What the Windows 10 ESU Program Means for Your Devices After Support Ends

Windows 10 official support ended for many versions in 2023, meaning those devices no longer receive regular security updates from Microsoft. To help organizations keep these devices secure while planning upgrades, Microsoft offers the Extended Security Updates (ESU) program. ESU provides critical security patches for certain Windows 10 Enterprise and Education editions beyond their support end dates, but it requires enrollment, incurs costs, and only lasts for a limited time. Understanding which devices qualify, how to enroll, what protections ESU offers, and when you must upgrade is essential for keeping your endpoints secure.

What exactly is the Windows 10 ESU program and who needs it?

The Extended Security Updates (ESU) program lets organizations continue receiving important security patches for Windows 10 devices that have reached the end of their official support lifecycle. It targets Windows 10 Enterprise and Education editions specifically for versions 1607 (Anniversary Update), 1703 (Creators Update), and 1709 (Fall Creators Update). These versions are common in business and education environments where upgrading all devices at once can be difficult. Consumer editions like Home and Pro, as well as later Windows 10 versions, do not qualify. ESU is designed as a short-term measure to protect devices from serious vulnerabilities while you plan and implement upgrades to supported versions or Windows 11.

How do I know if my devices qualify for ESU and how do I enroll?

To determine if your devices qualify, check the exact Windows 10 edition and version using the “winver” command or your management tools. Only Enterprise and Education editions of versions 1607, 1703, and 1709 are eligible. After confirming eligibility, you must purchase ESU licenses annually for each device through Microsoft Volume Licensing or a cloud solution provider. The cost typically increases each year you extend support. Once purchased, activate ESU by deploying the correct product key and installing the latest servicing stack updates and security patches via Windows Update or WSUS. Skipping any step can prevent devices from receiving ESU updates. Also, ensure your devices have valid Windows licenses, as ESU does not cover unlicensed systems.

What kind of updates and protections does ESU actually provide?

ESU delivers security updates that address Microsoft’s critical and important vulnerabilities, focusing on protecting devices from exploits that could allow malware infections, data breaches, or system compromises. It does not include feature updates, non-security bug fixes, or performance improvements. For example, if a zero-day vulnerability is discovered in Windows 10 version 1607, Microsoft may release a patch through ESU; without ESU, that patch would not be available. ESU updates are cumulative and prioritize fixes for active threats, so you may not receive every minor security patch but will get the major ones needed to reduce risk. In short, ESU acts as a security safety net, not a substitute for ongoing feature support or upgrades.

How long will ESU keep my Windows 10 devices protected?

The ESU program extends security update support up to three years beyond each version’s original end-of-support date. For example, since support for Windows 10 version 1607 ended in May 2023, ESU updates are available through May 2026 for that version. The exact timeline varies by version but generally covers a three-year extension. ESU is temporary and non-renewable beyond this period. Microsoft expects organizations to upgrade devices to supported Windows 10 versions or Windows 11 before ESU expires. Continuing to rely on ESU after its final year leaves devices vulnerable due to lack of security patches, which can lead to compliance and operational risks.

What mistakes do people often make when relying on ESU?

Common mistakes include assuming ESU covers all updates, including feature or quality improvements—it only provides security patches. Missing enrollment deadlines or incorrect activation of ESU keys can prevent devices from receiving updates altogether. Some IT teams underestimate or overlook the licensing costs, expecting ESU to be free or included with existing licenses. Treating ESU as a long-term solution instead of a temporary bridge delays necessary upgrades and increases risk. Additionally, some administrators forget ESU applies only to specific Windows 10 versions and editions; devices outside these parameters won’t receive coverage regardless of enrollment attempts. Being aware of these limitations helps avoid gaps in security and wasted effort.

What should I do now to manage Windows 10 devices with or without ESU?

If your devices qualify for ESU and you can’t upgrade immediately, purchase and activate ESU licenses to maintain security coverage. At the same time, develop a clear upgrade plan to move devices to supported Windows 10 versions or Windows 11. Weigh the cost of ESU licenses against upgrade efforts—ESU is a useful short-term expense but not a permanent fix. For devices that don’t qualify or if you decide against paying for ESU, prioritize upgrading or replacing them quickly to avoid security gaps. Consider segmenting your environment so critical devices remain protected with ESU while you phase out others. Keep your update management tools current and monitor patch compliance closely. Communicate with stakeholders about the risks and timelines, making clear that ESU is a temporary bridge, not a final solution.

Conclusion

Start by identifying which Windows 10 devices still need protection beyond official support and verify their ESU eligibility. If they qualify, enroll and activate ESU to continue receiving essential security updates in the short term. Don’t assume ESU covers all updates or lasts indefinitely—it’s a limited, paid extension. Use the extra time ESU provides to plan and execute upgrades, balancing security, cost, and operational needs. Devices without ESU or outside its scope should be prioritized for upgrade or replacement to maintain your organization’s security posture. The goal is to avoid security gaps and complete your transition off unsupported Windows 10 versions before ESU ends.

Frequently Asked Questions

Can I get Windows 10 ESU for Home or Pro editions?

No. ESU is only available for Windows 10 Enterprise and Education editions of specific versions. Home and Pro editions are not eligible, so devices running those must be upgraded to supported versions or Windows 11 to stay secure.

How much does the Windows 10 ESU program cost?

Costs vary depending on your volume licensing agreements and usually increase each year you extend support. Pricing depends on the number of devices and your licensing channel. Check with your Microsoft reseller or volume licensing partner for exact pricing.

Does ESU include feature updates or just security patches?

ESU provides only security updates for critical and important vulnerabilities. It does not include feature updates, non-security bug fixes, or new functionality. Its purpose is to keep devices secure, not to add features.

What happens if I miss the ESU enrollment deadline?

Missing the enrollment window or failing to activate ESU keys correctly means your devices won’t receive extended security updates after standard support ends. This leaves them vulnerable to new threats, so timely enrollment and activation are essential for continued protection.

When do I need to upgrade from Windows 10 if I’m using ESU?

You should upgrade before your ESU coverage expires, which is usually up to three years after your Windows 10 version’s original support end date. ESU isn’t renewable beyond that, so treat it as a temporary solution while you transition to supported versions or Windows 11.