Microsoft has drawn a hard line in the sand: the October 14, 2025 Patch Tuesday will deliver the final regular security update for Windows 10 systems that aren’t enrolled in the new consumer Extended Security Updates (ESU) program. After that date, any unenrolled Windows 10 PC will stop receiving monthly protections against the latest threats, leaving hundreds of millions of devices exposed unless users take immediate action.

This confirmation, combined with a phased rollout of the ESU enrollment experience, makes the next few weeks critical. Microsoft urges users to prepare now—install pending updates, verify eligibility, and look for the “Enroll now” prompt inside Windows Update. Delaying until the last day risks missing the cutoff entirely.

A hard deadline and a narrow lifeline

Windows 10 mainstream support ends on October 14, 2025. On that date, Microsoft will ship its final monthly security update for systems not signed up for ESU. The consumer ESU program offers a one-year bridge of security-only patches—covering Critical and Important vulnerabilities—through October 13, 2026. It does not include feature updates, non-security quality fixes, or technical support. It’s a stopgap, not a destination.

The program is Microsoft’s first attempt to offer individual users a post-support security patching option for a desktop operating system. For years, ESU was available only through volume licensing for enterprise customers. Now three paths are open to anyone running a supported edition of Windows 10 version 22H2.

Three ways to enroll, one hard requirement

All consumer ESU paths demand a Microsoft Account (MSA) with administrator rights on the device. Local accounts do not qualify. This is a notable shift that ties continued security support to Microsoft’s identity ecosystem.

Once signed in, an eligible device shows an “Enroll now” link in Settings > Update & Security > Windows Update. Tapping it brings up three choices:

  • Free enrollment: Enable Windows Backup to sync PC settings and apps to OneDrive. No cash changes hands, but you must opt into cloud backup.
  • Microsoft Rewards: Redeem 1,000 Rewards points to claim an ESU license. This avoids enabling cloud sync but requires having points available.
  • Paid one-time purchase: $30 USD (plus tax) bought through the Microsoft Store via the enrollment wizard. A single license covers up to 10 eligible devices linked to the same Microsoft Account.

All three deliver the same 12 months of security updates. The license is tied to the MSA used at enrollment; swapping accounts later breaks coverage.

Prerequisites: what your PC needs before enrollment

The enrollment prompt won’t appear unless your device meets strict technical conditions.

  • Must be on Windows 10 version 22H2. Home, Pro, Pro Education, or Pro for Workstations editions. Enterprise and domain-joined machines are excluded from the consumer program and must use volume licensing.
  • Must have recent cumulative updates installed. The August 2025 update (commonly referred to as KB5063709) fixed early enrollment bugs and helps surface the prompt. The September 2025 mandatory security update is now rolling out and includes further refinements. Install every pending update and reboot until Windows Update reports “You’re up to date.”
  • Must sign in with a Microsoft Account that is an administrator on the machine. Local accounts won’t trigger the enrollment option.

Community forums and tech press have documented that users who installed the August or September cumulative updates often saw the enrollment link immediately. Others, still waiting, illustrate the phased rollout.

The phased rollout tightens the clock

Microsoft is rolling out the enrollment experience in waves. Even fully patched, eligible devices may not see the “Enroll now” link right away. The company says everyone will have it before October 14, but that leaves little margin for procrastination.

A day or two of checking without the link may be normal. Waiting until mid-October, however, is a gamble. If the prompt hasn’t appeared by the deadline, the device misses out. The safe move: install updates now, check Windows Update daily, and enroll the moment the link appears.

Why unpatched Windows 10 is a magnet for attackers

Without monthly security updates, newly discovered vulnerabilities remain unpatched indefinitely. Attackers closely track Patch Tuesday releases and reverse-engineer fixes to develop exploits for unpatched systems. A Windows 10 machine without ESU becomes a soft target the moment the last regular update ships.

ESU plugs that gap for one year, but only for flaws rated Critical or Important by Microsoft’s Security Response Center. Lower-severity bugs and non-security quality issues are left unaddressed.

The scale of the challenge

Market share estimates paint a sobering picture. StatCounter data showed Windows 10 still holding roughly 44% of desktop Windows usage by mid-2025—equivalent to something north of 600 million devices. Those numbers are directional; no official Microsoft census exists. But even a conservative reading makes clear that a vast user base must either migrate or enroll in ESU.

Forbes reported that Windows 11 finally began regaining share after a brief Windows 10 rebound, but the clock is ticking for the holdouts. Many are on hardware that cannot meet Windows 11’s TPM 2.0, Secure Boot, and CPU requirements, making ESU their only official path to continued patching.

Privacy, identity, and consumer friction

The Microsoft Account mandate has drawn sharp criticism. Even the $30 paid ESU license requires a device to be associated with an MSA. Privacy-conscious users who have long avoided cloud accounts are forced to choose between losing security coverage and joining Microsoft’s account ecosystem.

Tech outlets and forum commenters have flagged this as a significant policy lever. Microsoft’s own documentation frames the MSA as a convenience—it binds the license to the user and enables coverage across up to ten devices—but for many, it’s a dealbreaker. The alternatives: upgrade to Windows 11 (which also pushes MSA sign-in but still allows workarounds for local accounts) or switch to a non-Microsoft OS.

Step-by-step: how to enroll in ESU today

A practical checklist for any Windows 10 user:

  1. Back up your PC now. Create a full system image and file backup. Store it offline. A rare but real possibility exists that cumulative updates or enrollment steps could expose driver or firmware incompatibilities.
  2. Verify your Windows version. Settings > System > About—you must be on Windows 10 version 22H2. If not, update via Windows Update.
  3. Install all pending updates. Reboot repeatedly until no updates remain. Look for the September 2025 cumulative update (or any later LCU) and ensure the servicing stack is current.
  4. Sign in with a Microsoft Account that has administrator privileges. If you currently use a local account, switch sign-in type first.
  5. Open Settings > Update & Security > Windows Update and look for the “Enroll now” link. If it appears, follow the wizard and choose Free, Rewards, or Paid enrollment.
  6. If the link is missing, re-check steps 3 and 4, reboot, and check again in 24 hours. The rollout is phased; persistence is key.

For IT professionals and business admins

Domain-joined, MDM-managed, and kiosk devices are excluded from consumer ESU. Organizations must use enterprise ESU via volume licensing. For those fleets, the October 14 cutoff is equally firm without active ESU contracts.

  • Audit your Windows 10 inventory and classify devices by eligibility for Windows 11 upgrade versus those requiring ESU or hardware refresh.
  • Test application compatibility and firmware readiness for any migration.
  • For consumer-type scenarios (e.g., small offices with unmanaged PCs), the $30 per-account option covering up to 10 devices may be cost-effective, but document the Microsoft Accounts used and the enrollment dates.

Remember: ESU is a temporary bridge. Build a migration timetable that ends before October 13, 2026.

Alternatives to ESU

Upgrade to Windows 11 remains the recommended path for anyone whose hardware qualifies. The upgrade is free, and Windows 11 receives full feature and security support well beyond the ESU window. Microsoft’s documentation leads with this option. Users who can upgrade should do so rather than rely on a one-year security bandage.

Buy a new PC. For those on unsupported hardware, a new Windows 11 device provides multi-year support without the restrictions and deadline pressure of ESU. This is the most future-proof option, albeit with a cost.

Switch to an alternative OS. Linux distributions can breathe new life into older hardware, offering ongoing security updates at no cost and without MSA requirements. The trade-off is a complete change of workflow, compatibility testing, and a learning curve. This path suits power users and those with simple computing needs.

Analysis: strengths and risks of the ESU program

Strengths
- A clear, fixed deadline helps organizations and individuals plan.
- Three enrollment options—free, Rewards, paid—broaden access for households.
- Microsoft quickly shipped a cumulative update (KB5063709) to fix early rollout bugs, demonstrating responsiveness.

Risks and downsides
- Mandatory Microsoft Account enrollment locks users into the company’s identity ecosystem, even for paid coverage.
- Phased rollout creates uncertainty and risks leaving some users unable to enroll in time.
- ESU only covers Critical and Important security updates; no quality updates, no new features, no technical support.

What happens after October 13, 2026?

Microsoft has not announced an extension of consumer ESU beyond the one-year bridge. On that date, even ESU-enrolled devices lose all security patches. The message is clear: the consumer ESU program is a deadline extension, not a permanent solution. Migrating to a supported OS before then is essential.

The bottom line

October 14, 2025, is not a suggestion. It’s the day Windows 10 goes dark for anyone who hasn’t enrolled in ESU or upgraded. The enrollment prompt is rolling out in waves, and the enrollment process hinges on having a Microsoft Account, applying specific cumulative updates, and acting before the cutoff. For the hundreds of millions of users still on Windows 10, the next few weeks are the moment to decide: enroll now, upgrade to Windows 11, or accept the risk.

Procrastination is the biggest threat. Install the latest updates today, check for the “Enroll now” link, and secure your device before the last regular patch arrives. The one-year lifeline is there—but only for those who reach for it in time.