Windows 10 Extended Security Updates: The Real Deadlines

Free Windows 10 ESU Enrollment: Terms and Exclusions

Windows 10’s consumer support ended October 14th 2025, but Microsoft’s free Windows 10 Extended Security Updates enrollment now runs through Oct. 12, 2027 — a full year later than the program’s original October 2026 cutoff.

For IT and procurement teams, the practical question isn’t whether ESU exists — it does — but which of several separate coverage tracks a given device actually qualifies for, since eligibility, activation mechanics, and cost model differ by edition rather than following one unified Windows 10 policy.

Quick take

Free consumer ESU enrollment now covers eligible Windows 10 PCs through Oct. 12, 2027, activated with a Microsoft account.

Enterprise and Education editions are excluded from the free consumer program and must go through volume licensing instead.

Windows 10 Enterprise LTSC 2021 runs on its own clock, reaching end of support on Jan 12, 2027.

The free program replaced what was originally announced as a $30 consumer ESU fee for most eligible PCs, before Microsoft extended and broadened the enrollment terms.

Eligibility is narrower than “any Windows 10 PC.” The free path covers version 22H2 Home, Professional, Pro Education, and Workstation editions with the latest cumulative update installed — Enterprise and Education editions do not qualify.

Devices joined to Active Directory, Microsoft Entra ID, or managed through Intune are excluded from the free consumer program entirely, which pushes managed fleets back toward commercial ESU or LTSC licensing.

One Microsoft account can extend free ESU eligibility to as many as 10 PCs, and coverage persists on a device even after the account used for enrollment is swapped for a local sign-in.

Enrollment terms also vary by region. Customers in any of the 30 EEA countries qualify automatically, while other regions may face additional Microsoft-account requirements.

Enterprise Windows 10 Extended Security Updates Run on Separate Clocks

Enterprise fleets don’t get the free consumer path, and the underlying support dates diverge by edition. Windows 10 Enterprise LTSC 2021 reaches end of support on Jan 12, 2027, while Windows 10 IoT Enterprise LTSC 2021 continues until Jan 13, 2032.

LTSB 2016 has separate, older ESU mechanics. Microsoft’s own instructions require the May 2026 servicing stack update KB5088064 and the May 2026 security update KB5087537, or later, installed before an ESU key will activate, ahead of the LTSB 2016 support boundary at October 13, 2026.

Activation runs through slmgr.vbs with a Multiple Activation Key pulled from the Microsoft 365 admin center, followed by an ESU Activation ID specific to each coverage year — Year1, Year2, or Year3.

That MAK and Activation ID workflow is a volume-licensing process, not a consumer toggle: it requires a Product Key Reader or VL Administrator role in Microsoft Entra ID, plus outbound access to Microsoft’s activation endpoints.

Outside official channels, community documentation from the MAS project describes an activation utility called TSforge used to enroll in what it labels a “Commercial ESU Program” spanning Oct 2025 to Oct 2028 — an unofficial, third-party activation path rather than a Microsoft-published enrollment channel.

What the Windows Server 2016 ESU Deadline Shows About Pricing

A useful cost reference sits just outside the Windows 10 story. Windows Server 2016 leaves extended support on January 12, 2027, and Microsoft’s published ESU program for it covers up to 3 more years of security-only patches, running to January 2030.

Independent guidance on that deadline frames each Server 2016 ESU year as costing the full Windows Server license price again, with no new features or bug fixes included — a cost structure enterprise Windows 10 buyers should expect under comparable volume-licensing ESU terms rather than assuming free consumer pricing.

The same guidance frames hardware age as part of the decision: moving to a currently supported server OS on refurbished but validated hardware was estimated at 50–70% below new-hardware pricing, a tradeoff with no consumer-PC equivalent but a useful illustration of how ESU costs compound against aging infrastructure.

Choosing a Path and What to Verify First

Choose free consumer ESU when the fleet is Home, Pro, Pro Education, or Workstation edition, is not domain- or Entra ID-joined, and can tolerate a Microsoft-account dependency through Oct. 12, 2027.

Choose commercial ESU or an LTSC edition when devices are domain-joined, Enterprise-licensed, or need coverage past 2027 — but confirm the KB and role prerequisites before assuming a purchased ESU key will actually activate.

Before enrolling any fleet, verify three things directly against Microsoft’s own documentation rather than a summary: the exact servicing-stack and cumulative-update KB numbers required for the specific edition in use, whether target devices are domain- or Entra ID-joined, since that disqualifies free consumer ESU, and the actual per-year ESU renewal cost quoted under the applicable licensing agreement.