Microsoft has fixed a last‑minute enrollment bug that was blocking some Windows 10 users from signing up for its Extended Security Updates (ESU) program, a one‑year safety net that kicks in after official support ends on October 14, 2025. The cumulative update KB5063709, released in August 2025, resolves a wizard crash and ensures eligible devices can actually see and complete the enrollment process. With the clock ticking, consumers now have three distinct ways to buy themselves another 12 months of critical patches—but each path comes with strings attached, and none replace the need for a real migration plan.

The End of an Era: Windows 10 Support Sunset

After more than a decade of service, Windows 10 reaches its end of support on October 14, 2025. On that date, Microsoft will stop shipping monthly security updates, non‑security fixes, and any form of technical assistance for the operating system. Systems will continue to boot and run, but they will quickly become a sitting duck for newly discovered vulnerabilities.

For home users and small businesses that cannot upgrade to Windows 11 by the deadline, Microsoft is offering a consumer ESU program for the first time. Previously limited to volume‑licensing enterprise customers, this program extends critical and important security updates for one year—until October 13, 2026. It is explicitly not a long‑term solution, but rather a bridge to buy time for upgrading hardware or planning a migration.

What the Consumer ESU Actually Delivers

The consumer ESU is deliberately narrow in scope. Here is exactly what it does and does not provide:

  • What ESU covers:
  • Monthly security updates classified as “Critical” or “Important” by Microsoft.
  • Coverage is limited to the one‑year extension ending October 13, 2026 for consumer enrollments.
  • Consumer ESU is tied to a Microsoft account and to eligible devices running Windows 10 version 22H2 (Home, Pro, Pro Education, Pro for Workstations).
  • What ESU does not cover:
  • No new feature updates, performance improvements, or general quality fixes.
  • No extended Microsoft technical support for Windows 10 issues.
  • It is not an alternative to migrating to a supported operating system for the long term.
  • Eligibility caveats:
  • Consumer ESU is only for version 22H2 of Windows 10; older versions must be updated.
  • Devices that are domain‑joined, managed by enterprise MDM, or configured as kiosks are ineligible for the consumer path and must use enterprise ESU channels.
  • Enrollment requires that the necessary cumulative update(s) are installed (see next section).

In short, ESU is a security‑only bridge. It does not keep your system current, it merely patches the most severe holes.

KB5063709: The Critical Enrollment Patch

The August 2025 cumulative update KB5063709 (build numbers 19045.6216 for 22H2 and 19044.6216 for 21H2) performs two essential functions: it prepares eligible Windows 10 devices to surface the ESU enrollment flow in Settings → Update & Security → Windows Update, and it fixes a bug that caused the enrollment wizard to crash or fail silently for some users.

If you are not seeing the “Enroll now” option, installing the latest cumulative update—which includes KB5063709 and any required servicing stack updates—is the first troubleshooting step. After installation, the OS build should be equal to or newer than 19045.6216 for 22H2. A reboot and a re‑check for updates are necessary before the offer may appear.

How to Enroll: Three Paths to One More Year

Microsoft intentionally provided multiple consumer enrollment options to lower the barrier. All three require a Microsoft account during the enrollment flow—local accounts cannot complete the process alone. The three routes are:

  1. Free enrollment by enabling Windows Backup / Settings sync
    This uses the built‑in Windows Backup feature to sync certain device settings to the cloud. It leverages your OneDrive account for settings and metadata; the free OneDrive tier provides 5 GB of cloud storage, which may be enough for settings sync but not for a full data backup.

  2. Redeem 1,000 Microsoft Rewards points
    If you participate in Microsoft Rewards and have accumulated at least 1,000 points, you can redeem them to cover ESU enrollment. Note that Rewards availability and redemption can be region‑dependent and have seen sporadic glitches for some users early in the rollout.

  3. One‑time paid purchase (approximately $30 USD)
    The consumer ESU one‑time fee covers up to 10 eligible devices linked to the same Microsoft account. The price is billed in local currency and may vary by region and applicable taxes. This is the most straightforward path for households with multiple older PCs that cannot upgrade.

The enrollment link appears in Settings as an “Enroll now” prompt when your device meets the prerequisites. Each device must be individually enrolled, though the paid license simplifies household coverage.

Immediate Actions: A Pre‑Deadline Checklist

If you run Windows 10 and aren’t ready to migrate, follow this checklist to reduce risk and preserve your options:

  • Confirm your Windows 10 edition and build: Go to Start → Settings → System → About (or run winver). Verify you are on Windows 10 version 22H2 and that the OS build is up to date.
  • Install pending Windows updates: Run Windows Update and install cumulative updates and servicing stack updates (KB5063709 or later). Reboot and re‑check for outstanding patches.
  • Prepare a Microsoft account: If you currently use a local sign‑in, create or link a Microsoft account. Avoid using child or restricted accounts for ESU enrollment.
  • Choose an enrollment path and enroll: If cost is a concern, enable Windows Backup sync now or ensure you have 1,000 Microsoft Rewards points before October 14. If paying, have your payment method ready.
  • Back up your data: Use Windows Backup, a full image tool, or external drives. Relying solely on the free 5 GB OneDrive tier may not be sufficient for large profiles.
  • Export product keys, license information, and application installers: Document everything you need for a rebuild.
  • Decide your long‑term plan: Test your machine for Windows 11 compatibility (TPM 2.0, Secure Boot, CPU requirements). If hardware is unsupported, research replacement options or supported OS alternatives.

Completing this checklist gives you the best chance to enroll successfully and buy time for a deliberate migration.

Migration Roadmap: Using Your ESU Year Wisely

ESU buys a year of breathing room; it does not solve long‑term compatibility. Consider these migration strategies:

  • Upgrade to Windows 11 on supported hardware: The best long‑term path. Use the official PC Health Check tool to verify TPM 2.0 and Secure Boot capabilities.
  • Acquire a new PC with Windows 11 preinstalled: Recommended if existing hardware is old, unreliable, or incompatible. Newer devices also include firmware‑level security improvements.
  • Move workloads to cloud or virtualized environments: Windows 365 Cloud PCs or Azure Virtual Desktop can include ESU rights for hosted images (depending on licensing). This removes reliance on local hardware while keeping a familiar Windows environment.
  • Migrate to Linux or macOS for older hardware: Tech‑savvy users can extend the life of unsupported hardware with modern Linux distributions, but application compatibility and user expectations must be managed carefully.
  • Continue using Windows 10 without ESU (not recommended): If you choose to run unsupported after October 14, 2025, accept the elevated risk. Mitigate by isolating the machine from sensitive networks and using strong endpoint protection.

Each route has cost, usability, and security tradeoffs. Enterprises will typically choose volume licensing ESU or coordinated migrations; consumers must weigh convenience against risk.

The Hidden Costs and Risks of Delaying

Remaining on Windows 10 after support ends—even with ESU—exposes you to several risks:

  • Narrow patch coverage: ESU only includes patches Microsoft deems Critical or Important. Other stability or less‑critical vulnerabilities will not be fixed.
  • No feature or performance updates: Over time, compatibility and performance will degrade relative to newer OS releases.
  • Application lifecycle mismatches: Third‑party vendors may stop supporting older OS versions; newer apps or services may require a supported platform.
  • Credential and account exposure: If core OS components are unpatched, attackers can exploit vulnerabilities to escalate privileges or establish persistence.
  • Regulatory and compliance issues: Small businesses handling regulated data may find running an unsupported OS conflicts with compliance frameworks and insurance requirements.
  • Higher cost of delayed migration: Delaying often increases complexity and cost later, as hardware ages and support channels close.

ESU reduces the immediate risk of critical exploitation but does not eliminate it. Treat ESU as short‑term risk management.

Troubleshooting Common Enrollment Hiccups

Users have reported a handful of issues when signing up for consumer ESU. Here are practical fixes:

  • Don’t see “Enroll now”? Confirm you are on Windows 10 version 22H2 and that KB5063709 (or later) is installed. Run Windows Update, reboot, and check again. You must be an administrator and signed in with a Microsoft account.
  • Microsoft Rewards redemption fails? Ensure your Rewards account has enough points and that the service is available in your region. Try redeeming from a different browser or device.
  • Wizard crashes or throws an error? Install the latest cumulative and servicing stack updates, then retry. Make sure you are using a Microsoft account, not a local one.
  • Domain‑joined or MDM‑enrolled devices are excluded from the consumer ESU path; work with IT to acquire enterprise ESU or plan migrations.

If enrollment still fails, keep a screenshot of the error and note your build number. These details help technical support and community troubleshooting.

Is the $30 Fee Worth It? A Cost‑Benefit Analysis

The paid consumer ESU option is a one‑time fee—roughly $30 USD—that covers up to 10 eligible devices linked to the same Microsoft account. For households with several older PCs that cannot upgrade, this is a relatively inexpensive bridge for one year. However, consider hidden costs and tradeoffs:

  • Security tradeoff: ESU covers only critical/important patches; you may still need to invest in endpoint protection, backups, and monitoring.
  • Migration costs: The $30 buys time, not a migration. Plan whether that time will be used to replace hardware or perform a controlled upgrade.
  • Privacy implications: The free options require syncing settings to OneDrive or linking a Microsoft account; some users may view that as an unacceptable privacy or policy tradeoff.
  • Regional variability: Local taxes and currency fluctuations affect the final cost.

For many households, combining one paid ESU license with a small budget for backups and a replacement plan is a reasonable short‑term approach. For organizations, enterprise ESU and migration planning remain the more robust choices.

To stay secure and migrate on your own terms, follow this phased timeline:

  • Now: Confirm your device is on Windows 10 version 22H2 and install the latest cumulative updates (including KB5063709 if not already present).
  • Within 30 days: Back up critical data and enroll in ESU if you need the one‑year bridge. Choose your enrollment path after weighing privacy and account tradeoffs.
  • Over the next 3–9 months: Use the ESU window to test Windows 11 compatibility, collect application compatibility data, and budget for new hardware or alternative platforms.
  • No later than October 13, 2026: Complete a migration to a supported OS or accept the heightened risks of running an unsupported Windows 10 system.

ESU should be treated as a deliberate, short‑term safety net—buy time, not complacency.

Conclusion: A Responsible Stopgap, Not a Permanent Solution

Windows 10’s consumer ESU program is a pragmatic and measured response from Microsoft. It recognizes that a portion of users cannot immediately transition to Windows 11 and that a short, managed extension can reduce mass exposure to critical threats. The KB5063709 update addressed early rollout issues and made enrollment accessible to the intended audience.

Yet the offering is intentionally temporary and constrained. The program’s architecture—Microsoft account binding, eligibility limits, and the single‑year timeframe—makes one thing clear: the era of Windows 10 mainstream support is ending. For home users, the best outcome is to use the ESU window to secure, inventory, and migrate thoughtfully rather than to delay indefinitely. For organizations, ESU buys planning time but should not replace disciplined migration programs. The costs of postponing a move to a supported platform—in security, compatibility, and ultimately money—will rise over time. Prioritize data protection, informed choices about account and backup tradeoffs, and an actionable schedule to exit the Windows 10 lifecycle gracefully.