Microsoft has drawn a line in the sand: after October 14, 2025, Windows 10 Home, Pro, Enterprise, and Education will no longer receive routine security patches. The company isn’t leaving consumers entirely stranded, though. In a departure from its business-only Extended Security Updates (ESU) program of the past, Microsoft is offering individual users a one-year stopgap — and one enrollment option won’t cost you a cent.

That’s the headline. For millions of PCs still running Windows 10 version 22H2, the clock is ticking. This guide walks through exactly what ends on that date, the official escape hatches, and a practical timeline to keep your machine safe.

The Immediate Deadline

The October 14, 2025 cutoff isn’t a performance cliff. Your PC will boot and your programs will launch. But starting that day, any newly discovered vulnerability will be patched on Windows 11 — and left wide open on unenrolled Windows 10 machines. Microsoft’s monthly “Patch Tuesday” security updates stop. Technical support ends. Over time, third-party software vendors will drop Windows 10 from their support matrices, and new hardware will ship without drivers for the old OS.

There are a handful of important exceptions. Microsoft has confirmed that Microsoft Defender Antivirus will continue receiving security intelligence updates for an extended window beyond the OS end-of-support date. That means your built-in antivirus will still recognize new malware, but it cannot patch the underlying operating system flaws that malware might exploit. Microsoft 365 apps will also continue to work on Windows 10 for a limited period, though some features and protections will degrade. These are temporary safety nets, not long-term solutions.

Your Safety Net Options

For consumers, Microsoft has designed a three-tier ESU enrollment scheme. It’s not automatic — you must opt in before the program ends a year later. Here’s how the paths break down.

The Free Enrollment Route

Sign into your Windows 10 machine with a Microsoft account, then enable the Windows Backup or OneDrive sync mechanism for your settings. That’s it. Once you turn on that backup/sync feature, you become eligible for a free ESU license tied to your Microsoft account. There’s no fee, no Rewards points, and no credit card. The catch? You must be running version 22H2 and have the latest updates installed. Local accounts don’t qualify; you’ll need to switch to a Microsoft account sign-in first.

The Rewards Route

If you’ve been collecting Microsoft Rewards points, 1,000 points can be redeemed for an ESU license. This option avoids the backup requirement and gives you a clean, no-cost path as long as you have the points balance. For active Rewards users, it’s essentially free.

The Paid Option

If neither path works, you can purchase ESU directly through the Windows Update enrollment wizard. The published price is $30 USD equivalent, plus local taxes, applied as a one-time purchase to your Microsoft account. Each ESU license can cover multiple devices associated with the same account — the exact device allowance will be shown during enrollment. The $30 covers the full one-year extension, not a recurring subscription.

What ESU Actually Delivers

No matter which route you pick, ESU provides only critical and important security patches. No new features, no performance improvements, no non-security fixes, and no phone or chat support. You’re buying (or earning) time — a bridge to a permanent migration. ESU does not block a later upgrade to Windows 11; you can move whenever ready.

A Step-by-Step Survival Guide

October 14, 2025 might feel distant, but some decisions take weeks, not days. Here’s a checklist you can start today.

1. Confirm Your Current Version

Open Settings > System > About. If you’re not on Windows 10 version 22H2, run Windows Update repeatedly until you’re fully patched. ESU requires the latest build.

2. Back Up Everything

Before any major change, create a system image and copy documents, photos, and settings to an external drive and to the cloud. Windows Backup (integrated with a Microsoft account) and OneDrive are the easiest cloud options, and using them also sets you up for a free ESU enrollment if you go that route.

3. Evaluate Your Upgrade Eligibility

Download and run the PC Health Check tool from Microsoft’s site. It will flag any missing requirements: TPM 2.0, Secure Boot, CPU generation, RAM, or storage. Many PCs manufactured after 2018 can pass if you enable Intel Platform Trust Technology (PTT) or AMD fTPM in the BIOS, and turn on Secure Boot. Update your firmware to the latest version before testing — motherboard vendors have released compatibility fixes over the past two years.

If PC Health Check gives a green light, you can upgrade to Windows 11 for free via Windows Update or the Update Assistant. Do this only after a full backup. If it fails, you have two main paths: ESU to buy time, or new hardware.

4. Enroll in ESU When the Prompt Appears

After you’re on version 22H2 and signed in with a Microsoft account, open Settings > Update & Security > Windows Update. Microsoft will roll out the ESU enrollment prompt to eligible devices before October 14. Click through the wizard and choose your enrollment method — free backup sync, Rewards redemption, or the $30 purchase. Note: the prompt may not appear immediately for every device; keep checking as the deadline approaches.

5. Plan Your Permanent Migration

ESU is a one-year patch. By October 2026, you need to be off Windows 10 entirely. For most people, the cleanest path is a Windows 11 PC, either by upgrading a compatible device or buying a new one. Modern entry-level laptops start around $300–$400 and will run Windows 11 with full driver support.

If your workflow is entirely browser-based, a Chromebook or ChromeOS Flex (which can revive older hardware) is a low-cost alternative. Linux distributions like Linux Mint or Zorin OS also run well on aging machines and offer a familiar desktop paradigm, but they require comfort with occasional terminal commands and app compatibility workarounds.

For Advanced Users: The LTSC Rabbit Hole

A small but vocal community is promoting tools that convert consumer Windows 10 to Windows 10 LTSC 2021 (IoT Enterprise LTSC 2021). That SKU receives security updates into the early 2030s. The allure is obvious: a lean, long-lived OS without forced feature updates or consumer bloat.

But LTSC is not a consumer SKU. It’s distributed through volume licensing channels, and running it on a personal PC without a legitimate volume license violates Microsoft’s product terms. Activation requires a valid key from a volume licensing agreement. Unofficial conversion scripts touch system files and the registry, creating an unsupported Frankenstein build that Microsoft won’t help you fix. Modern Store apps, some drivers, and certain cloud features break on LTSC. For businesses, the licensing and audit risk alone makes this a non-starter. For enthusiasts, treat it as a curiosity, not a production solution.

What to Do If You Must Remain on Plain Windows 10 (Without ESU)

Some machines cannot run Windows 11, and their owners may refuse ESU for privacy or cost reasons. That’s a dangerous game, but if you go that route, reduce risk with these steps:

  • Isolate the device: Avoid public Wi-Fi; place it on a separate VLAN or guest network segment.
  • Harden the system: Use strong, unique passwords; enable two-factor authentication for cloud accounts; apply least-privilege user accounts.
  • Keep apps updated: Browsers like Chrome and Firefox will continue patching on Windows 10 for a while. Install updates immediately.
  • Use a reputable third-party antivirus: While it can’t patch the kernel, a frequently updated endpoint protection suite can block known exploit attempts.
  • Back up religiously: Ransomware and data loss risks spike on unpatched systems.
  • Consider virtualizing legacy workloads: Run Windows 10 inside a virtual machine on a supported host OS to contain damage.

These are stopgaps, not solutions. The first zero-day targeting a post-EOL Windows 10 flaw will be a race you cannot win.

How We Got Here

Windows 10 launched in July 2015 with a 10-year lifecycle commitment — an unusually long horizon born partly from the missteps of Windows 8. Back then, Microsoft promised “Windows as a service,” with continuous feature updates. But the explosion of hardware-based attacks — Meltdown, Spectre, ransomware kits — pushed the company to require TPM 2.0 and Secure Boot for Windows 11, released in October 2021. That hardware floor left behind millions of perfectly functional PCs built before 2018.

For businesses, Microsoft’s ESU program has been standard since Windows 7’s end of life in 2020. Enterprise customers could buy up to three years of additional security patches. Consumers got nothing — until now. The consumer ESU program, first disclosed in December 2023, marks a significant shift. It acknowledges the sheer volume of Windows 10 devices still in use (market share hovers around 65% as of early 2025) and the logistical impossibility of migrating everyone to Windows 11 by October.

The Outlook After October 2025

The one-year ESU extension expires in October 2026. Microsoft has shown no hint of relaxing Windows 11’s hardware requirements, despite public pressure. That means the window to act is finite. Every month that goes by without a plan adds risk, especially as the deadline approaches and attackers begin stockpiling exploits they know will never be patched on unenrolled Windows 10 machines.

For most users, the free upgrade to Windows 11 remains the best long-term answer — if your hardware cooperates. If not, the free or low-cost ESU enrollment buys you breathing room. The important thing is to start now: check your version, back up your files, and make a choice before the clock runs out.