How to Enable Free Windows 10 Extended Security Updates (ESU)

To enable Windows 10 Extended Security Updates (ESU) for free, create a Microsoft account user on your PC, add two registry values under a new ConsumerESU key, then enroll through Settings > Update & Security. This gives you free security updates until October 13, 2026 — no payment required if you use the sync settings or Microsoft Rewards option.

Applies to: Windows 10 (22H2) — Home, Professional, Pro Education, Workstation | Last updated: April 1, 2026

Key Takeaways

• ESU extends Windows 10 security updates until October 13, 2026 — one additional year of critical patches beyond the original end-of-support date
• Three enrollment options exist: sync your PC settings with a Microsoft account (free), redeem 1,000 Microsoft Rewards points (free), or pay a one-time $30 fee
• European users face stricter requirements — you must stay signed in with your Microsoft account to keep ESU active, or pay $30 to use it with a local account
• The dual accounts method is the best approach — keep a local account for daily use and privacy while maintaining a Microsoft account solely for ESU enrollment

Quick Steps

1. Verify you are running Windows 10 version 22H2 via Settings > Update & Security > About
2. Create a new Microsoft account user via Settings > Accounts > Family & other users > Add someone else to this PC
3. Change the new account type to Administrator
4. Sign into the Microsoft account user from the Start menu
5. Create registry entries under HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\ConsumerESU with ESUEligibility = 2 and ESUEligibilityResult = 1
6. Enroll in ESU via Settings > Update & Security and click Enroll Now
7. Switch back to your local account for daily use

---

Requirements

• Windows 10 version 22H2 — ESU is not available on older versions
• Latest cumulative updates installed — run Windows Update before attempting enrollment
• A Microsoft account — required for the free enrollment options
• Administrator access — you need admin privileges for the registry modifications
• Not a kiosk or domain-joined device — consumer ESU is for personal PCs only; enterprise devices use a separate enrollment path

Understanding ESU Pricing: US vs Europe

Microsoft offers different ESU enrollment options depending on your region, and the differences matter — especially if you prefer using a local account.

In the United States, you have three options. The first is to sync your PC settings with your Microsoft account, which is completely free. The second is to redeem 1,000 Microsoft Rewards points, also free if you have the points. The third is a one-time $30 payment. The free options require your Microsoft account to remain signed in and syncing.

In Europe, the requirements are stricter. You must stay signed in with your Microsoft account to maintain ESU eligibility. If you want to use ESU with a local account, you need to pay the $30 fee. There is no way around this in the EU — the free sync option still requires an active Microsoft account sign-in.

Important: Microsoft requires you to sign in with your Microsoft account at least once every 60 days to keep ESU active. If you go longer than 60 days without signing in, your device will stop receiving ESU updates until you sign in again.

The Best Solution: Using Dual Accounts

If you value your privacy and prefer not to have Microsoft syncing your data, the dual accounts method is the way to go. The idea is simple: keep your local account as your primary daily-use account, and create a separate Microsoft account user solely for ESU enrollment.

Your local account stays completely untouched — no data syncing, no Microsoft telemetry tied to your daily workflow. The Microsoft account just needs to exist on the machine and be signed into periodically (at least once a month is a safe habit) to keep the ESU enrollment active.

All your files, settings, and applications on the local account remain private. The Microsoft account user is just a shell — you sign in, let it verify your ESU eligibility, and switch right back. This is the approach I recommend for anyone who does not want to convert their main account to a Microsoft account.

How to Enable ESU Step by Step

Step 1: Verify Your Windows 10 Version

Open Settings > Update & Security > About (or press Win + I and navigate there). Under Windows specifications, confirm you are running version 22H2. If you are on an older version, you need to update first — ESU enrollment is only available on 22H2.

While you are here, also run Settings > Update & Security > Windows Update and install any pending updates. Microsoft requires the latest cumulative update before ESU enrollment will appear.

Step 2: Create a Microsoft Account User

Go to Settings > Accounts > Family & other users and click Add someone else to this PC. Sign in with an existing Microsoft account (Outlook, Hotmail, or Live email), or create a new one during the setup process. This creates a separate user profile on your PC linked to that Microsoft account.

Step 3: Change the Account to Administrator

Still in Settings > Accounts > Family & other users, click on the Microsoft account you just added and select Change account type. Set it to Administrator. This is required because the registry modifications in the next steps need admin privileges, and those changes are made under the Microsoft account user profile.

Step 4: Sign Into the Microsoft Account

Click the Start button, then click your account icon (your profile picture or initials) at the bottom left of the Start menu. Select the Microsoft account user you just created. Windows will switch to that user and set up the profile on first sign-in — this may take a minute.

Step 5: Add Registry Entries for ESU

While signed into the Microsoft account, open Registry Editor by pressing Win + R, typing regedit, and pressing Enter. Navigate to the following path:

HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows

Right-click on the Windows key in the left panel, select New > Key, and name it ConsumerESU. Inside the new ConsumerESU key, create two DWORD (32-bit) values:

• ESUEligibility — set the value data to 2
• ESUEligibilityResult — set the value data to 1

If you prefer using the command line, open Command Prompt as Administrator and run these two commands:

reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\ConsumerESU" /v ESUEligibility /t REG_DWORD /d 2 /f

reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\ConsumerESU" /v ESUEligibilityResult /t REG_DWORD /d 1 /f

Tip: These registry entries must be created while signed into the Microsoft account user — not your local account. The HKEY_CURRENT_USER hive is specific to whichever user is currently signed in.

Step 6: Enroll in Extended Security Updates

Open Settings > Update & Security. You should now see an option to enroll in Extended Security Updates. Click Enroll Now and confirm. If the enrollment option does not appear, restart the PC and check again — sometimes a reboot is needed after the registry changes.

Once enrollment is successful, you will see a confirmation message with the ESU expiration date of October 13, 2026.

Step 7: Switch Back to Your Local Account

Now that ESU is enrolled, sign out of the Microsoft account and switch back to your local account. Click the Start button, click your account icon, and select your local account. You are done — ESU is active on the machine, and your daily-use local account remains unchanged.

Remember to sign into the Microsoft account at least once a month to keep ESU active. A quick sign-in and sign-out is all it takes.

How to Check for ESU Updates

After enrollment, ESU security updates are delivered through the normal Windows Update channel. Go to Settings > Update & Security > Windows Update and click Check for updates. ESU patches appear as regular cumulative updates — there is no separate download or update mechanism.

You do not need to be signed into the Microsoft account to receive the updates. As long as ESU enrollment is active on the machine, updates will install under any user account including your local account.

Alternative: Upgrade to Windows 11

If you would rather move on from Windows 10 entirely, upgrading to Windows 11 is the long-term solution. ESU only buys you one year — after October 2026, you are back to receiving no security updates. Windows 11 will continue receiving updates for years to come.

I have a full guide on how to upgrade from Windows 10 to Windows 11 using the Update Assistant. If your hardware does not officially meet the Windows 11 requirements, you can still upgrade using Flyby11 to bypass Windows 11 hardware requirements.

Once you are on Windows 11, consider locking your Windows version if you want to stay on a specific release and avoid forced feature updates. And if you want to clean up and optimize your Windows 11 installation, Winhance is my go-to tool for that — I built it specifically for debloating and customizing Windows.

Frequently Asked Questions

How long will Windows 10 ESU last?

Windows 10 Extended Security Updates run for exactly one year, from October 14, 2025 to October 13, 2026. There is no option to extend beyond that date. After October 2026, Windows 10 will receive no further security updates from Microsoft.

Do I need to stay signed in with my Microsoft account?

It depends on your region and enrollment method. In the US, you need to either keep your settings synced with a Microsoft account or have redeemed Rewards points. In Europe, you must stay signed in with your Microsoft account. With the dual account method, signing into the Microsoft account user once a month is enough. If you stop signing in entirely, updates will stop after approximately 60 days.

Can I use the same Microsoft account on multiple PCs?

Yes. You can use the same Microsoft account to enroll multiple Windows 10 PCs in ESU. Each PC needs its own registry entries and enrollment, but the same account works across all of them.

What happens after ESU expires in October 2026?

After October 13, 2026, Windows 10 will no longer receive any security updates. Your PC will still work, but it will become increasingly vulnerable to new threats. At that point, your best option is to upgrade to Windows 11 or accept the security risk of running an unpatched operating system.

Does ESU include feature updates?

No. ESU only includes security patches and critical updates. You will not receive new features, UI changes, or non-security improvements. Windows 10 22H2 is the final feature update — ESU simply extends the security support for that version.