How to Activate Windows 10 ESU (Extended Security Updates): Complete Enrollment Guide
Windows 10 hit end of support on October 14, 2025. This guide walks through every ESU activation path: consumer enrollment, commercial MAK activation with slmgr, and Intune deployment, so your devices keep getting security updates.
- Difficulty
- Intermediate
- Time required
- 15-30 minutes
- Steps
- 6
- Platform
- Windows 10 Extended Security Updates (ESU)
- Version
- Windows 10, version 22H2
- Last tested
- July 12, 2026
Table of contents
Quick Answer
Go to the stepsConsumer: open Settings > Update & Security > Windows Update and select Enroll now, then pick a free or paid option. Commercial: get your MAK from the Microsoft 365 admin center, then on each device run slmgr.vbs /ipk to install the key and slmgr.vbs /ato with the ESU Activation ID to activate it.
- Confirm the device runs Windows 10 22H2 with the required updates installed.
- Consumer: Settings > Update & Security > Windows Update > Enroll now.
- Commercial: retrieve the ESU MAK from the Microsoft 365 admin center.
- Install the key: slmgr.vbs /ipk <ESU-MAK-KEY>.
- Activate: slmgr.vbs /ato <Activation-ID>, then verify with slmgr.vbs /dlv.
Settings > Update & Security > Windows Update > Enroll now (consumer)slmgr.vbs /ipk <ESU-MAK-KEY>
slmgr.vbs /ato <Activation-ID>Expected result: Windows Update shows Extended Security Updates as active (consumer), or slmgr.vbs /dlv reports License Status: Licensed for the ESU program (commercial).
Key takeaways
- How to enroll consumer Windows 10 PCs in ESU, how to activate commercial ESU MAK licenses with slmgr, and how to push activation across a fleet with Intune.
- Windows 10 stopped receiving free security updates on October 14, 2025. ESU is the only supported way to keep patching those devices while you migrate to Windows 11.
- Consumer devices enroll via Windows Update; commercial devices activate a MAK with slmgr /ipk then slmgr /ato, verified with slmgr /dlv.
Introduction
Windows 10 Extended Security Updates (ESU) is a paid program that delivers critical and important security updates for Windows 10, version 22H2 after end of support on October 14, 2025. It does not add features or general technical support. It keeps the door closed on new vulnerabilities.
There are two separate tracks, and they do not mix. Consumer ESU is for personal devices and is enabled through Windows Update with a Microsoft account. Commercial ESU is for organizations, uses volume licensing, and is activated per device with a Multiple Activation Key (MAK).
In June 2026 Microsoft quietly extended the consumer program by a year, so enrolled personal PCs now receive updates through October 12, 2027. Commercial customers can buy up to three years, with coverage escalating in price each year. This guide covers both tracks and the Intune path for fleets.
Who this is for: Home users on Windows 10, plus IT admins and MSPs managing commercial Windows 10 fleets that cannot move to Windows 11 yet.
Before you start
- Access
- For consumer enrollment you need a Microsoft account (not a child account) and internet access. For commercial activation you need local administrator rights on each device and an Entra ID account with the Product Key Reader or VL Administrator role to view the MAK.
- Required roles
- Local administrator (device-level, for slmgr commands)
- Product Key Reader or VL Administrator in Microsoft Entra ID (to read the MAK)
- Local administrator on each device (commercial MAK activation)
- Product Key Reader or VL Administrator in Microsoft Entra ID (to view the MAK)
- Required licenses
- Consumer ESU enrollment (free with settings sync, 1,000 Rewards points, or a one-time fee)
- Commercial Windows 10 ESU volume license, purchased per device and per year
- Windows 10 ESU (consumer enrollment, or commercial volume license per device)
- Environment
- Windows 10, version 22H2 (Home, Pro, Pro Education, or Enterprise as applicable). LTSB and LTSC releases have their own lifecycles and are not covered by this ESU program.
- Vendor
- Microsoft
- Tested environment
- Verified against Microsoft Learn ESU documentation, July 2026.
- Last tested
- Administrator permissions required
Paths and commands verified against Microsoft Learn, July 2026.
About 15 minutes for one device; longer for fleet deployment.
Warning: Consumer and commercial tracks are mutually exclusive
Devices joined to Active Directory or Microsoft Entra, or managed by MDM, are not eligible for consumer ESU. Use commercial ESU for managed devices. A device enrolled in consumer ESU has that enrollment suspended if it later joins a commercial scenario.
Note: Commercial ESU is cumulative and paid per year
If you buy Year 2 later, you must also pay for Year 1. Year One pricing started at 61 USD per device and roughly doubles each subsequent year, for up to three years.
1Confirm the device meets ESU prerequisites
Make sure the device is eligible before you try to activate anything.
Settings > System > About (or run winver)ESU only applies to Windows 10, version 22H2. Earlier feature updates are not eligible and must be updated to 22H2 first. Check your version with winver or in Settings.
Two updates must be present on commercial devices before MAK activation:
- KB5066791, the 2025-10 cumulative update for Windows 10 22H2 (or a later cumulative update).
- KB5072653, the ESU Licensing Preparation Package, installed after KB5066791.
Deploy these through Windows Update, WSUS, or Intune before you continue.
winverExpected result: The device reports Windows 10 version 22H2 and both required updates are installed.
2Enroll a personal PC through Windows Update (consumer)
Turn on ESU for a home device without volume licensing.
Settings > Update & Security > Windows Update > Enroll nowOn a personal device, ESU is enabled straight from Windows Update. Sign in with a Microsoft account first, because the license is tied to that account.
- Go to Settings > Update & Security > Windows Update.
- If the device is eligible, select Enroll now.
- Choose one of the three options: free if you sync your PC settings with Windows Backup, redeem 1,000 Microsoft Rewards points, or pay the one-time fee.
- Follow the prompts to finish enrollment.
One consumer license covers up to 10 devices tied to the same Microsoft account. On the extra devices, open the same Windows Update screen and select Enroll now or Add device.
Expected result: Windows Update shows the device is enrolled and will receive Extended Security Updates through October 12, 2027.
Note
Devices in kiosk mode, child accounts, and MDM-managed or domain-joined devices cannot use consumer ESU. Microsoft Entra registered (not joined) personal devices can.
3Retrieve the commercial ESU MAK from the Microsoft 365 admin center
Get the Multiple Activation Key you will install on managed devices.
Microsoft 365 admin center > Billing > Your Products > Volume licensing > View contractsAfter your organization purchases Windows 10 ESU in volume licensing, the MAK appears in the admin center. Your Entra ID account needs the Product Key Reader or VL Administrator role to see it.
- Sign in to the Microsoft 365 admin center at admin.microsoft.com.
- Go to Billing > Your Products and open the Volume licensing tab.
- Select View contracts.
- Find the License ID the ESU licenses sit under, select the three dots (More actions), then View product keys.
- Copy the MAK from the product keys details page.
The download button on that page is greyed out on purpose; there is no file to download, only a key.
Expected result: You have a valid ESU MAK (a 5x5 product key) copied for use on your devices.
Note
The MAK shown before the Windows 10 end-of-support date is not usable until the ESU coverage period begins. If you cannot find the key, contact Microsoft volume licensing support.
4Install and activate the MAK with slmgr (commercial)
Apply the ESU key on a managed device and activate the right year.
Run these from an elevated Command Prompt on each device. First install the key, then activate the correct ESU year using its Activation ID.
Install the key, replacing the placeholder with your MAK:
slmgr.vbs /ipk <ESU-MAK-KEY>
You should see a message that the product key installed successfully. Then activate with the Activation ID for the year you purchased:
- Year 1:
f520e45e-7413-4a34-a497-d2765967d094 - Year 2:
1043add5-23b1-4afb-9a0f-64343c8f3f8d - Year 3:
83d49986-add3-41d7-ba33-87c7bfb5c0fb
Activate online with:
slmgr.vbs /ato <Activation-ID>
The device needs to reach the internet and Microsoft activation servers. If it cannot, activate by phone with slmgr.vbs /atp <Confirmation-ID> <Activation-ID> using the Microsoft Licensing Activation Center.
slmgr.vbs /ipk <ESU-MAK-KEY>
slmgr.vbs /ato f520e45e-7413-4a34-a497-d2765967d094Expected result: Activation succeeds and Windows reports the ESU program as licensed for the chosen year.
Note
The Activation IDs are the same across all eligible Windows 10 ESU editions and all devices for a given program year.
5Verify ESU activation
Confirm the ESU license is actually licensed on the device.
Check the license state from an elevated Command Prompt, passing the same Activation ID you used:
slmgr.vbs /dlv <Activation-ID>
Read the output for the ESU program name and the License Status line. On a healthy device the status reads Licensed.
slmgr.vbs /dlv f520e45e-7413-4a34-a497-d2765967d094Expected result: The output shows the ESU program name and License Status: Licensed.
6Deploy activation across a fleet with Intune
Automate MAK activation on many devices instead of touching each one.
Microsoft Intune admin center > Devices > Scripts and remediationsFor managed fleets, wrap the slmgr commands in a script and push it with Intune rather than running them by hand. Microsoft Configuration Manager works the same way.
- In the Microsoft Intune admin center, go to Devices > Scripts and remediations (or the platform scripts area for Windows).
- Add a script that installs the key and activates the correct Activation ID, for example calling
cscript //nologo slmgr.vbs /ipk <ESU-MAK-KEY>thencscript //nologo slmgr.vbs /ato <Activation-ID>. - Assign it to the target device group and let it run.
For non-persistent VDI, remove the ESU key from the golden image with slmgr.vbs /upk before publishing, so pooled machines do not burn through your activation count.
cscript //nologo slmgr.vbs /ipk <ESU-MAK-KEY>
cscript //nologo slmgr.vbs /ato <Activation-ID>Expected result: The script reports success on assigned devices and slmgr /dlv confirms them as licensed.
Note
Windows 10 endpoints connecting to Windows 365 Cloud PCs and Azure-hosted Windows 10 VMs may get ESU at no extra cost under specific conditions, with no key needed.
How to confirm Windows 10 ESU is active
Confirm configuration
The check differs by track. On a consumer PC, the confirmation lives in the interface: Settings > Update & Security > Windows Update shows an Extended Security Updates status and keeps offering monthly security updates.
On a commercial device, the source of truth is slmgr. Running slmgr.vbs /dlv <Activation-ID> returns the ESU program name and a License Status of Licensed when activation worked. If it shows anything else, activation did not complete.
Normal result: Consumer: Windows Update lists Extended Security Updates and installs monthly patches. Commercial: slmgr /dlv reports License Status: Licensed.
Abnormal result: slmgr shows Unlicensed or Notification, or Windows Update still warns the device is out of support. That points to a missing prerequisite update, the wrong Activation ID, or a blocked connection to Microsoft activation servers.
Healthy commercial device
License Status: Licensed
slmgr /dlv output for the correct ESU program year.
Enrolled consumer device
Extended Security Updates: On
Status shown under Settings > Update & Security > Windows Update.
Troubleshooting
Windows Update says the device is no longer receiving security updates after activation
Note
Cause: A known cosmetic bug in the Windows Update interface after ESU activation.
This is a visual glitch, not a licensing failure. Checking for and installing updates still works. Confirm the real state with slmgr.vbs /dlv <Activation-ID>; a fix for the message ships in an ESU update after enrollment.
slmgr /ato fails to activate the ESU key
Warning
Cause: The device cannot reach Microsoft activation servers, or a prerequisite update is missing.
Confirm KB5066791 and KB5072653 are installed and the device is on 22H2. Check internet access to Microsoft activation servers. If the device is offline, activate by phone with slmgr.vbs /atp <Confirmation-ID> <Activation-ID>.
The Enroll now option does not appear in Windows Update
Warning
Cause: The device is not eligible for consumer ESU or does not meet prerequisites.
Verify the device runs 22H2 and is signed in with a Microsoft account. Domain-joined, Entra joined, or MDM-managed devices are excluded from consumer ESU and must use commercial ESU instead.
Cannot find the MAK in the Microsoft 365 admin center
Note
Cause: Missing role, or the coverage period has not started yet.
Confirm your Entra ID account has the Product Key Reader or VL Administrator role. Keys shown before the Windows 10 end-of-support date are not usable until the ESU period begins. Contact Microsoft volume licensing support if it is still missing.
Frequently asked questions
How long do Windows 10 ESU updates last?
Consumer ESU now runs through October 12, 2027 after Microsoft extended it in June 2026. Commercial ESU is sold per year for up to three years, so organizations can extend coverage into 2028.
How much does Windows 10 ESU cost?
Consumer enrollment can be free if you sync PC settings, or costs 1,000 Microsoft Rewards points or a one-time fee. Commercial Year One started at 61 USD per device and roughly doubles each following year.
Do I need to reinstall Windows to enroll in ESU?
No. ESU is a licensing add-on. Consumer devices enroll through Windows Update, and commercial devices activate a MAK with slmgr. Neither reinstalls Windows.
Can I use one ESU license on multiple devices?
A consumer ESU license covers up to 10 devices tied to the same Microsoft account. Commercial ESU is licensed per device, so you need one license for each machine you activate.
Are LTSC and LTSB editions covered by this ESU program?
No. Windows 10 Long Term Servicing releases have their own lifecycles and are not covered by the Windows 10 ESU program described here.
Does ESU include feature updates or technical support?
No. ESU delivers only critical and important security updates. It does not add features, bug fixes, or general technical support beyond the ESU activation itself.
Conclusion
Keeping Windows 10 patched after end of support comes down to picking the right ESU track. Personal PCs enroll through Settings > Update & Security > Windows Update with a Microsoft account and stay covered through October 2027. Managed fleets buy volume licenses, pull the MAK from the Microsoft 365 admin center, and activate each device with slmgr, or push the same commands through Intune.
Whichever path you take, ESU buys time. Treat the coverage window as your runway to move to Windows 11.
Consumer devices enroll via Windows Update; commercial devices activate a MAK with slmgr /ipk then slmgr /ato, verified with slmgr /dlv.
slmgr.vbs /ipk <ESU-MAK-KEY> then slmgr.vbs /ato <Activation-ID>Sources5
