Microsoft’s end-of-support date for Windows 10—October 14, 2025—is now a hard deadline. After that, the operating system will no longer receive routine feature updates, quality fixes, or technical support. But the company is offering consumers a one-year lifeline through its Extended Security Updates (ESU) program. Two of the three enrollment methods are free, but they require a specific checklist and come with privacy trade-offs that every user should understand before clicking “Enroll.”
ESU delivers only security updates rated Critical or Important by Microsoft’s Security Response Center. It includes no new features, no non-security bug fixes, and no general technical support. The program is explicitly a short-term bridge, giving users until October 13, 2026, to move to a supported operating system—most logically Windows 11.
Who Is Eligible?
Consumer ESU is limited to personal-use devices running Windows 10, version 22H2 (Home, Pro, Pro Education, or Workstation editions). Enterprise-managed, domain-joined, or kiosk-mode systems are excluded and must use separate enterprise ESU channels.
All eligible devices must have the latest cumulative updates installed. Microsoft’s August 2025 cumulative update, in particular, includes fixes that make the ESU enrollment wizard visible in Settings. Without that patch, you may not see the option.
Crucially, enrollment requires signing into the device with a Microsoft Account (MSA) that has administrator privileges. Local accounts will not qualify. This is a non-negotiable condition that directly impacts privacy-conscious users who have deliberately avoided linking their PC to a Microsoft cloud identity.
When to Enroll—and the Exposure Gap
Coverage begins on October 15, 2025, and runs through October 13, 2026. You can enroll after the October 14 cutoff, but your device will be unprotected until enrollment completes. Microsoft warns that the ESU program does not retroactively fill that gap. Enrolling early is strongly recommended to avoid any window of vulnerability.
The Three Enrollment Paths
Microsoft surfaces all three options through a unified “Enroll now” wizard in Settings → Update & Security → Windows Update. The choices are functionally equivalent—each delivers the same year of security patches—but the validation methods differ sharply.
| Method | Cost | Key Requirements |
|---|---|---|
| Redeem 1,000 Microsoft Rewards points | Free (if you have the points) | Active Rewards account with at least 1,000 points. Points can be earned through Bing searches, app downloads, and other Microsoft services, but balances and earning rates vary widely. |
| Sync Windows Backup to OneDrive | Free (but may require additional OneDrive storage) | Enable Windows Backup/settings sync to a Microsoft Account. The default 5 GB of free OneDrive space may be insufficient, forcing a paid storage plan. |
| Pay the one-time consumer ESU fee | $30 per license (can be applied to up to 10 devices on the same Microsoft Account) | Purchase through the Microsoft Store inside Settings. |
If you choose the Rewards route, check your balance carefully. Anecdotal reports suggest downloading the Bing app awards 500 points, but Rewards mechanics change frequently. Do not assume you can quickly earn the needed points without verifying your account.
The OneDrive path, meanwhile, ties ESU enrollment to cloud backup—effectively making Microsoft’s sync service a prerequisite for free security patches. That bundling has raised eyebrows among users who prefer local backups or minimal cloud footprint.
Why Are People Sticking With Windows 10?
There are several practical reasons:
- Hardware barriers. Windows 11 requires TPM 2.0, Secure Boot, and a modern CPU. Many older PCs—especially those running Intel 2nd- or 3rd-generation chips or early AMD platforms—simply cannot upgrade without hardware modifications. For these users, ESU is the only supported path to stay patched.
- Application compatibility. Some legacy software and peripherals have not been fully validated on Windows 11. IT pros and power users often need extended testing time before migrating.
- Cost and disruption. Replacing a fleet of home machines or performing motherboard-level upgrades is expensive and disruptive. ESU offers breathing room to budget and plan transitions.
But Microsoft is clear: ESU is not a permanent alternative. It is a one-year bridge. Use the time deliberately to plan your move to Windows 11, a cloud-based virtual desktop, or an alternative OS.
What You Give Up: The Trade-Offs and Risks
Limited security scope. ESU patches only Critical and Important vulnerabilities. Any stability or reliability issues that would normally be fixed through cumulative quality updates will remain. Your system may become less stable over time even as it remains patched against top-tier exploits.
Account and cloud requirements. The mandatory Microsoft Account and—in the OneDrive path—forced cloud sync represent a significant privacy shift. Users who chose local accounts specifically to avoid vendor tie-in must now accept a permanent link to Microsoft’s identity and cloud infrastructure. Consider this carefully, especially if you handle sensitive data on the PC.
Exposure gap if you delay. If you enroll after October 14, 2025, your machine will be unprotected for days, weeks, or months. That gap can be dangerous if a zero-day exploit emerges immediately after support ends. The program remains open for enrollment until October 13, 2026, but earlier is always safer.
Unsupported Windows 11 workarounds are risky. Some users have used registry hacks, modified ISOs, or third-party tools to install Windows 11 on unsupported hardware. Microsoft does not support these installations and has warned that such devices may be blocked from receiving future updates. For unsupported hardware, ESU is a far safer short-term option than an unsanctioned OS upgrade.
Regulatory and compliance concerns. If you operate in a regulated industry or need a persistently supported platform for compliance, ESU’s one-year window is likely insufficient. Plan a full migration promptly; do not rely on ESU to satisfy long-term audit requirements.
A Separate Lifeline for Microsoft 365 Apps
Even after Windows 10 itself stops receiving patches, Microsoft 365 apps (Office, Teams, etc.) on Windows 10 will continue to get security updates through October 10, 2028. That is three years beyond the OS end-of-life date. Keep this in mind when prioritizing migration steps—your productivity apps may be safe even if the underlying OS is not.
How to Prepare and Enroll: A Practical Checklist
Follow these steps in order to minimize risk and avoid common pitfalls:
- Verify your Windows 10 version. Go to Settings → System → About and confirm you are on version 22H2. If not, update immediately.
- Install all pending Windows updates. Check for cumulative updates, especially the August 2025 release, and reboot. These are required for the ESU wizard to appear.
- Back up everything. Create a full disk image with a tool like Macrium Reflect or Acronis, and make an independent file backup to external media or an alternate cloud service. Two backups—one local, one offsite—are the industry gold standard.
- Decide which ESU path you will use. Check your Microsoft Rewards balance. Evaluate your OneDrive storage situation (5 GB may not be enough). Or budget the $30 fee. Choose the path that fits your needs and privacy comfort level.
- Sign in with a Microsoft Account. If you are currently using a local account, switch to an MSA with admin rights. Understand that this action links your device to Microsoft’s identity infrastructure.
- Enroll via Settings. Open Settings → Update & Security → Windows Update. Look for the “Enroll now” ESU wizard, follow the prompts, and complete the flow.
- Confirm enrollment. After finishing, check Windows Update history to verify that the ESU license has been applied. You should see the extended coverage reflected.
- Use the ESU year intentionally. Do not treat it as a procrastination tool. Immediately start testing Windows 11 compatibility, budgeting for hardware upgrades, or exploring cloud and alternative OS options.
Migration Options During Your ESU Year
The ESU year (October 15, 2025 – October 13, 2026) is your runway. Consider these paths:
- Upgrade to Windows 11 (if eligible). Run the PC Health Check tool. If your hardware passes, upgrade after full backups and testing. This preserves full support and feature updates.
- Replace aging hardware. For machines that cannot meet Windows 11 requirements, a new PC is often the cleanest route. Look for trade-in programs to reduce net cost.
- Migrate to an alternative OS. Modern Linux distributions or ChromeOS Flex can breathe new life into older hardware, especially for web-centric workloads. Security and community support are robust.
- Move to the cloud. Services like Windows 365 or Azure Virtual Desktop let you run Windows 11 in a cloud-hosted environment, removing endpoint upgrade headaches at the cost of recurring fees.
- Adopt a hybrid approach. Keep a few legacy machines on ESU while moving day-to-day work to modern devices or cloud services. This concentrates risk and focuses your migration effort.
Overlooked Technical Steps
Before you transition away from Windows 10, do these often-forgotten tasks:
- Export and securely store BitLocker recovery keys. Losing them can permanently lock your data.
- Deauthorize licensed software. Adobe Creative Cloud, iTunes, and similar apps often need deactivation before moving to a new machine.
- Compile a list of critical peripherals and verify driver availability on Windows 11 or your target alternative OS.
- Test mission-critical applications in a Windows 11 virtual machine or on a trial install to identify compatibility blockers early.
Final Analysis: When to Enroll, and When to Walk Away
Enroll in consumer ESU if your device is ineligible for Windows 11, you need time to validate critical applications, or replacing hardware today is financially out of reach. ESU is a low-cost, practical stopgap for households that need breathing room.
Avoid ESU as a long-term strategy. Its one-year limit and narrow security scope mean it is a bridge, not a destination. Use the time to complete a genuine migration.
Do not rely on unsupported Windows 11 bypasses. Registry hacks and unofficial installers may leave your system unpatched or unstable. ESU is safer for unsupported hardware than an unsupported OS.
Accept the privacy trade-offs. The mandatory Microsoft Account and potential cloud sync requirements are a direct challenge to users who have kept their PC offline-identity for privacy reasons. If you cannot stomach that linkage, prioritize hardware replacement or an alternative OS now, rather than clinging to Windows 10 with ESU.
The consumer ESU pathway transforms a hard drop-dead date into a manageable transition period. But that transition is only manageable if you act deliberately—enrolling before the deadline, accepting the account requirements, and using the extra year to land safely on a supported platform. Microsoft has given you a bridge; now it’s up to you to cross it.