Windows 10 after October 2026: consumer and organisational ESU coverage

What it is

Status as of 25 October 2026: Microsoft's consumer ESU page says eligible Windows 10 devices can receive extended security updates through 12 October 2027, with coverage continuing automatically for devices already enrolled. Re-check that page's prerequisites and local enrolment terms, plus the separate commercial activation guidance, before relying on coverage. Consumer programme.

Regular Windows 10 support ended on 14 October 2025. Organisational ESU provides a separate, annual security-update arrangement, with a maximum of three years after that date. This article concerns version 22H2; establish the specific lifecycle separately for LTSC, LTSB and specialised editions. Organisational programme.

Why it matters

A support deadline, eligibility for ESU, successful activation and receipt of updates are separate inventory facts. Microsoft's commercial lifecycle table gives year-end dates of 13 October 2026, 12 October 2027 and 10 October 2028. That final date must not be applied to consumer devices. Commercial ESU is purchased by year, and joining in a later year requires the earlier years too. Commercial dates.

Use the following checks as a proposed operational workflow. Keep a migration owner and destination for every retained device even when its present ESU status is satisfactory.

How to apply

• Record edition, version, asset owner, management status and update history using the existing endpoint inventory. Separate personal devices from organisational assets before selecting an enrolment process. Preserve evidence of the applicable programme and its end date alongside the machine record.
• For consumer eligibility, Microsoft's page lists version 22H2 Home, Professional, Pro Education and Workstations editions. It requires current updates, its named ESU Licensing Preparation Package, and an administrator Microsoft account that is not a child account. Follow the page's current prerequisites and Settings > Update & Security > Windows Update enrolment workflow.
• Check the exclusions: consumer ESU is unavailable for commercial scenarios, kiosk mode, domain-joined devices, Microsoft Entra joined devices and MDM enrolment. Microsoft distinguishes Entra registration, which can be eligible. Do not remove business management controls merely to make a device appear eligible.
• For commercially licensed physical devices, follow the activation guide. It lists version 22H2 with KB5066791 or a later update, then preparation package KB5072653, and administrator privileges. Use the authorised licence and programme-year activation identifier from the current instructions; keep licence keys out of tickets and article examples. Activation prerequisites.
• Inspect licensing with slmgr.vbs /dlv all from an elevated command prompt. Microsoft's command reference documents all for installed products; check the corresponding ESU programme and year for Licensed, rather than accepting the ordinary Windows licence as ESU evidence. Then verify installation of the applicable security update through the device's update-management process. Licence inspection.
• Reassess after ownership, account or management changes, and after yearly commercial renewal. Schedule the replacement deployment and verify application compatibility, accessibility needs and restoration of user data before retiring the old device.

Pitfalls

ESU does not restore feature development or general product support. A subscription record alone is insufficient evidence that a particular endpoint receives updates. Keep failed installations and missing inventory visible until resolved, and distinguish consumer enrolment from the commercial activation procedure. These checks do not establish that a machine was uncompromised before enrolment.