How to Activate Windows 10 Extended Security Updates (ESU) Licenses: Complete 2026 Guide

Windows 10 support officially ended on October 14, 2025. If you haven't upgraded to Windows 11 yet, your devices are no longer receiving security updates -unless you've enrolled in Microsoft's Extended Security Updates (ESU) program.

This guide walks you through every ESU activation scenario: consumer enrollment, enterprise volume licensing, Intune deployment, and special cases like Windows 365 and Azure Virtual Desktop.

What Are Windows 10 Extended Security Updates?

The ESU program allows Windows 10 devices to continue receiving critical and important security updates after the end of support date. Here's what you need to know:

What ESU includes:

• Critical security updates (as defined by Microsoft Security Response Center)
• Important security updates
• Coverage through October 13, 2026 (consumers) or up to 3 years (enterprise)

What ESU does NOT include:

• Feature updates
• Non-security bug fixes
• Technical support from Microsoft
• New functionality

Prerequisites for all ESU scenarios:

• Windows 10, version 22H2
• Latest cumulative updates installed (KB5046613 or later recommended)
• For consumers: Microsoft account with admin privileges
• For enterprise: Volume licensing agreement

---

Part 1: Consumer ESU Activation

Consumer ESU is available for Windows 10 Home, Pro, Pro Education, and Workstations editions. Microsoft offers three enrollment methods.

Method 1: Free Enrollment via PC Settings Backup

This is the simplest option if you're willing to sync your Windows settings to a Microsoft account.

Step 1: Verify your Windows version

• Press Win + R, type winver, press Enter
• Confirm you're running Windows 10, version 22H2

Step 2: Install all pending updates

• Go to Settings > Update & Security > Windows Update
• Click Check for updates and install everything
• Restart your PC

Step 3: Sign in with a Microsoft account

• Go to Settings > Accounts > Your info
• If using a local account, click Sign in with a Microsoft account instead
• Complete the sign-in process

Step 4: Enable Windows backup

• Go to Settings > Accounts > Windows backup
• Toggle on Remember my apps and Remember my preferences
• Your settings will sync to OneDrive

Step 5: Enroll in ESU

• Go to Settings > Update & Security > Windows Update
• Look for the ESU enrollment link
• Select Enroll now
• Choose the free backup option
• Complete enrollment

Your device is now enrolled and will receive security updates through October 13, 2026.

Method 2: Microsoft Rewards Points (Free)

If you have 1,000 Microsoft Rewards points, you can redeem them for ESU enrollment.

Step 1: Complete Steps 1-3 from Method 1

Step 2: Navigate to ESU enrollment

• Go to Settings > Update & Security > Windows Update
• Click the ESU enrollment link

Step 3: Choose Rewards redemption

• Select the Microsoft Rewards option
• Sign in to your Microsoft account if prompted
• Confirm you have 1,000+ points available
• Click Redeem to activate ESU

Method 3: One-Time Purchase ($30 USD)

For users who don't want to enable settings backup or don't have Rewards points.

Step 1: Complete Steps 1-3 from Method 1

Step 2: Navigate to ESU enrollment

• Go to Settings > Update & Security > Windows Update
• Click the ESU enrollment link

Step 3: Complete purchase

• Select the paid option
• Enter payment information
• Complete the $30 transaction
• Your license covers up to 10 devices on your Microsoft account

Troubleshooting Consumer Enrollment

ESU enrollment link not appearing?

Try these fixes in order:

1. Install all updates including optional updates, then restart

2. Ensure you're signed in as admin with a Microsoft account

3. Enable DiagTrack service:

sc config DiagTrack start=auto
sc start DiagTrack

4. Add registry override (elevated Command Prompt):

reg.exe add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 4011992206 /t REG_DWORD /d 1 /f

5. Restart and check Windows Update again

If enrollment fails with a server error, wait a few hours and retry - Microsoft experienced high demand during initial rollout.

---

Part 2: Enterprise ESU Activation (Volume Licensing)

Organizations using volume licensing must purchase ESU licenses and deploy Multiple Activation Keys (MAK) to eligible devices.

Pricing Structure

Year	Price per Device	Coverage Period
Year 1	$61 USD	Nov 2025 - Oct 2026
Year 2	$122 USD	Nov 2026 - Oct 2027
Year 3	$244 USD	Nov 2027 - Oct 2028

Note: ESU is cumulative. If you purchase Year 2, you must also pay for Year 1.

Step 1: Purchase ESU Licenses

1. Contact your Microsoft licensing partner or use the Volume Licensing Service Center
2. Purchase "Windows 10 ESU Year 1 (2025-2026)" for each device
3. Licenses will appear in your Microsoft 365 admin center

Step 2: Locate Your MAK Key

1. Sign in to the Microsoft 365 admin center
2. Go to Billing > Your Products
3. Select the Volume licensing tab
4. Find your License ID and select View contracts
5. Click the three dots (More actions) > View product keys
6. Copy your ESU MAK key

Required role: Product Key Reader or VL Administrator in Microsoft Entra ID.

Step 3: Install Prerequisites

Before activating ESU, devices must have:

• Windows 10, version 22H2
• KB5066791 (October 2025 cumulative update) or later
• KB5072653 (ESU Licensing Preparation Package)

Deploy these updates via WSUS, Intune, or your preferred method before proceeding.

Step 4: Install the ESU Key

Open an elevated Command Prompt on each device and run:

slmgr.vbs /ipk <ESU-MAK-KEY>

Replace <ESU-MAK-KEY> with your actual MAK from the admin center.

You should see: "Product key installed successfully."

Step 5: Activate the ESU Key

Run the activation command using the appropriate Activation ID:

Windows 10 ESU Year 1 Activation ID:

d5c2d138-9f26-4e4f-8ac7-b9f0e67e48d6

Windows 10 ESU Year 2 Activation ID:

be8a2f68-f40c-4e52-bf14-0c9d166995b1

Windows 10 ESU Year 3 Activation ID:

83d49986-add3-41d7-ba33-87c7bfb5c0fb

Run the activation command:

slmgr.vbs /ato d5c2d138-9f26-4e4f-8ac7-b9f0e67e48d6

You should see: "Product activated successfully."

Step 6: Verify Activation

Check the activation status:

slmgr.vbs /dlv

Look for:

• Name: Windows 10 Extended Security Updates-Year 1
• License Status: Licensed

Phone Activation (Offline Devices)

For devices without internet access:

1. Install the key: slmgr.vbs /ipk <ESU-MAK-KEY>

2. Get the Installation ID:

slmgr.vbs /dti d5c2d138-9f26-4e4f-8ac7-b9f0e67e48d6

3. Call the Microsoft Activation Center (number displayed)
4. Provide the Installation ID to the automated system
5. Enter the Confirmation ID you receive:

slmgr.vbs /atp <Confirmation-ID> d5c2d138-9f26-4e4f-8ac7-b9f0e67e48d6

---

Part 3: ESU Deployment with Microsoft Intune

For organizations managing devices through Intune, you can automate ESU activation across your fleet.

Create a PowerShell Script

Save this as Activate-ESU.ps1:

# Windows 10 ESU Activation Script
# Replace with your actual MAK key
$ESUKey = "XXXXX-XXXXX-XXXXX-XXXXX-XXXXX"
$ActivationID = "d5c2d138-9f26-4e4f-8ac7-b9f0e67e48d6"

# Install the ESU key
$InstallResult = cscript //nologo "$env:SystemRoot\System32\slmgr.vbs" /ipk $ESUKey
Write-Output "Key Installation: $InstallResult"

# Activate the ESU key
$ActivateResult = cscript //nologo "$env:SystemRoot\System32\slmgr.vbs" /ato $ActivationID
Write-Output "Activation: $ActivateResult"

# Verify activation
$Status = cscript //nologo "$env:SystemRoot\System32\slmgr.vbs" /dlv
Write-Output "Status: $Status"

Deploy via Intune

1. Go to Microsoft Intune admin center
2. Navigate to Devices > Scripts and remediations > Platform scripts
3. Click Add > Windows 10 and later
4. Upload your PowerShell script
5. Configure:
   • Run this script using the logged-on credentials: No
   • Enforce script signature check: No
   • Run script in 64-bit PowerShell host: Yes
6. Assign to your Windows 10 device group
7. Monitor deployment in Device status

Verification via Intune

Create a detection script to verify ESU activation:

# ESU Detection Script
$ESUKey = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform"
$ESUStatus = Get-ItemProperty -Path $ESUKey -Name "ESU" -ErrorAction SilentlyContinue

if ($ESUStatus) {
    Write-Output "ESU Enrolled"
    exit 0
} else {
    Write-Output "ESU Not Enrolled"
    exit 1
}

---

Part 4: Windows 365 and Azure Virtual Desktop ESU

Good news: If you use Windows 365 or Azure Virtual Desktop, ESU may be included at no additional cost.

Windows 365 Cloud PCs

Automatic ESU for Cloud PCs:

• Windows 10 Cloud PCs running version 22H2 are automatically eligible
• No additional license purchase required
• ESU is included with your Windows 365 subscription

ESU for Physical Devices Connecting to Windows 365:

Physical Windows 10 devices that connect to Windows 365 Cloud PCs can receive ESU for free, but require configuration:

1. Enable ESU check via Intune:

   • Create a custom configuration profile
   • OMA-URI: ./Device/Vendor/MSFT/Policy/Config/Update/EnableESUSubscriptionCheck
   • Data type: Integer
   • Value: 1

2. User requirements:

   • Must have an active Windows 365 Enterprise license
   • Must sign in to the physical device with their Microsoft Entra ID
   • Must sign in at least once every 22 days to maintain eligibility

3. Verify enrollment: Check registry key:

   HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\ESU
   Win10CommercialW365ESUEligible = 1
   

Azure Virtual Desktop (AVD)

Automatic ESU for AVD VMs:

• Windows 10 multi-session and single-session VMs are automatically eligible
• No additional license or activation required
• Applies to commercial, government, and education tenants

Important dates for AVD:

• Windows 10 with M365 Apps image: Removed from Marketplace April 14, 2026
• Windows 10 without M365 Apps image: Available until 2028

---

Part 5: Verification and Monitoring

Verify ESU Status (Individual Device)

Command Prompt:

slmgr.vbs /dlv

Look for:

• Name: Windows 10 Extended Security Updates-Year 1
• License Status: Licensed

Registry check:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\ESU
EnableESUSubscriptionCheck = 1

Event Viewer:

• Path: Applications and Services Logs > Microsoft > Windows > ClipESU
• Event ID 113: ESU license successfully installed

Monitor Fleet-Wide ESU Status

PowerShell script for reporting:

# Get ESU status across devices
$Computers = Get-ADComputer -Filter {OperatingSystem -like "*Windows 10*"} | Select -ExpandProperty Name

$Results = foreach ($Computer in $Computers) {
    try {
        $ESUStatus = Invoke-Command -ComputerName $Computer -ScriptBlock {
            $Status = cscript //nologo "$env:SystemRoot\System32\slmgr.vbs" /dlv | Select-String "Extended Security"
            if ($Status) { "Licensed" } else { "Not Licensed" }
        } -ErrorAction Stop
        
        [PSCustomObject]@{
            ComputerName = $Computer
            ESUStatus = $ESUStatus
            CheckDate = Get-Date
        }
    } catch {
        [PSCustomObject]@{
            ComputerName = $Computer
            ESUStatus = "Error: $($_.Exception.Message)"
            CheckDate = Get-Date
        }
    }
}

$Results | Export-Csv -Path "ESU_Status_Report.csv" -NoTypeInformation

---

Timeline and Recommendations

Date	Event	Action Required
October 14, 2025	Windows 10 EOS	ESU enrollment begins
October 13, 2026	Consumer ESU ends	Upgrade to Windows 11
October 2027	Enterprise Year 2 ends	Continue or upgrade
October 2028	Enterprise Year 3 ends	Must upgrade

Best Practices

1. Inventory first - Know exactly how many Windows 10 devices need ESU
2. Plan migration - Use ESU as a bridge, not a destination
3. Test activation - Pilot ESU deployment on a small group first
4. Document everything - Track MAK usage and activation status
5. Budget accordingly - Remember enterprise pricing doubles each year