Windows 10 users have a one-time chance to extend security support for another year, but the window to enroll closes on October 13, 2025—and the process isn’t as simple as clicking a button. Microsoft has quietly opened a consumer Extended Security Updates (ESU) program that grants critical and important security patches through October 13, 2026, but only if you meet strict prerequisites and act before the October 14, 2025, end-of-support deadline. The enrollment toggle is rolling out in waves, and recent Windows Update problems have made it harder for some to qualify. Here’s what you need to know, drawn from official Microsoft guidance, community reports, and recent coverage.

What the Consumer ESU Actually Delivers

Microsoft’s consumer ESU program is a stopgap, not a permanent solution. It supplies the same security updates classified as critical and important by the Microsoft Security Response Center (MSRC) that enterprise customers have long purchased, but it excludes feature updates, new functionality, and technical support. If a stability fix or non-security improvement ships after the cutoff, ESU license holders won’t receive it.

Three enrollment paths are available, each tied to a Microsoft Account (MSA):

  • Free with OneDrive backup: Sync your PC settings to OneDrive and link the device to an MSA. Microsoft grants the ESU at no cost if you already back up settings or enable it during enrollment. Personal file backup is optional but recommended.
  • Microsoft Rewards: Redeem 1,000 Rewards points for an ESU license. This option bypasses the OneDrive requirement but still demands an active Rewards balance and an MSA.
  • Paid license: A one-time $30 USD purchase (plus tax) covers up to 10 devices on a single Microsoft Account. It’s the cleanest path if you want to avoid cloud syncing and have multiple PCs to protect.

All three methods produce the same outcome: security updates flow until October 13, 2026. The license is MSA-bound, so you can reassign it if you switch hardware.

Who Can Enroll—and Who’s Left Out

Eligibility hinges on a handful of hard requirements:

  • Windows 10 version 22H2 with Home, Pro, Pro Education, or Workstation editions. Older versions or other editions won’t see the enrollment prompt.
  • All latest cumulative and servicing stack updates installed. Microsoft’s August 12, 2025 cumulative update KB5063709 and the August 19 out-of-band fix KB5066188 (which resolved reset and recovery issues) are examples; your device must have applied equivalent recent patches for the enrollment flow to appear reliably.
  • An administrator Microsoft Account. The account used to enroll must be a personal MSA with local admin rights. Child accounts are blocked. Domain-joined or MDM-managed devices are explicitly excluded—organizations must use volume licensing and enterprise ESU programs.

Additional exclusions include kiosk-mode devices, certain Entra-joined scenarios, and PCs already covered by enterprise licenses. Check Microsoft’s support page for the full list if your setup is unusual.

The Enrollment Timeline: Act Before October 13, 2025

The deadline is non-negotiable. Microsoft will deliver a final regular Windows Update to unenrolled Windows 10 devices in October 2025; after that, only ESU devices will get patches. To avoid even a day of exposure, you must complete enrollment before October 14. The “Enroll now” button is being pushed to devices in phased waves—some users see it immediately, others wait weeks. Microsoft has assured that every eligible device will receive the toggle before the cutoff, but you shouldn’t count on a last-minute rush.

Recent reporting from Forbes and Windows Latest confirms that the next cumulative update expected in mid-September (likely September 9, 2025) will be a trigger for many. Install it as soon as it appears, then check Settings > Update & Security > Windows Update for the enrollment prompt. If you haven’t applied recent updates, you won’t see anything.

Technical Verification: What to Install Now

Two items are non-negotiable for the enrollment infrastructure to work:

  • Confirm Windows 10 22H2: Open Settings > System > About. If you’re not on 22H2, upgrade via Windows Update or the Media Creation Tool immediately.
  • Apply the latest SSU and LCU: The servicing stack update (SSU) and latest cumulative update (LCU) are tightly coupled. Microsoft’s August 2025 releases—KB5063709 (August 12) and KB5066188 (August 19)—address enrollment reliability and recovery bugs. If Windows Update reports errors, run the Windows Update troubleshooter or use the Microsoft Update Catalog to manually install the .msu files.

A broken update stack is the number one reason the “Enroll now” toggle stays hidden. Before doing anything else, ensure no pending updates remain and reboot until the checkmark appears in Windows Update.

Step-by-Step Enrollment Guide

Follow these instructions in order to minimize risk and confirm eligibility:

  1. Verify edition and version: Confirm you’re on Windows 10 22H2 (Home, Pro, Pro Education, or Workstation).
  2. Install all pending updates: Go to Settings > Update & Security > Windows Update, check for updates, and install everything offered. Reboot when prompted, then check again until no updates appear.
  3. Create a full system image (recommended): Use a third-party tool or the legacy Windows 7 backup utility to clone your drive to an external disk. This provides a rollback point if the cumulative update or enrollment process causes instability.
  4. Sign in with an administrator MSA: If you use a local account, you’ll be prompted during enrollment. The MSA must have admin privileges on the device.
  5. Open Windows Update and look for “Enroll now”: Navigate to Settings > Update & Security > Windows Update. If a blue “Enroll now” button appears, click it and follow the wizard. Choose Free, Rewards, or Paid enrollment as applicable.
  6. If the button is absent: Recheck for updates, apply any newly offered SSU or LCU, reboot, and check again. The rollout is phased; your device may need the September 2025 cumulative update to surface the toggle.

After enrollment, verify success by checking the Windows Update page for a confirmation message. Document the MSA used and, if you paid, save the receipt.

What ESU Doesn’t Fix—and the Tradeoffs

While ESU buys time, it comes with constraints that every user should weigh:

  • Security patches only: If a non-security bug disrupts your workflow, ESU won’t deliver a fix. The program offers no performance improvements, driver updates, or feature additions.
  • Microsoft Account dependency: All three enrollment methods require an MSA. The free path also demands that you sync PC settings to OneDrive, which may trouble privacy-conscious users. The paid and Rewards options still attach the license to your MSA, so you can’t avoid the cloud entirely.
  • Not for business environments: As soon as a device joins an Active Directory domain or enrolls in MDM, the consumer ESU becomes invalid. Companies must procure enterprise ESUs through volume licensing.
  • Rollout fragility: August 2025’s cumulative updates caused well-publicized issues, including an out-of-band patch to fix reset/recovery problems. Large servicing changes can temporarily break update reliability, so a full backup is essential.
  • One year is not forever: ESU ends on October 13, 2026. There is no extension beyond that date. Use the time to migrate to Windows 11, switch to a supported Linux distribution, or adopt a cloud-based Windows instance (Windows 365 or Azure Virtual Desktop) for legacy applications.

Market Reality: Why So Many Are Stuck on Windows 10

Forbes reported that over 700 million users can’t or won’t upgrade to Windows 11, a number that likely stems from Statcounter’s global usage data. Statcounter shows Windows 11 recently overtook Windows 10 in market share, but the two operating systems remain neck-and-neck. Many devices fail Windows 11’s strict hardware requirements—TPM 2.0, specific CPUs, and UEFI firmware—while others are in environments where a major OS change is impractical.

Microsoft’s surprise consumer ESU is a direct response to this vast installed base. By offering a free or low-cost path, the company hopes to reduce the security risk posed by millions of unpatched machines while nudging the ecosystem toward Windows 11. The phased enrollment rollout and technical prerequisites suggest Microsoft still wants to minimize the support tail, but it recognizes pushing users off a cliff in October 2025 would be disastrous.

Which Path Should You Take?

Your choice depends on your constraints:

  • If you can upgrade to Windows 11: Do it now. Use the PC Health Check app to confirm compatibility and launch the upgrade from Windows Update. Windows 11 will receive full support and feature updates long past 2026.
  • If your hardware can’t run Windows 11 and you’re comfortable with cloud sync: Enroll in the free ESU path by syncing PC settings to OneDrive. The privacy tradeoff is minimal for most, and it buys a year of breathing room.
  • If you refuse to sync or lack a Rewards balance: Pay the $30 one-time fee. It covers up to 10 devices, making it economical for families.
  • If you’re an enterprise or have domain-joined devices: Avoid the consumer program. Acquire ESU keys through your volume licensing agreement or explore Windows 10 IoT LTSC alternatives.

No matter the route, start planning your exit from Windows 10 immediately. The ESU clock is ticking, and a year passes faster than you think.

Final Verdict: A Pragmatic Lifeline with Strings Attached

Microsoft’s consumer ESU program is a rare and welcome concession. For the first time, individual users can access extended security updates without enterprise contracts, and the free option lowers barriers significantly. The phased rollout and heavy dependency on recent cumulative updates have caused frustration—community forums brim with reports of invisible enrollment buttons—but the structural problems are manageable if you follow the preparation steps.

The deeper takeaway is that Windows 10’s twilight is now officially a managed transition, not an abrupt cliff. Still, ESU is a patch, not a platform. Use the year to audit your hardware, test Windows 11 on spare drives, or evaluate Linux distributions that can run your critical applications. By October 2026, you’ll need to be somewhere else.

For now, open Windows Update, install everything, and if you see that “Enroll now” button, click it. The alternative—an unpatched Windows 10 machine facing the open internet—is not an option.