Microsoft’s slow, staged rollout of the Windows 10 Extended Security Updates (ESU) enrollment wizard means the one-year security lifeline for legacy PCs is available—but not instantly visible to everyone. Users who updated to the August 2025 cumulative update may still find the “Enroll now” button missing, even when their devices meet all eligibility requirements. That’s because the rollout is being phased across millions of machines, a fact Microsoft confirmed to Windows Latest, and a recent bug fix in KB5063709 only solved one of the hurdles: a crash that caused the wizard to open and immediately close.
For consumers and small businesses counting on ESU to bridge the gap beyond October 14, 2025, the patch notes and enrollment guidance paint a picture of an option that’s functional but deliberately gradual—and it comes with an account requirement that privacy-minded users will find hard to swallow. Here’s everything you need to know about the program, the bug fix, the invisible button problem, and how to secure your device’s safety net before support ends.
The ESU basics: one extra year, three ways to pay
Microsoft announced the consumer ESU program in early 2025, offering Windows 10 Home, Pro, Pro Education, and Pro for Workstations users up to 12 additional months of security updates beyond the October 14, 2025 end-of-support date. The coverage runs through October 13, 2026, and includes only patches rated “Critical” or “Important” by Microsoft. No new features, no non-security quality fixes, and no general technical support are included.
Enrollment comes through a wizard built directly into Windows Update, with three price tiers:
- Free: Enable Windows Backup or sync PC settings to a Microsoft Account.
- Microsoft Rewards: Redeem 1,000 Rewards points at no monetary cost.
- Paid: One-time purchase of $30 USD, which covers up to 10 devices tied to the same Microsoft Account.
These options are documented in Microsoft’s official support article, and they apply only to personal, non-domain-joined, non-MDM-managed devices running Windows 10 version 22H2 with the latest cumulative updates. A Microsoft Account with administrator privileges is mandatory for all three paths—even the paid one.
The rollout puzzle: why the button stays hidden
When KB5063709 shipped on August 12, 2025, it carried a crucial ESU-related fix: “This update addresses an issue that causes the Extended Security Updates (ESU) enrollment wizard to open, begin loading, and then close unexpectedly.” The update notes are unambiguous—the crash is resolved. Yet independent testing and forum reports show that many fully patched devices still lack the “Enroll in Extended Security Updates” link under Settings > Update & Security > Windows Update.
The reason is Microsoft’s phased rollout strategy. A company spokesperson told Windows Latest that the toggle “will be visible to everyone before the EOL deadline,” but also confirmed the wizard is being rolled out slowly. That means even after installing all updates and signing in with a qualifying Microsoft Account, the button may simply not appear until Microsoft’s servers flip a switch for your device. There’s no manual override, no registry tweak, and no timeline published.
In practice, patience is the only remedy—but that patience is tested when the October deadline looms. The phased approach makes sense from a deployment risk perspective: Microsoft can monitor server load and client-side errors as the user base expands. For end users, however, it creates uncertainty at a time when clear, actionable steps are most needed.
Practical step-by-step: how to check eligibility and enroll when it arrives
Even if the button isn’t there yet, you can ensure your device is ready the moment Microsoft enables it. Follow these steps in order:
- Verify Windows 10 version 22H2: Open Settings → System → About and confirm the version number. If you’re on an older release, install all available updates to reach 22H2.
- Install the latest cumulative updates: Run Windows Update and apply every pending patch. KB5063709 (or any later cumulative update) is essential—it contains the wizard crash fix and other ESU-related improvements.
- Sign in with a Microsoft Account: If you use a local account, you’ll be prompted to switch during enrollment. The account must have administrator rights on the device and cannot be a child account.
- Look for the enrollment link: Go to Settings → Update & Security → Windows Update and scan for the “Enroll in Extended Security Updates” link near the Check for updates button. Click “Enroll now” and follow the prompts to choose your preferred method (sync, Rewards, or purchase).
If the link is absent after these steps, you’ve done all you can. Re-check periodically—the phased rollout will eventually reach your device. In the meantime, note that the absence of the button does not mean you’re unprotected; once enrolled, the security updates will flow automatically via Windows Update as long as the license is active.
What ESU really delivers—and what it withholds
The program’s narrow scope is its biggest limitation. ESU patches only the operating system’s attack surface. Vulnerabilities in Microsoft Edge, .NET Framework, or other Microsoft applications are addressed through separate update channels, but OS-level flaws that aren’t deemed “important” or “critical” will remain unfixed. If a non-security bug causes crashes, performance regressions, or compatibility issues, those won’t be resolved either.
This isn’t a Windows 10 “extended life” in any rich sense; it’s a safety valve for users who cannot immediately migrate to Windows 11 or replace hardware. Think of it as a managed buffer zone. The one-year limit is firm—after October 13, 2026, the updates stop, and the device becomes genuinely unsupported unless you move to an enterprise ESU plan (available only to volume-licensed organizations).
The Microsoft Account requirement: privacy trade-offs and local account friction
Perhaps the most controversial aspect is the forced Microsoft Account linkage. All three enrollment routes—including the $30 paid option—require signing in with a Microsoft Account. The license is account-based, not machine-based, which allows a single purchase to span up to 10 devices. But it also closes the door on those who hoped to pay and stay on a local account.
TechRadar, Windows Central, and other outlets flagged this as a “catch” that undermines the privacy ethos of local-account diehards. Microsoft’s own support pages confirm the requirement: “You must be signed in to Windows with a Microsoft account… Your ESU program status is tied to your Microsoft account.” This means even users willing to pay cash must link their device to an online identity, potentially triggering telemetry and cloud sync settings they previously avoided.
For households where one person manages multiple PCs (e.g., parents with several children’s laptops), the multi-device license is a genuine cost saver, but the privacy burden shifts. The free route—enabling Windows Backup/sync—further pushes users into the Microsoft ecosystem, using the promise of no-cost security as an incentive to adopt OneDrive and account-driven personalization.
Bug fix in KB5063709: a close call for early enrollers
The August 2025 cumulative update deserves special attention because it fixed a failure that would have eroded trust in the entire program. According to the official KB article, pre-patch machines could trigger the enrollment wizard, watch it load, and then see it vanish without explanation. For users already anxious about the end-of-support clock, this broken UX would have been infuriating. The fix proves that Microsoft is actively stabilizing the enrollment pipeline, but it also underscores how fragile the initial rollout was. Anyone planning to enroll should ensure KB5063709 or a later patch is installed—not just for the button, but to avoid being trapped in a broken flow once the wizard becomes visible.
Beyond ESU: the ticking Secure Boot bomb
While not directly part of the ESU program, KB5063709 also contains an ominous note: “Secure Boot certificates used by most Windows devices are set to expire starting in June 2026.” Microsoft has been quietly updating these certificates via Windows Update, but devices that miss the update or have incompatible firmware could fail to boot when the old certificates expire. This is a separate lifecycle risk that parallels the Windows 10 EOL. If you’re planning to keep a device alive on ESU, you must also stay current with all cumulative updates to receive the new Secure Boot certificates. The KB article suggests checking status in the Windows Security app and directs IT admins to a Secure Boot playbook, but the consumer guidance is sparse. The overlap of these two deadlines—October 2025 OS end-of-support and June 2026 certificate expiration—could create a perfect storm for unprepared users.
The good, the bad, and the upgrade nudge problem
What works: For $30 covering ten devices, the paid ESU is a steal. The free options lower the barrier to zero for anyone willing to sync settings. Integrating enrollment into Windows Update spares users from hunting down a separate licensing portal. And for households with a fleet of older laptops that still perform basic tasks, ESU buys a dignified, secure exit ramp rather than forcing premature e-waste.
What frustrates: The phased visibility turns ESU preparation into a waiting game. The account requirement feels like a bait-and-switch to privacy advocates. The security-only scope leaves non-critical bugs unpatched indefinitely. And even after enrolling, users can expect to see the same full-screen “Upgrade to Windows 11” prompts that have dogged Windows 10 users throughout 2025. Enrollment does not mute Microsoft’s aggressive upgrade advertising—a sore point repeatedly aired in community forums.
A short- and medium-term action plan
Immediate (0–30 days): Inventory your Windows 10 devices. Confirm every machine is on version 22H2 and fully patched. If you intend to use ESU, sign in with a Microsoft Account now (or create one) and check Windows Update for the enrollment link. Don’t panic if it’s not there; just have the infrastructure ready.
Near-term (1–6 months): For machines that can upgrade to Windows 11, start testing and scheduling the migration. ESU is a bridge, not a destination. For incompatible hardware, begin budgeting for replacement. If privacy is paramount, assess whether the free sync route is acceptable, or whether the $30 purchase plus a fresh Microsoft Account (used only for licensing) can serve as a compromise.
Long-term (before October 13, 2026): All migrations must be complete by this date. If you manage family members’ devices, document which Microsoft Account each ESU license is tied to, because support for re-assigning licenses mid-stream is unlikely. For businesses, the consumer ESU is unsuitable—pursue enterprise ESU via volume licensing if needed.
The bottom line: a necessary stopgap with strings attached
The consumer ESU program is Microsoft’s concession to the millions of PCs that cannot or will not move to Windows 11 before October 2025. It’s reasonably priced, functionally adequate, and—once the rollout completes—easy to use. Yet the phased deployment, the account mandate, and the security-only limitations demand that users see it for what it is: a one-year bridge, not a solution.
Treat ESU as an insurance policy you hope to never fully claim. Enroll early if possible, keep your system updated, and use every month of that extra year to plan a clean exit. The wizard may be slow to appear on your screen, but the clock is ticking, and October 14, 2025, will arrive on schedule.