Windows 10's free ride ended on October 14, 2025. For the millions of PCs still running the decade-old operating system, the only path to monthly security patches now runs through Microsoft's Extended Security Updates (ESU) program—and for home users, the door closes permanently on October 13, 2026. Businesses have more breathing room, with commercial ESU tiers that stretch through 2028, but they, too, must actively enroll and assign licenses to each device. Without action, those machines will go without fixes for the next critical vulnerability.

What actually changed

On October 14, 2025, Windows 10 version 22H2 exited mainstream support. That means no more automatic, free security updates via Windows Update—the monthly dump of patches that sealed off exploits in the OS kernel, browser, and networking stack.

Microsoft's official Extended Security Updates program, previously reserved for enterprise and Windows Server customers, is now available for Windows 10, and for the first time, it includes an option for individuals. But ESU is a different beast from the familiar Patch Tuesday rhythm. It delivers only fixes rated Critical or Important by Microsoft's Security Response Center. There are no new features, no non-security hotfixes, no design tweaks, and no technical support unless you have a separate paid support plan. In short, it's a security-only drip feed, issued if and when vulnerabilities emerge.

For consumers, ESU lasts exactly one year: until October 13, 2026. Commercial customers—organizations running Windows 10 Enterprise, Education, or Pro for work—can extend coverage for up to three years, with year two ending October 12, 2027, and year three on October 10, 2028. But each year must be licensed separately, and you can't skip years: if you come late to the program, you pay for the months you missed.

What it means for you

The impact splits sharply between home users and IT administrators.

If you're a home user

If you have a personal Windows 10 PC that doesn't meet Windows 11's hardware requirements—or you're simply not ready to upgrade—you have a straightforward but time-sensitive path. Once your machine is fully updated to version 22H2, the Windows Update page in Settings should display an ESU enrollment option. Microsoft has outlined several enrollment routes: syncing PC settings, redeeming Microsoft Rewards points, or making a one-time purchase. The purchase option is the most direct; it requires a Microsoft account, and the offer is linked to that account and device.

If enrollment fails—and users on forums have reported opaque errors—you'll need to run through a checklist: confirm you're on 22H2, install all pending updates, ensure the same Microsoft account is used consistently, and capture any error messages before retrying. The important thing: don't treat ESU as a permanent solution. Mark your calendar for October 13, 2026. After that, no consumer patch avenue exists. The only choices will be to upgrade to Windows 11 (if your hardware allows), invest in a new PC, or stay on an unpatched OS at your own risk.

For businesses and IT administrators

Commercial ESU is not a simple button in Windows Update; it requires purchasing licenses through your organization's Microsoft volume licensing agreement or enrolling servers in Azure Arc. The exact procedure depends on your agreement type (Enterprise Agreement, Cloud Solution Provider, etc.). Administrators must first identify the governing agreement and entitlement channel, acquire the appropriate ESU SKUs, assign them to devices, and verify that updates actually flow through your management tools (WSUS, Configuration Manager, or third-party patch solutions).

Crucially, you can't just buy a blanket ESU license and call it done—each endpoint needs its license recorded, along with proof of eligibility, activation status, and a planned migration exit date. Virtual machines add another layer: a Windows 10 VM running on-premises or in a cloud doesn't automatically get ESU rights. You must validate whether the host platform, image ownership, and licensing model grant coverage. In many cases, commercial ESU must be purchased separately for VMs, unless your service explicitly includes it (Azure VMs, for instance, get free ESU when configured correctly).

How we got here

Extended Security Updates have been a staple of Microsoft's lifecycle policy since the Windows 7 era, but they were always an enterprise-only affair. The original Windows 7 ESU program (2020–2023) charged per-device fees that escalated yearly and were available only to volume licensing customers. With Windows 10, Microsoft broke tradition by offering ESU to consumers—a nod to the hundreds of millions of PCs that can't upgrade to Windows 11 due to TPM 2.0 and CPU requirements.

The company announced the consumer ESU option in late 2023, setting a one-year tenure and stressing it was a last resort, not a new support model. This aligned with a broader push to move users to newer platforms, yet it acknowledged the reality that many people and organizations would remain on Windows 10 beyond its end-of-support date.

The October 14, 2025 deadline was fixed in stone long ago; Windows 10 22H2 was the final version. Now that we've passed it, the ESU bridge is the only official safety net. It's worth noting that some community speculation has occasionally referenced a potential "2027" date for consumer ESU, but that's a misreading of the commercial timeline. Microsoft's documentation is explicit: consumer ESU ends October 13, 2026. Plan accordingly.

What to do now

Whether you're an individual or an IT pro, today is the day to act. Here's a concrete plan.

For home users

  1. Open Settings > Update & Security > Windows Update and check for updates. Install everything and restart until no more updates appear.
  2. Verify your Windows 10 version is 22H2 (type "winver" in Start to confirm).
  3. Return to Windows Update and look for an "Extended Security Updates" section. If it's there, follow the prompts using your Microsoft account. You may see options to purchase, redeem Rewards, or sync settings—choose the one that fits.
  4. If enrollment doesn't appear or fails, don't panic. Re-run Windows Update, ensure your Microsoft account is signed in, and try again. If it still fails, note the exact error and contact Microsoft support via the Windows support portal.
  5. Once enrolled, save any confirmation you receive. Set a reminder for October 2026 to either upgrade to Windows 11 or prepare for a hardware transition.

For IT administrators

  1. Assign a responsible person or team to catalog every Windows 10 device in your environment. For each, record owner, version, management status, and whether it's physical or virtual.
  2. Determine your ESU licensing route: talk to your Microsoft licensing administrator to identify the applicable agreement (EA, CSP, SCE, etc.). Use Microsoft's official Windows 10 ESU documentation for the exact steps.
  3. Acquire licenses for the devices you'll cover. Remember that commercial ESU requires covering all prior years; if you start now, you'll likely need a Year 1 license. For VMs, validate whether your Azure subscription or cloud provider includes ESU before buying extra.
  4. Deploy licenses according to Microsoft's instructions—this may involve activation keys, Azure Arc enrollment, or other methods. Then verify that a test device actually receives an ESU update after the next Patch Tuesday.
  5. Build a migration register: for every ESU-covered device, document the blocking issue (app incompatibility, no budget for replacement, etc.) and set a firm exit date. ESU is a temporary bridge, not indefinite support.

Outlook

Microsoft has no intention of extending consumer ESU beyond one year. The company's focus is on Windows 11, which now boasts a growing install base but still leaves behind a significant number of older machines. Over the next 12 months, expect to see more aggressive prompts to upgrade or buy a new PC.

For businesses, the three-year runway buys time, but the per-device cost and administrative overhead will mount annually. The smartest play is to use ESU only for the systems you genuinely can't move, and accelerate migration plans for everything else.

After October 13, 2026, the consumer chapter closes. After October 10, 2028, the last Windows 10 security patch will be delivered to commercial holdouts. Between now and then, every ESU-enrolled machine needs an owner, a license record, and an exit strategy. Otherwise, it's a vulnerability waiting to happen.