The clock is ticking for Windows 10. As the October 14, 2025 end-of-support date barrels forward, Microsoft has quietly issued a rare consumer-friendly move: a one-year Extended Security Updates (ESU) program that can be activated through a simple Windows Update toggle—and it’s deliberately cheap. For $30, a household can cover up to ten devices. That’s the headline, but the real story is in the details, trade-offs, and the stark reality that this is a temporary bridge, not a permanent shelter.

For millions of users whose hardware can’t—or won’t—migrate to Windows 11, the ESU offering fills a security vacuum. Without it, every unpatched vulnerability discovered after October 14 would be an open door. With it, critical and important patches keep flowing until October 13, 2026. But this isn’t a free pass to ignore the future. It’s a calculated pause, and making it work requires understanding exactly who qualifies, how to enroll, and what risks remain.

Why Microsoft Is Offering Consumer ESU Now

Windows 10’s sunset has been public knowledge for years. When it hits end of support, Microsoft halts all security updates, feature improvements, and technical assistance. For businesses, this has long been a manageable risk—they’ve had access to enterprise ESU agreements. But for everyday consumers, the path forward has been murkier.

Microsoft’s pivot is as much about practicality as it is about optics. There are still hundreds of millions of active Windows 10 devices, many blocked from Windows 11 by TPM 2.0 requirements, unsupported CPUs, or simply because users aren’t ready to switch. Rather than leave them exposed—and invite criticism or regulatory scrutiny—the company carved out a consumer ESU track. It’s narrow in scope, but it’s also simpler than any enterprise licensing maze.

The Core ESU Offering: Security Only, One Year Only

The consumer ESU program is stripped down to essentials:

  • It delivers only security updates rated critical or important by Microsoft. No new features, no performance improvements, no optional patches.
  • It lasts exactly one year: from October 14, 2025, to October 13, 2026.
  • It applies solely to devices running the final feature release, Windows 10 version 22H2.

Think of it as a security-only umbrella that fits a very specific slice of the ecosystem. If you’re still on an older Windows 10 build, you’ll need to update to 22H2 before enrolling—a point many users may miss.

Three Paths to Enroll: Free, Rewards, or $30

Microsoft designed enrollment to be unusually accessible. When a device meets prerequisites, a new “Enroll in Extended Security Updates” option appears in Settings > Update & Security > Windows Update. From there, you pick one of three lanes:

  1. Free (with a trade-off): Enable device settings sync, which backs up your PC settings to your Microsoft account via OneDrive. Once syncing is on, the enrollment wizard unlocks at no charge. This path is ideal for single-device users comfortable with cloud sync, but it does mean handing over settings data to Microsoft’s servers—a privacy consideration some will reject.
  2. Microsoft Rewards: Redeem 1,000 Rewards points per device. If you’re already a heavy Bing or Edge user, this might be the cheapest route, effectively zero cost. But points balances vary widely.
  3. Paid $30 option: The crowd-pleaser. A one-time $30 purchase attaches an ESU license to your Microsoft account. That single purchase then covers any up to 10 eligible Windows 10 devices signed in with the same account. For a household juggling multiple aging laptops or desktops, $30 is strikingly affordable—far less than a single new PC.

All three paths demand a Microsoft account with administrator privileges on the device. Local accounts won’t cut it; the wizard will prompt you to convert or sign in. That’s a sticking point for privacy purists, but it’s also the mechanism that keeps the $30 multi-device deal manageable.

Eligibility: Who Gets In and Who’s Left Out

Not every Windows 10 machine qualifies. The checklist is short but rigid:

  • Operating System: Must be Windows 10, version 22H2 (Home, Pro, Pro Education, or Workstation editions). Earlier builds won’t see the enrollment prompt.
  • Updates: The latest cumulative updates must be installed. Microsoft shipped several mid-2025 quality patches specifically to stabilize the ESU enrollment wizard. Without them, the option may not appear even on 22H2.
  • Account: The Microsoft Account used for enrollment must be an admin on the PC and cannot be a child account.
  • Exclusions: Devices joined to an Active Directory domain, managed via enterprise MDM (like Intune), or already holding an enterprise ESU license are locked out of the consumer program. Kiosk and specialized configurations may also be blocked.

Businesses should not attempt to shoehorn corporate machines into the consumer ESU path. Microsoft offers separate commercial ESU programs with different licensing terms and activation methods. Misusing the consumer track could lead to compliance gaps.

Step-by-Step: How to Enroll Right Now

If you’re ready to secure your Windows 10 device, follow these steps:

  1. Update to 22H2 and install all quality patches. Head to Windows Update, check for updates, and install everything offered.
  2. Verify your edition. Go to Settings > System > About and confirm the OS version reads “Windows 10, version 22H2”.
  3. Check Windows Update again. After the final cumulative update, the “Enroll in Extended Security Updates” banner should appear below the main Check for updates button.
  4. Click Enroll now. Sign in with your Microsoft Account when prompted.
  5. Choose your method. Pick between free (enable settings sync), Rewards (redeem 1,000 points), or $30 payment. For the paid option, the purchase is tied to your Microsoft Account, not the device—so repeat enrollment on up to nine more devices without paying again.
  6. Complete the wizard and watch for a confirmation. Post-enrollment, you’ll see ESU-related entries in Windows Update history after October 14, 2025.

If the option doesn’t appear, download the latest cumulative update manually from the Microsoft Update Catalog or run the Windows Update troubleshooter. In some cases, a restart is needed to surface the prompt.

The $30 Math: Cheap Now, but Is It Smart?

For a home with five aging PCs, $30 for blanket protection is a no-brainer compared to replacing hardware. But the calculus shifts when you consider the wider picture:

  • Temporary coverage: By October 14, 2026, ESU protection evaporates. There’s no renewal, no extension. You must have a migration plan completed by then.
  • No feature updates: Apps that demand newer OS capabilities will eventually break or become unsupported. Web browsers may stop updating on Windows 10, even with security patches.
  • No technical support: If your Windows 10 installation develops an issue unrelated to ESU patches, Microsoft won’t assist. Community forums and third-party help will be your only lifelines.
  • Account lock-in: The paid option’s convenience depends entirely on your Microsoft Account. If you switch accounts, you lose the multi-device benefit. The free path forces settings sync, which some find invasive.

For a rarely used secondary machine, even $30 might feel like overkill. But for a primary device holding sensitive data, the cost is negligible compared to the risk of running unpatched.

Security, Compliance, and Operational Risks You Can’t Ignore

ESU patches the most dangerous security holes, but it doesn’t restore Windows 10 to full support status. Understanding the residual risks is critical:

  • Growing attack surface: After October 2025, any zero-day not deemed “critical” by Microsoft could go unpatched. Threat actors will increasingly target Windows 10 once it’s out of mainstream support.
  • Compliance headaches: Regulatory frameworks (HIPAA, PCI-DSS, GDPR) often mandate running supported operating systems. Consumer ESU alone may not satisfy auditors—check your specific obligations.
  • Application abandonment: Third-party developers will gradually drop Windows 10 support. Anti-virus, productivity, and creative tools might stop receiving updates, leaving you vulnerable through application-level flaws.
  • E-waste and forced upgrades: Hardware that can’t run Windows 11 (due to missing TPM 2.0, unsupported CPUs) creates a hard fork: buy new devices or explore alternative operating systems. Both paths carry costs and learning curves.

Public backlash over Windows 11’s hardware mandates has spawned lawsuits and consumer complaints, but legal outcomes are uncertain and won’t shield you from immediate security dangers.

Alternatives to ESU: Your Migration Options

ESU is a stopgap. The longer-term solution is moving to a supported platform. The menu:

  • Windows 11 upgrade: Free if your hardware passes the PC Health Check. This is the cleanest path—ongoing updates, new features, and broad vendor support.
  • New hardware: If your current machine fails Windows 11 requirements, a modern PC (likely with a neural processing unit for AI tasks) future-proofs you for years. Cost is the obvious hurdle.
  • Windows 365 Cloud PC: Stream a Windows 11 desktop to any device, even underpowered hardware. Subscription pricing can add up, but it decouples OS longevity from local hardware.
  • Alternative operating systems: Linux distributions or ChromeOS Flex can breathe life into older devices for web-centric tasks. Compatibility with specialized Windows software may be a dealbreaker.
  • Doing nothing: The least advisable path. An unpatched, unsupported OS becomes a magnet for malware and data breaches.

A Realistic Migration Timeline

Treat the ESU window as a tight project schedule:

  • Today to 2 weeks: Back up all files and create a system image. Verify 22H2 status and enroll in ESU if you intend to use it.
  • 2 to 8 weeks: Test Windows 11 on a non-critical device. If your hardware is incompatible, research replacement options or Cloud PC.
  • 1 to 6 months: Purchase new hardware if needed, migrate data using OneDrive or Windows Backup, and begin gradual rollout of upgraded devices.
  • By October 13, 2026: All devices must be off Windows 10. Retire or responsibly recycle old hardware.

What Comes Next: Microsoft’s Long Game

Consumer ESU is a tactical concession, not a strategic shift. Microsoft will continue to push Windows 11 hard through in-OS messaging and likely more incentives. The enrollment UI itself is expected to evolve—later updates may streamline the process or add reminders as the 2026 cutoff approaches.

Pricing could change. The $30 model is experimental; if uptake is massive, Microsoft might extend or adjust it. Conversely, if migration rates remain sluggish, pressure could mount for a longer grace period or even a Windows 10 “LTSC” for consumers. But betting on policy reversals is risky.

Final Assessment

Microsoft’s consumer ESU launch is a pragmatic, well-timed olive branch that acknowledges real-world hurdles: hardware incompatibility, budget constraints, and user inertia. The $30-for-10-devices structure is genuinely generous, and direct Windows Update enrollment removes friction. Yet the program’s sharp expiration in 2026 makes it impossible to cling to Windows 10 indefinitely.

The smart play: enroll if you need the buffer, but start your migration immediately. Use the reprieve to test Windows 11, upgrade hardware, or explore other OS options. For most, a supported OS remains the only safe long-term destination.