Microsoft has pushed out KB5065429, the September 2025 cumulative update for Windows 10 22H2, and it arrives as more than just a standard security rollup — it’s the key that unlocks the consumer Extended Security Updates (ESU) enrollment wizard for millions of PCs facing the October 14, 2025 end-of-support cliff. With only one more Patch Tuesday left before the OS retires, this mandatory update not only patches critical vulnerabilities but also prepares devices for the free or low-cost ESU program that can extend security patches until October 13, 2026.

KB5065429 is a cumulative rollup distributed automatically through Windows Update and available as a standalone .msu package on the Microsoft Update Catalog. It advances Windows 10 22H2 to build 19045.6332 and is applicable to all x86, x64, and ARM64 editions. For most home users, no manual action is needed — the update will install in the background — but administrators and offline environments can fetch the full installer to avoid bandwidth spikes or deployment delays.

The Clock Ticks: KB5065429 Lands as a Critical Pre-EOL Update

As Microsoft’s own documentation confirms, Windows 10 Home and Pro will stop receiving free monthly security updates after October 14, 2025. That leaves only a handful of weeks for the estimated hundreds of millions of PCs still running the decade-old OS to plan their next move. KB5065429 is not the final cumulative update — that will arrive on the October Patch Tuesday — but it is the penultimate servicing release, and it carries immediate security content alongside the infrastructure needed for the consumer ESU enrollment.

The update addresses a range of vulnerabilities in the Windows kernel, graphics stack, networking components, and system services. Because it’s cumulative, it also includes all fixes from previous months, making it a critical install for any device that has fallen behind on patches. Microsoft has not reported any widespread issues with this specific release as of this writing, though community testers have flagged a few improvements and minor quirks that we’ll detail below.

ESU Enrollment: Free, Rewards, or $30 — How It Works

For the first time, Microsoft is offering consumers a bridge year of security updates through a simplified in-product enrollment process. The program, detailed on Microsoft’s support site, provides three paths to secure patches from October 14, 2025 until October 13, 2026:

  • Free via Windows Backup sync: Enroll by signing in with a Microsoft account and enabling Windows Backup / settings sync to OneDrive. This no-cost route ties the ESU entitlement to the act of backing up settings to Microsoft’s cloud.
  • Redeem 1,000 Microsoft Rewards points: Users who have accumulated Rewards points can spend 1,000 points to obtain an ESU license token, effectively making the program free for loyal Microsoft ecosystem participants.
  • One-time $30 payment: A flat fee (plus applicable tax) purchases a license that covers up to 10 eligible devices associated with a single Microsoft account. This is the most straightforward paid option for multi-PC households.

All three methods produce the same result: the device is flagged for the consumer ESU stream and will receive monthly security-only updates during the one-year grace period. The coverage is limited to “Critical” and “Important” rated patches — no new features, no design changes, and no non-security fixes beyond what’s already in Windows 10’s final regular updates.

Enrollment had been gated behind an invisible prerequisite: the machine must be running Windows 10 version 22H2 and have the latest servicing stack combined with the August or September cumulative updates. Earlier this year, a bug in the August update caused the “Enroll now” banner to crash or not appear at all for some users. Microsoft fixed that regression, and KB5065429 carries further refinements to ensure the enrollment wizard loads reliably. The path to enrollment is now accessible through Settings → Update & Security → Windows Update, where a “Windows 10 support ends in October” notice should be visible if the device qualifies.

Hands-On: What Users Are Seeing After Installing KB5065429

Independent testers and community reports paint a clarified — though not yet universal — picture. For many home users, installing KB5065429 and rebooting immediately surfaces the “Enroll now” button. In controlled tests, the process was usually seamless: click Enroll now, choose one of the three paths, confirm with a Microsoft account sign-in if prompted, and within seconds the device was registered for ESU.

However, Microsoft has cautioned that the enrollment UI is rolling out in phases. Not every eligible PC will see the option right away, even after the September update is applied. The company’s official stance, confirmed in both support documentation and statements to outlets like Windows Latest, is that the staged rollout is intentional to ensure backend capacity and to catch any last-minute glitches. If you don’t see the banner immediately, the advice is to keep the device updated with the latest servicing stack and cumulative updates and to check again periodically before mid-October.

There are also hard eligibility boundaries. The consumer ESU program is not available for domain-joined devices, enterprise-managed machines, kiosk systems, or accounts set up as child accounts. Enterprise and education customers have a separate ESU pathway with different pricing and volume licensing terms. Users who deliberately avoid Microsoft Accounts and rely on local-only sign-in will be forced to convert or add a Microsoft Account to enroll — a tradeoff that privacy-focused communities have already begun to debate.

Bug Fixes and Stability Improvements

While the ESU enrollment logic is the headline story, KB5065429 also contains a few targeted fixes that address real-world pain points:

  • NDI streaming fixes: After the August update, many users reported audio delays, stuttering, and poor video performance when using Network Device Interface (NDI) to stream or transfer feeds between PCs. This update reverses that regression, restoring reliable low-latency A/V stream behavior.
  • SMB security hardening: For administrators managing shares and Group Policy settings, the update refines Server Message Block (SMB) protocols. This allows tighter security controls across managed fleets without breaking existing workflows.

No new features are introduced — this is a pure security and reliability update — but for users relying on NDI for broadcasting, the fix is a welcome return to normal.

Security and Privacy Tradeoffs

The consumer ESU program is a pragmatic answer to the massive share of Windows 10 devices that cannot meet Windows 11’s hardware requirements (TPM 2.0, Secure Boot, supported CPUs). But the enrollment mechanics come with a handful of considerations that cautious users should weigh:

  • Microsoft Account requirement: Every enrollment path — including the $30 paid option — demands a Microsoft Account. For those who have deliberately kept their Windows 10 PC local, this represents a shift toward a more connected ecosystem and gives Microsoft visibility into the device’s enrollment status and possibly its usage patterns.
  • OneDrive storage implications: The free route hinges on enabling Windows Backup and settings sync to OneDrive. Free OneDrive accounts come with only 5 GB of storage; if a user’s settings backup pushes beyond that ceiling, they may be nudged toward a paid OneDrive subscription, adding a recurring cost that isn’t obvious at first glance.
  • One-year limit: ESU is a bridge, not a permanent solution. After October 13, 2026, security updates stop entirely for Windows 10 consumer SKUs. Organizations and power users must use the extra year to migrate to Windows 11, switch to an alternative OS, or decommission unsupported hardware. Delaying that planning until 2026 would be a mistake.

On the plus side, the program keeps internet-exposed and sensitive machines safer during a period when threat actors are likely to stockpile Windows 10 exploits. The ability to cover up to 10 devices with a single $30 license is also a genuine money-saver for households with multiple aging PCs.

Your Action Plan: Patching, Enrolling, and Migrating

Here’s a step-by-step roadmap to navigate the final weeks of Windows 10’s free support and the ESU program:

  1. Verify your build: Open Settings → System → About and confirm you’re on Windows 10 22H2 with a valid digital license.
  2. Patch immediately: Run Windows Update and install all pending cumulative updates, including KB5065429. If automatic updates fail, download the correct .msu file from the Microsoft Update Catalog (search for KB5065429) and install it manually. Always verify the file hash with PowerShell’s Get-FileHash -Algorithm SHA256 to ensure integrity.
  3. Prepare your account: Decide which Microsoft Account will act as the ESU license holder. If you currently use a local account, add an MSA as an administrator or convert your local profile. One account can cover up to 10 eligible devices, so coordinate within your household.
  4. Create a full backup: Before making any significant changes, capture a complete system image using Windows Backup and Restore (Windows 7) or a third-party tool. Don’t rely solely on OneDrive for disaster recovery.
  5. Enroll when prompted: Once your device is fully patched, visit Settings → Update & Security → Windows Update. If the “Enroll now” banner appears, click it and follow the wizard. Choose your preferred enrollment path — sync, Rewards, or purchase — and complete the process. If you don’t see the option, be patient; Microsoft’s staged rollout may take a few more days.
  6. Plan your migration: Use the ESU year to inventory your applications, test Windows 11 compatibility on spare hardware, and budget for replacements. If your PC can’t run Windows 11 at all, consider whether Linux, ChromeOS Flex, or a dedicated offline role might be a viable long-term path.

The Bottom Line

KB5065429 is far more than a routine security patch. It is the technical linchpin that makes consumer ESU enrollment possible, and it arrives at the last practical moment before Windows 10’s mainstream retirement. For the millions of users whose hardware cannot jump to Windows 11, the free or moderately priced ESU program is a responsible safety net — but only if they act before October 14, 2025.

Privacy-focused users should scrutinize the Microsoft Account requirement and the OneDrive entanglement before enrolling. Enterprise customers must look to volume-licensed ESU options. And everyone should treat the extra year as a runway for migration, not an excuse to delay decisions.

With one final Patch Tuesday left and the “Enroll now” button gradually lighting up on eligible machines, the time to secure Windows 10’s legacy is now. Install KB5065429, evaluate your ESU path, and start planning the next chapter for your hardware — before the clock runs out.