not want.

Community reactions on forums and in comments sections have been sharply critical. “This is just another way Microsoft forces us into their ecosystem,” one user wrote in a popular Windows forum. “I don’t want my security updates contingent on a Microsoft account.” Another complained that the enrollment flow feels like “a bait-and-switch — you start thinking it’s a simple update and suddenly you’re stuck linking a live.com account.” These sentiments echo a broader unease about account-linked telemetry and the loss of local control.

From a technical standpoint, the account requirement is not merely corporate overreach. Without it, Microsoft would have no reliable way to manage ESU entitlements across reinstallations or hardware changes. But the friction is real, and it will likely push some users to either rush their Windows 11 migration or accept an unsupported Windows 10 device rather than create yet another online account.

Requirements and Enrollment Gotchas

Only devices that meet a specific set of criteria will see the ESU enrollment link. The system must be running Windows 10 version 22H2 (Home, Pro, Pro Education, or Workstation editions) with the latest cumulative and servicing stack updates installed. Machines that are domain-joined, managed through a mobile device management solution, or running in kiosk mode are explicitly excluded; those scenarios fall under enterprise ESU licensing. However, devices that are Microsoft Entra registered (a lighter-touch cloud identity) can still use the consumer program.

A late-summer servicing patch — tracked as KB5063709 and released in August 2025 — proved critical. Before that update, many eligible users could not complete enrollment because the wizard would crash or fail to launch. TechRadar and Tom’s Guide both covered the bug, and Microsoft’s release notes confirmed the fix. If today a user doesn’t see the ESU link, the first troubleshooting step is to check for updates and install any pending patches.

The sign-in process requires an adult administrator account, not a child account. If a device has multiple local accounts, users will be prompted to log in with a Microsoft account during enrollment, and the license is then associated with that account. Child accounts cannot initiate enrollment; a parent must sign in separately on the child’s device to add coverage.

Timeline: The Dates That Matter

Navigating the ESU landscape means tracking several overlapping deadlines:

  • October 14, 2025: Windows 10 reached end of support. No more free security or feature updates from that date forward for unenrolled devices.
  • October 12, 2027: The consumer ESU program ends. After this date, even enrolled devices stop receiving any security patches from Microsoft.
  • October 10, 2028: Microsoft 365 Apps (Word, Excel, Outlook, etc.) will continue receiving security updates on Windows 10 until this date, giving organizations and individuals extra time to keep productivity workflows secure even after the OS updates cease.
  • Edge browser support: Microsoft has committed to delivering Edge security updates on Windows 10 for free through at least 2028, reducing the immediate pressure for a browser-based attack surface.

This staggered timeline means that a Windows 10 PC enrolled in ESU can remain functionally safe for most everyday tasks until late 2027, with Office and Edge protections extending a bit further. However, after October 2027, the OS itself becomes a hard liability.

Consumer vs. Enterprise: Two Different Worlds

The consumer ESU program is designed for personal and very small business use. Enterprises have a separate channel with its own pricing model, which typically scales by device and increases year-over-year. Historically, enterprise ESU fees double each successive year — so a company paying roughly $25 per device in the first year might owe $50 the next and $100 the year after. Organizations can also leverage Windows 365 Cloud PC or Azure Virtual Desktop as alternatives that include Windows 11 licensing and keep unsupported hardware off the local network.

For IT managers, the consumer program’s restrictions are a non-starter: it cannot be used on Active Directory–joined machines, and the $30–$45 flat fee per device may look cheap but comes with no centralized management, no bulk deployment tools, and no technical support. Companies that delay migration must engage Microsoft’s volume licensing agreements or risk non-compliance.

Community Reaction: Relief Mixed with Frustration

In the Windows enthusiasts’ forum that broke the news, the mood is cautiously grateful but wary. One prolific poster summarized the sentiment: “The free option is great — if you already trust OneDrive. For the rest, it’s $30 or giving Microsoft more of your data. Still, it’s better than a zero-day nightmare.”

Many users reported that the free Windows Backup route works smoothly once the KB5063709 patch is installed. But they also noted that the backup setting must be enabled before enrollment; turning it on retroactively doesn’t always trigger the free option. Others found that the Rewards redemption fails if the account hasn’t collected enough points, leaving them with the paid path.

A recurring complaint is the lack of clarity about what happens if a Microsoft account used for ESU is later deactivated or hacked. Microsoft’s FAQ doesn’t address that scenario in detail, aside from stating that the license is tied to the account and can be managed through Order History. That ambiguity worries users who fear losing security coverage through an account outage.

The Bigger Picture: Migration, Not Perpetual Patching

Microsoft has been unequivocal: ESU is a bridge, not a destination. The company continues to promote Windows 11 as the only long-term supported platform. An in-place upgrade is free for devices that meet Windows 11’s hardware requirements — which include a TPM 2.0 chip, Secure Boot–capable UEFI firmware, a supported Intel/AMD/Qualcomm CPU generation, and at least 4 GB of RAM and 64 GB of storage. The PC Health Check tool, available from Microsoft’s website, runs a quick compatibility check.

For the hundreds of millions of PCs that fail the hardware bar, Microsoft recommends a hardware refresh to a Windows 11 or Copilot+ PC. This is where the economics shift: while $30 to $45 buys a year of security updates, a new laptop purchase can be a much larger expense. Many households and small businesses on tight budgets will likely choose ESU as a short-term fix while they save for new equipment.

Environmental concerns also simmer under the surface. The forced hardware refresh risks creating a glut of e-waste as otherwise functional PCs are retired solely because of a missing TPM chip or older CPU. Critics argue that the ESU program, while welcome, merely postpones that problem by two years.

How to Enroll: Step-by-Step

For those who decide ESU is the right move, here is the concise enrollment process:

  1. Ensure your PC runs Windows 10, version 22H2, and install all available Windows updates. Restart if prompted.
  2. Go to Settings > Update & Security > Windows Update. Look for the “Enroll in Extended Security Updates” banner or link.
  3. If the link doesn’t appear, check for pending updates again; the KB5063709 servicing stack update must be installed.
  4. Click Enroll now. You will be asked to sign in with a Microsoft account. If you normally use a local account, have your credentials ready.
  5. Choose your enrollment option: enable Windows Backup sync (free), redeem 1,000 Rewards points, or pay the one-time purchase.
  6. Complete the enrollment. You can verify status on the same Windows Update page after it’s done.

If the device belongs to a child, the parent must temporarily sign in with their own Microsoft account (as an administrator) to enroll. The ESU license will apply to all users on that PC.

Troubleshooting Common Hurdles

  • ESU link missing: The most frequent cause is missing the August 2025 cumulative update. Install all updates manually via Settings or the Microsoft Update Catalog.
  • “This device can’t be enrolled”: Verify the edition is not Pro for Workstations configured in kiosk mode, domain-joined, or MDM-enrolled. Entra-registered devices are eligible.
  • Rewards points not accepted: Ensure the Microsoft account has at least 1,000 points. Points are separate from Xbox or Game Pass balances.
  • Unable to sign in: Use an adult administrator Microsoft account. Child accounts are blocked.

Final Assessment: A Pragmatic Pause That Demands a Plan

Microsoft’s consumer ESU program is a pragmatic concession to the reality that tens of millions of PCs cannot, or will not, jump to Windows 11 by the end-of-support date. By giving users a free enrollment path via OneDrive, it cleverly nudges more users into the Microsoft cloud without forcing an immediate hardware purchase. The paid and Rewards options offer reasonable alternatives for those who resist the sync.

Yet the program’s limitations are stark. It provides no feature progress, no performance boosts, and no assistance with application compatibility as third-party software increasingly drops Windows 10 support. The mandatory Microsoft account remains a pill many users will swallow reluctantly, and the 2027 hard stop means that every enrolled PC eventually must be decommissioned, upgraded, or replaced.

For households and very small offices, the recommended playbook is clear: run the PC Health Check to see if a free Windows 11 upgrade is possible. If yes, do it before October 2025 to stay fully supported without the account hassle. If not, enroll in ESU through the free Windows Backup route — but immediately start budgeting for a new PC by mid‑2027. Enterprises should avoid the consumer program entirely and instead evaluate volume licensing, Windows 365, or a structured hardware refresh.

The ESU program won’t make anyone love Windows 10 more. It simply buys time — two years of it — and demands that users use that time wisely.