The countdown to October 14, 2025, has officially begun for millions of Windows 10 users worldwide. This date marks the definitive end of support for one of the most successful operating systems in Microsoft’s history. However, for many individuals and organizations, migrating to Windows 11 is not a simple overnight task. Hardware limitations, legacy software dependencies, and budget constraints often create a gap between the end of official support and the readiness for an upgrade.

To bridge this gap, Microsoft has introduced the Windows 10 Extended Security Updates (ESU) program. This is a paid subscription service designed to provide critical and important security patches for devices that must remain on Windows 10 after the support cutoff. Understanding the nuances of this program—its cost, its limitations, and its technical requirements—is essential for anyone planning their computing roadmap beyond 2025.

What is the Windows 10 Extended Security Update Program

The Extended Security Update (ESU) program is a last-resort option. It is not a feature update, nor is it a performance boost. It is a security-only subscription. Once the standard lifecycle of Windows 10 ends, Microsoft will no longer release public updates, bug fixes, or security patches. A computer running an unsupported operating system becomes a prime target for malware, zero-day exploits, and sophisticated cyber-attacks because the vulnerabilities discovered after October 2025 will remain unpatched.

The ESU program changes this by allowing enrolled devices to continue receiving "Critical" and "Important" security updates as defined by the Microsoft Security Response Center (MSRC). It is a strategic safety net that ensures regulatory compliance and data protection while the user prepares for a hardware refresh or a migration to Windows 11.

It is vital to understand what ESU does not include. Subscribing to this program will not grant access to new features, design changes, non-security bug fixes, or general technical support from Microsoft. If your printer driver breaks or your interface glitches, the ESU program will not provide a fix unless that glitch is specifically tied to a security vulnerability.

Windows 10 End of Support Dates and Timelines

The official end-of-life for Windows 10 Home, Pro, Pro Education, and Pro for Workstations is October 14, 2025. This applies specifically to version 22H2, which Microsoft has confirmed is the final version of the operating system.

The duration of the ESU program varies significantly based on whether you are a personal user or a business entity:

  • For Individual Consumers: The ESU program provides a single year of coverage, extending security support through October 13, 2026.
  • For Commercial Organizations: Businesses, educational institutions, and government agencies can purchase up to three years of coverage, extending support as far as October 2028.

This distinction is crucial. Home users only have a 12-month "grace period" before their systems are truly left without protection, whereas enterprises can buy themselves a 36-month window to manage massive fleet deployments of new hardware.

Eligibility and Technical Prerequisites for Windows 10 ESU

Not every Windows 10 machine can simply "sign up" for updates. There are strict technical and account-level requirements that must be met before enrollment is even offered.

Version Requirements

Your device must be running Windows 10, version 22H2. If you are still running version 21H2 or earlier, you must update to 22H2 before the October 2025 deadline to be eligible for the ESU enrollment.

Required Security Patches

Microsoft requires specific servicing stack updates and licensing preparation packages to be installed. Specifically, devices should have KB5066791 (the October 2025 end-of-service statement update) or a later update already active. For commercial environments, the Extended Security Updates (ESU) licensing preparation package (KB5072653) must be installed after KB5066791.

Account and Administrative Permissions

For personal users, the Microsoft account used to enroll the device must have administrator privileges. Furthermore, the account cannot be a "child account" managed under a family safety umbrella. For commercial users, the process is managed through the Microsoft 365 Admin Center, requiring roles like Global Administrator or Volume Licensing Administrator to view and manage the Multiple Activation Keys (MAK).

Windows 10 ESU Pricing for Home Users

For the first time in its history, Microsoft is offering an ESU program directly to individual consumers. Previously, this was a luxury reserved for large-scale enterprise customers. The pricing structure for individuals is straightforward but carries specific limitations.

The cost for a consumer ESU license is $30 USD for the one-year term. This is a one-time purchase per license. However, a single license can be associated with up to 10 devices under the same Microsoft account, provided they are all used for personal, non-commercial purposes.

Microsoft has also introduced alternative ways to "pay" or qualify for these updates:

  1. Syncing PC Settings: Users who actively sync their PC settings and use Windows Backup to OneDrive may be offered enrollment at no additional cost as part of Microsoft's push to keep users within their cloud ecosystem.
  2. Microsoft Rewards: Users can redeem 1,000 Microsoft Rewards points to cover the enrollment. This is a significant value for long-time users of Bing and other Microsoft services who have accumulated points over the years.
  3. Direct Purchase: A $30 one-time payment via the Microsoft Store or Windows Update settings interface.

Commercial ESU Pricing: The Doubling Model

For businesses, the financial math is much more aggressive. Microsoft utilizes a cumulative pricing model that effectively doubles the cost each year to encourage organizations to move to Windows 11 as quickly as possible.

While exact regional pricing can vary depending on volume licensing agreements, the base structure for commercial entities typically follows this trajectory:

  • Year 1 (Oct 2025 – Oct 2026): Approximately $61 USD per device.
  • Year 2 (Oct 2026 – Oct 2027): Approximately $122 USD per device (must also have paid for Year 1).
  • Year 3 (Oct 2027 – Oct 2028): Approximately $244 USD per device (must also have paid for Years 1 and 2).

It is important to note that ESU is cumulative. You cannot jump into the program in Year 2 without having paid for Year 1. If an organization decides to join the program late, they will be billed for the previous years to ensure they receive all the historical security patches released since the end of support.

Cloud Exceptions

There is a significant "loophole" for businesses using Microsoft’s cloud infrastructure. If your Windows 10 instances are running as virtual machines in Azure, Windows 365, or Azure Virtual Desktop, the ESU patches are included at no additional cost. This makes cloud migration an attractive alternative for companies with legacy app requirements.

How to Enroll a Personal Device in ESU

The enrollment process for home users is designed to be integrated directly into the Windows Update interface. As the October 2025 deadline approaches, eligible users will see notifications within their settings.

  1. Check Eligibility: Navigate to Settings > Update & Security > Windows Update. If your system meets the 22H2 and patch requirements, a link labeled "Enroll in ESU" or "Learn about Extended Security Updates" will appear.
  2. Account Verification: Click "Enroll now." You will be prompted to sign in with your Microsoft account. If you are currently using a local account, you must switch to or link a Microsoft account to proceed.
  3. Choose Payment Method: You will be presented with the three options mentioned earlier: Pay $30, redeem 1,000 Rewards points, or check for "no-cost" eligibility via settings syncing.
  4. Confirmation: Once the transaction is processed, the license is tied to your account. Your Windows Update screen will reflect that the device is now "Enrolled in Extended Security Updates."

After enrollment, security patches will be delivered through the standard Windows Update channel on "Patch Tuesday" (the second Tuesday of every month).

Activating Windows 10 ESU in Commercial Environments

For IT professionals managing dozens or thousands of machines, the process involves Multiple Activation Keys (MAK) and command-line tools. Enrollment is not done through the settings UI but rather through deployment scripts or management consoles like WSUS or Configuration Manager.

Step 1: Obtain the MAK

Administrators must log into the Microsoft 365 Admin Center, navigate to Billing > Your Products, and select the Volume Licensing tab. Under the ESU contract, you can find the Product Keys.

Step 2: Install the ESU Key

On the target Windows 10 device, open an elevated Command Prompt (Run as Administrator) and use the Software Licensing Management tool (slmgr.vbs).