Windows 10 Extended Security Updates: Pricing and How to Enrol

Windows 10 Extended Security Updates (ESU) is the paid way to keep receiving critical and important security updates for Windows 10 after support ended on October 14, 2025. Home users can enrol from the PC itself at no cost, with Microsoft Rewards points or for a one-time US$30. Organisations buy ESU through volume licensing at US$61 per device for the first year, with the price doubling each year for up to three years.

This guide is for small business owners, home users with older PCs, and part-time administrators. By the end you will know which program applies, what it costs, what must be in place before enrolling, and the exact steps to enrol and verify.

What ESU gives you and what it does not

ESU provides security updates Microsoft rates critical and important for Windows 10 devices enrolled in the program. It does not provide:

• New features.
• Customer-requested non-security updates.
• Design change requests.
• General technical support. Microsoft's ESU support covers licence activation, installation and possible regressions of the ESU itself, and organisations need an active support plan to get that help.

Windows 10 PCs keep working without ESU, but from October 14, 2025 Microsoft no longer provides technical support, feature updates or quality updates (including security and reliability fixes) for the version that reached end of support. ESU is a bridge. It does not make Windows 10 a supported long-term platform.

Which program applies to you

Note the line about managed devices. If your PCs are joined to a domain or Microsoft Entra ID, or enrolled in a mobile device management service such as Intune, they are not eligible for consumer ESU. Microsoft Entra registered devices are eligible. A small business with a few unmanaged PCs and a Microsoft account could use the consumer route, but a business that manages its PCs needs the commercial program.

Pricing in detail

Commercial

Microsoft's FAQ states that ESU for organisations can be purchased through the Microsoft Volume Licensing Program at US$61 per device for year one. The price doubles every consecutive year for a maximum of three years. Plan on the doubling when you budget; check the current price in your reseller's quote, because licensing programs and currencies differ.

Three rules matter:

• Sold by year. You cannot buy partial periods such as six months.
• Cumulative. If you decide to buy in year two, you must pay for year one too.
• Minimum. The minimum purchase is one licence.

ESU is free for Windows 10 virtual machines in Windows 365, Azure Virtual Desktop, Azure virtual machines, Azure Dedicated Host, Azure VMware Solution, Nutanix Cloud Clusters on Azure, Azure Local, Azure Stack Hub and Azure Stack Edge. Windows 10 endpoints that connect to Windows 365 Cloud PCs are entitled to ESU for up to three years with an active Windows 365 subscription licence.

Consumer

The three routes are free with Windows Backup settings sync, 1,000 Microsoft Rewards points, or a one-time purchase of US$30 (or the local equivalent, plus applicable tax). One licence covers up to 10 devices, and enrolled devices continue to receive updates automatically through October 12, 2027.

Prerequisites for commercial enrolment

On each device you need:

• Windows 10, version 22H2 with update KB5066791 or a later update installed.
• The ESU Licensing Preparation Package, KB5072653, installed after KB5066791.
• Administrator privileges.
• Network access to the activation endpoints Microsoft lists, including https://activation.sls.microsoft.com/, https://validation.sls.microsoft.com/ and the activation-v2 and validation-v2 equivalents, plus https://login.live.com, https://go.microsoft.com/ and the Microsoft Store licensing and purchase endpoints. Allow them through any proxy or firewall.

To see the activation key in the Microsoft 365 admin center, your Microsoft Entra account needs the Product Key Reader or VL Administrator role.

Steps for commercial enrolment

Step 1: Find the Multiple Activation Key (MAK)

1. Sign in to the Microsoft 365 admin center at https://admin.microsoft.com.
2. Go to Billing > Your Products and open the Volume licensing tab.
3. In the Contracts section, select View contracts.
4. Find the License ID that the ESU licences are under, select the three dots (More actions), then View product keys.

The product keys page lists every key for that contract. Microsoft notes that keys shown in the admin center were not usable until the Windows 10 end of support date, when the ESU coverage period began. If you cannot find your key, contact volume licensing support.

Step 2: Install the key

Open an elevated Command Prompt on the device and run:

slmgr.vbs /ipk <ESU MAK>

A Windows Script Host dialog confirms the product key was installed.

Step 3: Activate the correct ESU year

Each program year has its own activation ID. The IDs are the same across all eligible editions and all enrolled devices.

Activate with the ID for the year you bought:

slmgr.vbs /ato <Activation ID>

Because the program is cumulative, buying year two means paying for year one as well. Microsoft's article does not say whether a later year's activation also needs the earlier year's ID, so confirm with your reseller or volume licensing support which activation IDs your key requires.

Step 4: Verify

slmgr.vbs /dlv

The output shows the Name of the ESU program and a License Status of Licensed.

Activation by phone for devices without internet

If the device cannot reach the activation servers, install the key, then get an installation ID:

slmgr.vbs /dti <Activation ID>

Go to the Microsoft Product Activation portal at https://aka.ms/aoh from another computer, enter the installation ID and obtain a confirmation ID. The confirmation ID must not contain spaces. Then run:

slmgr.vbs /atp <Confirmation ID> <Activation ID>

For many offline devices, Microsoft points to proxy activation with the Volume Activation Management Tool (VAMT), which needs the latest Windows ADK plus a VAMT update that includes the Windows 10 ESU key configuration files. If a MAK runs out of activations, for example when you reimage machines, you can request an increase in MAK activation limits.

Steps for consumer enrolment

The consumer program has its own prerequisites: install the latest Windows update and the Windows 10 ESU Licensing Preparation Package KB5126256, and sign in with a Microsoft account that has administrator rights (not a child account). Then choose one of the three routes. Microsoft's consumer ESU page at https://www.microsoft.com/windows/extended-security-updates is the entry point; it covers each route and the steps shown on the PC. Because the on-screen wording can change, follow that page rather than a screenshot guide.

Troubleshooting

Closing checklist

• Decide consumer or commercial based on how the PC is managed.
• Confirm Windows 10 22H2 and install the prerequisite updates.
• For commercial, get the MAK, install it and activate the correct year, then verify with slmgr.vbs /dlv.
• Record each PC's coverage end date and its replacement plan.
• If a PC cannot run Windows 11, read Windows 11 on unsupported hardware; to find out whether it can, see Windows 11 hardware requirements.

References

• Extended Security Updates program for Windows 10: https://learn.microsoft.com/en-us/windows/whats-new/extended-security-updates
• Enable Windows 10 Extended Security Updates: https://learn.microsoft.com/en-us/windows/whats-new/enable-extended-security-updates
• Windows 10 Consumer Extended Security Updates program: https://www.microsoft.com/en-us/windows/extended-security-updates
• Windows 10 support has ended on October 14, 2025: https://support.microsoft.com/en-us/windows/windows-10-support-has-ended-on-october-14-2025-2ca8b313-1946-43d3-b55c-2b95b107f281