Windows 10 users who raced to enroll in Microsoft’s Extended Security Updates programme after the October 14, 2025, end‑of‑support deadline are confronting a stubborn reality: the ‘Enroll now (ESU)’ link that the company promised would appear in Windows Update still hasn’t materialized on millions of eligible machines. The glitch, tied to a slow, phased rollout of enrolment plumbing delivered via the August 2025 cumulative update KB5063709, has left consumers — from home users to small‑office operators — exposed to emerging threats while they wait for a Settings wizard that, for many, remains a blank pane.

Microsoft’s official support page, now updated to reflect the post‑deadline landscape, confirms that the ESU programme will continue until October 12, 2027 — nearly two years of critical and important security patches, not the single year originally broadcast in earlier communications. On the same page, the company reassures that enrolment remains open for the entire programme duration and that anyone who finally clicks through will receive all updates released since Windows 10 support sunsetted. Yet the disconnect between the documentation and the on‑screen experience is breeding frustration, especially for less‑technical users who cannot afford to lose a single month of protection.

What the official ESU programme offers — and what it doesn’t

Microsoft’s ESU stopgap is designed exclusively for Windows 10 version 22H2 Home, Professional, Pro Education and Workstations editions. Devices must be fully patched — the prerequisite servicing stack and the monthly cumulative containing the enrolment logic are non‑negotiable — and the user who triggers enrolment must sign in with a Microsoft account that holds administrator privileges. Child accounts are explicitly blocked. Once enrolled, a device receives all critical and important security updates defined by the Microsoft Security Response Center, delivered through the same Windows Update pipeline that previously carried full servicing. The programme does not include feature improvements, performance fixes, or technical support.

The cost model mixes three lanes: free enrolment for anyone willing to sync their PC settings and back them up to OneDrive; a redemption path for 1,000 Microsoft Rewards points; and a one‑time $30‑USD purchase (or local‑currency equivalent). A single licence covers up to ten devices associated with the same Microsoft account. IT professionals managing commercial deployments have a separate, volume‑license‑driven path using MAK keys through the Microsoft 365 admin centre.

The missing button: a phased rollout that’s testing patience

The August 2025 cumulative update, catalogued as KB5063709 (and its equivalents for other 22H2 branches), delivered the UI scaffold required to surface the ‘Enroll now (ESU)’ link inside Settings > Update & Security > Windows Update. Microsoft acknowledged that the feature would appear gradually, beginning with Windows Insiders and then fanning out to general availability. It also shipped fixes for early wizard crashes that plagued some early adopters. But weeks after the update’s release, numerous Windows 10 machines that meet every documented prerequisite still show nothing below the ‘Check for updates’ button.

Third‑party reporting and community forums are awash with step‑by‑step accounts of users who have verified their 22H2 build, installed every pending cumulative and SSU, signed in with an admin Microsoft account, toggled on Windows Backup sync, and still stare at an empty Windows Update pane. Some have resorted to multiple reboots, re‑installation of KB5063709, and even in‑place repair upgrades. For a portion of those users, the link eventually appeared days later; for others, it has not. This non‑uniform delivery mechanism injects uncertainty exactly when certainty is most needed. The practical risk is clear: if a user cannot enrol, they remain vulnerable, and if they discover the missing link only after a threat emerges, the damage may already be done.

Breaking down the prerequisites and why they matter

Every machine that hopes to see the enrolment link must satisfy a checklist that spans software versions, account posture, and device state:

  • Windows 10, version 22H2 — older builds are ineligible. Running winver should return build 19045 or later.
  • Latest cumulative update installed — specifically the one that carries the ESU readiness logic (KB5063709 for the 22H2 line, plus any subsequent rollup).
  • Administrator Microsoft account — local accounts will not trigger the link. During enrolment, users are prompted to switch to a Microsoft account. The licence is then tied permanently to that identity.
  • Not in a managed state — domain‑joined machines, Entra‑joined devices, and those enrolled in MDM are excluded from the consumer path. Kiosk‑mode devices and those already holding a commercial ESU licence are likewise blocked.
  • Child accounts are unsupported for enrolment; a parent or guardian must sign in and complete the process.

The forced Microsoft account requirement has become the programme’s most contentious design decision. Even users who opt to pay $30 must link the licence to a cloud identity, a move that strikes many long‑time Windows devotees as an unnecessary erosion of local control. Privacy‑conscious users who run strictly local accounts face a stark choice: compromise that posture or forgo security patches entirely.

Update quality: the threat inside the cure

August 2025 also demonstrated that applying patches can carry its own peril. The same update wave that delivered KB5063709 contained regressions that broke the built‑in ‘Reset this PC’ recovery feature and, on certain SSD models, caused drives to disappear or suffer file‑system corruption. Microsoft acknowledged the recovery break and issued an out‑of‑band emergency fix (KB5066189); it is still investigating the storage‑related reports with OEM partners. These incidents underscore a hard‑learned truth: no update, however urgent, should be installed without a verified backup.

For ESU enrollees, the advice is unambiguous. Adopt the 3‑2‑1 rule — three copies of your data, on two different media types, with one copy offsite — and take a full system image before applying the monthly cumulative that enables enrolment. If a show‑stopper regression is flagged in Microsoft’s release health dashboard, consider pausing updates for a few days until a fix is available.

A 10‑step action plan for every Windows 10 user

  1. Verify your build: Press Win + R, type winver, and confirm Windows 10 22H2.
  2. Install every pending update: Run Windows Update and accept all offerings, including SSUs and the ESU‑readiness cumulative (KB5063709 or later).
  3. Back up immediately: Use the 3‑2‑1 method. Do not proceed without a tested, restorable backup.
  4. Adopt a Microsoft admin account: If you use a local account, sign in with a Microsoft account that has administrator rights. Remember, the ESU licence will be tied to this identity.
  5. Enable Windows Backup sync: If you want the free enrolment path, turn on ‘Sync your settings’ under Backup — this is the trigger for the no‑cost option.
  6. Check for the link: Open Settings > Update & Security > Windows Update. If ‘Enroll now (ESU)’ appears, follow the wizard.
  7. If the link is missing: Confirm all prerequisites again. Accept that the rollout is phased and keep Windows Update fully current; the link should appear in days.
  8. For commercial or volume users: Obtain MAK keys through the Microsoft 365 admin centre and activate via the documented enterprise path.
  9. Set a migration timeline: ESU expires October 12, 2027. Plan to upgrade to Windows 11 or replace unsupported hardware within that window.
  10. Monitor health dashboards: Before each Patch Tuesday, check Microsoft’s release health site and trusted tech news for any new regressions. Stay cautious.

What the programme gets right — and where it stumbles

Microsoft deserves credit for building a flexible, multi‑lane enrolment model that lowers the barrier for cash‑strapped households. The ability to activate ESU at no cost via settings sync, or to redeem Rewards points, provides genuine relief. The ten‑device licence allowance is also generous for families with multiple older machines. Commercial customers get a clean, well‑documented MAK‑based activation flow that fits established management tooling.

But the execution is marred by three preventable weaknesses. First, tying enrolment to a Microsoft account — even for paying customers — alienates the sizable cohort of users who prize local autonomy. Second, the phased UI rollout, occurring mere weeks after the end‑of‑support deadline, is a textbook case of poor timing. A feature this critical should have been deployed uniformly and months in advance. Third, the programme’s original framing as a one‑year bridge (a notion reflected in many third‑party reports and forum posts) sowed confusion; the current official end date of October 12, 2027, is a welcome extension but arrived late and is still under‑communicated.

Alternatives to ESU: upgrade, migrate, or isolate

ESU is a bandage, not a cure. Users should evaluate every path in parallel:

  • Windows 11 upgrade: The recommended route for any machine that meets the hardware baseline — TPM 2.0, Secure Boot, and a supported CPU. It restores full support and feature innovation.
  • New hardware: Older PCs that fall below Windows 11’s bar eventually need replacement. New machines bring modern security architectures and longer support lifecycles.
  • Linux migration: Privacy‑focused or budget‑constrained users can adopt a desktop Linux distribution, gaining a current, community‑supported OS at no acquisition cost.
  • Isolation tactics: If a migration is impossible today, strip administrative rights from daily driver accounts, use a locked‑down browser, deploy a reputable third‑party antivirus that still supports Windows 10, and place the PC behind a strict firewall. This is a short‑term workaround, not a security guarantee.

Each alternative carries its own cost, skill‑floor, and compatibility considerations. ESU exists precisely to give people time to choose wisely.

The road ahead: what to expect between now and October 2027

The immediate future will see a renewed push from Microsoft, OEMs, and retailers to move users onto Windows 11 hardware. In‑app promotions, email nudges, and even point‑of‑sale signage will intensify. Windows 10’s installed base will gradually contract, but a stubborn tail of machines — perhaps tens of millions — will remain, buoyed by ESU enrolment or simply inertia.

For those who successfully enrol, the next two years should be uneventful: monthly security‑only updates, no feature churn, no surprise hardware requirements. The risk lies with those who never see the button, who give up, or who decide to ride out the post‑support era unpatched. That group will become an increasingly attractive target for exploit kits, ransomware, and botnets.

Microsoft’s release‑note cadence and the community feedback loop will be crucial. If a future cumulative update again breaks core functionality, the company must react faster than it did in August 2025. ESU users, lacking the cushion of feature‑update testing rings, are more exposed to a single defective patch.

Conclusion

The Windows 10 Extended Security Updates programme has evolved into a more generous offering than initially signalled: coverage through October 2027 and a $30 price cap that, while not zero, is far below commercial pricing. Yet the on‑the‑ground experience of actually enrolling remains a mess. A gradually appearing UI element, a hard requirement for a Microsoft account, and the ever‑present risk of update‑induced instability combine to make a programme that is, in theory, a pragmatic safety net feel like another hurdle.

The takeaway for every Windows 10 owner is unambiguous: don’t wait for the button to magically appear before you prepare. Install the latest patches, switch to an admin Microsoft account if you must, back up religiously, and check Windows Update daily. If the enrolment link still hasn’t surfaced after a week, seek help through Microsoft’s support channels or trusted community forums. ESU is designed to reduce risk — but only if you can actually flip the switch.