[image: A Windows 10 desktop showing the Settings Windows Update page with an “Enroll now” link visible under the Windows 10 support notice]
Windows 10 ESU is Microsoft’s paid extension that keeps security patches flowing to a PC after the operating system’s normal support window closed on 14 October 2025. It does not add features, it does not fix bugs, and it does not include phone support. It patches security holes, and nothing else. For most people reading this, the question is not what ESU does but whether they still need it, and how much longer the option stays open.
That last part matters right now. The consumer programme was sold as a single year. If you enrolled at launch, your coverage runs out in October 2026. If you have not enrolled at all, you have been running an unpatched machine for months and you should fix that this week.
Key takeaways
- ESU stands for Extended Security Updates. It delivers critical and important security patches only.
- Consumers get one year of coverage. Businesses can buy up to three, running to October 2028.
- There are free enrolment routes, and in the European Economic Area the consumer year was made free outright after regulatory pressure.
- Enrolment happens inside Settings, not on a website, and the option only appears once your PC meets a short list of prerequisites.
- ESU buys time. It is not a destination. The end state is Windows 11 or a supported alternative.
What Windows 10 ESU actually is
Every Microsoft operating system gets a published support lifecycle. During that window Microsoft ships feature updates, quality fixes, and security patches. When the window closes, all three stop. The machine keeps working, but every newly discovered vulnerability stays open forever.
Extended Security Updates exist to soften that cliff. Microsoft continues to build patches for the most serious flaws and delivers them only to devices that have been enrolled. Everything else stops. No new features, no driver work, no non-security bug fixes, no technical support beyond activation help.
Microsoft has run ESU programmes before, for Windows 7 and for several Windows Server releases. Those were aimed squarely at large organisations with volume licensing agreements. The Windows 10 round is the first time the company opened the door to ordinary home users, which is why so many people are encountering the term for the first time.
The distinction worth holding on to is this: ESU is a security floor, not a support contract. If an application breaks on your Windows 10 machine next month, ESU will not help you. If a critical remote code execution flaw is found in a core Windows component, ESU is the difference between getting the patch and not getting it.
What ESU does not cover
People are regularly surprised by the size of this list, so it is worth being blunt about it.
ESU does not cover Microsoft 365 apps. Office applications on Windows 10 have their own separate support timeline, and running the two together after both windows close is a compounding risk. ESU does not cover new hardware drivers, which is why a brand new printer or graphics card may simply refuse to work properly. It does not cover feature requests or performance improvements. It does not cover third-party software that decides to drop Windows 10 support, which many vendors have already started doing.
It also does not cover non-security bugs. If a Windows component develops a fault that is annoying but not exploitable, that fault is now permanent on your machine.
Why missing security patches matters more than it sounds
There is a comfortable myth that an unpatched machine is fine as long as you are careful. Do not open strange attachments, do not install pirated software, keep a decent antivirus running, and you will be fine. It is a reassuring story and it is wrong in a specific way that is worth understanding.
Most serious Windows vulnerabilities are not things you click on. They are flaws in components that process data automatically: the font renderer, the image decoder, the networking stack, the print spooler, the scripting engine embedded in things you did not know had a scripting engine. A malicious file only has to be previewed, or a crafted packet only has to arrive, and the flaw does the rest. Careful browsing habits do not protect against a bug in the code that draws a thumbnail.
The second thing that makes unpatched machines dangerous is that vulnerabilities become public knowledge on a schedule. Microsoft publishes what each patch fixes. Security researchers and attackers alike read those publications and work backwards to build working exploits, often within days. So the moment a patch ships for supported systems, the vulnerability it fixes becomes a documented, published roadmap for attacking every unpatched system still running the same code.
This is why the risk on an out-of-support operating system does not stay flat. It compounds. Month one after support ends, your machine has a handful of known unpatched holes. Month twelve, it has a hundred, each one documented, each one with proof of concept code circulating. Windows 7 machines still on the internet today are trivially compromised for exactly this reason, and Windows 10 is on the same curve.
Antivirus helps at the margins and it is worth having, but it works by recognising things it has seen before. A vulnerability in the operating system itself sits underneath the antivirus, and a sufficiently clean exploit will not look like malware until it is already running.
The dates you need to know
Windows 10 reached end of support on 14 October 2025. That date is fixed and it has passed. Everything after it is ESU territory.
For consumers, ESU covers a single year, ending 13 October 2026. There is no announced second consumer year. Anyone treating ESU as an indefinite reprieve is planning around something Microsoft has not offered.
For organisations buying through volume licensing, ESU runs in yearly blocks for up to three years, taking coverage through to October 2028. Each year is bought separately and each year costs more than the last, by design. Microsoft prices it to be uncomfortable, because the point is to move you off the platform rather than to let you rent the old one cheaply.
If you are reading this in mid-2026 the practical picture is straightforward. Consumer coverage has roughly ten weeks left. That is enough time to plan a migration properly. It is not enough time to keep putting it off.
We wrote about the wider timeline and what it means for different types of user in our guide to Windows 10 end of support, which covers the ground before the ESU decision point.
Consumer ESU compared with business ESU
These are two genuinely different products that share a name, and conflating them causes a lot of confusion in forum threads.
The consumer programme is aimed at individual PCs running Windows 10 Home or Pro in a household. Enrolment happens through the Windows Update interface on the machine itself. It requires a Microsoft account. It lasts one year. It covers up to a small number of devices tied to that account.
The business programme is bought through volume licensing or a cloud service provider, applied via activation keys or through management tooling, and covers three years in annual increments. It works on domain-joined machines, does not require each user to sign in with a personal Microsoft account, and scales to thousands of endpoints.
A small business with a handful of PCs sits awkwardly between the two. The consumer route technically works, but tying company machines to personal Microsoft accounts creates a mess when staff leave. The business route has a minimum practicality threshold that a five-person company may not clear. In that situation, upgrading the machines is almost always the cleaner answer.
[image: A side-by-side comparison of two laptop screens, one showing a home Windows 10 desktop and one showing a business desktop with a domain login banner]
The free routes, and the European exception
Not everyone pays for consumer ESU. Microsoft built in routes that cost nothing in money.
The first is syncing your PC settings to the cloud using Windows Backup. Turn it on, let it sync, and the ESU enrolment becomes free. The catch is that it consumes your Microsoft account storage allowance, and if you are already near the free storage limit you will be nudged toward a storage subscription. That is not an accident.
The second route is redeeming Microsoft Rewards points. If you have been accumulating points through Bing searches or other Microsoft services, you can spend them instead of money. Most casual users will not have enough banked, but it costs nothing to check.
The third route is paying a one-time fee, which covers the account rather than the single device and can extend to a small number of PCs signed in with the same account.
Then there is the European Economic Area. After sustained pressure from consumer organisations arguing that charging for security patches on a still widely used operating system was unfair, Microsoft made the consumer ESU year free for users in EEA countries, without the Windows Backup requirement attached. This is why “microsoft windows 10 esu eea” is one of the most searched phrases in this entire topic. If you are in the EEA, check the enrolment screen before assuming you need to pay or sync anything.
Search volume tells the story here. Across all the ways people phrase this topic, the EEA-specific query outranks the plain term by a wide margin, which suggests an enormous number of European users discovered mid-panic that their situation was different from what the English-language coverage described.
How to enrol in Windows 10 ESU
Enrolment is not a website. There is no ESU purchase page you navigate to. It happens inside the operating system, through a wizard that appears in Windows Update once your machine qualifies.
The sequence looks like this.
Open Settings, then Update and Security, then Windows Update. If your PC is eligible and fully prepared, you will see a notice about Windows 10 support ending with an enrolment link underneath it. Click it. The wizard walks you through choosing your route, whether that is backup sync, Rewards points, or payment. Sign in with a Microsoft account when prompted. Complete the flow, and the notice changes to confirm you are enrolled.
That is the happy path. A great many people never see the link at all, and that is where the trouble starts.
Prerequisites that block the enrolment link
The enrolment option only appears when several conditions are met at once.
Your machine must be running Windows 10 version 22H2. Older builds do not qualify, full stop. If you are on an earlier version you need to update to 22H2 first, and that update itself can take a while on a machine that has been ignoring updates.
Your machine must have the relevant servicing updates installed, including the enrolment enablement update that shipped in the run-up to end of support. This is what people are searching for when they type the KB number. Without it, the wizard has nothing to display.
You must be signed in with an administrator account. A standard user account will not surface the option.
Your Windows installation must be genuinely activated. An unactivated or improperly licensed copy of Windows 10 will not offer ESU. If you are not certain where your machine stands, our guide on how to check which Windows version you have walks through finding your edition, build, and activation state in under a minute.
Domain-joined and MDM-managed machines are excluded from the consumer flow entirely. They are expected to go through the business programme.
When enrolment does not work
The volume of searches around enrolment failures is striking. People searching for the enrolment error, the registration error, and the option simply not appearing collectively outnumber people searching for how much it costs. That tells you the process is rougher than the documentation suggests.
The enrol option does not appear
Work through the prerequisites above in order. Version 22H2 first, then all pending updates including optional ones, then confirm you are an administrator, then confirm activation. Restart between steps rather than at the end. The wizard is triggered by a background evaluation that does not always run promptly, so give it a day after you finish rather than concluding immediately that you are ineligible.
If the machine is domain-joined or was ever enrolled in a workplace management system, that is your answer. The consumer path is closed to it.
Enrolment starts and then fails
This usually points at the Microsoft account rather than at Windows. Sign out of the account in Settings, sign back in, and try again. Check that the account is not a child account under family safety, which cannot complete the flow. Check that the account has not hit its device limit from previous enrolments.
Some failures are simply server-side and resolve on their own within a day or two, which is unsatisfying advice but matches what a lot of people have reported.
The Microsoft account requirement and its expiry catch
Consumer ESU is bound to a Microsoft account, not to the hardware. If you stop signing in with that account on the device, coverage stops. This trips people who enrolled with an account, then switched the PC to a local account for privacy reasons, and later discovered patches had quietly stopped arriving.
There is a related detail people find genuinely irritating: the entitlement checks in periodically. A machine that has been offline for an extended period, or where the account has been signed out, can drop out of coverage without a clear warning. If a Windows 10 machine in your household is used rarely, check its enrolment state rather than assuming it persisted.
Enrolling without any Microsoft account is not possible on the consumer programme. People search for it constantly. The answer is no, and the workaround people circulate involves activation tooling we would not recommend and will not link.
[image: A Windows Update screen displaying an enrolment error message with a retry button]
Which Windows 10 editions qualify
The consumer programme covers Windows 10 Home and Windows 10 Pro on devices that are not managed by an organisation. Pro machines that happen to be in a household qualify perfectly well; it is the domain join and the management enrolment that disqualify a device, not the edition badge.
Enterprise and Education editions are handled through the business programme rather than the consumer wizard, which reflects how those licences are normally acquired in the first place. If you are running Enterprise on a home machine through some historical arrangement, expect the consumer flow to refuse you.
Windows 10 IoT Enterprise LTSC sits in a category of its own and does not need ESU at all in the same way, because the LTSC branches carry their own much longer support lifecycles independent of the mainstream Windows 10 timeline. This is a genuinely useful escape hatch for certain machines and we come back to it below.
Confirming that ESU is actually working
Enrolling and being covered are not quite the same thing, and there is no bright green badge that tells you which state you are in. A few checks give you reasonable confidence.
Look at the Windows Update screen itself. Once enrolment completes, the end of support notice changes its wording to confirm you are receiving extended security updates. If it still shows the enrolment invitation, the enrolment did not stick.
Look at your update history. Go to Windows Update, then View update history, and confirm that security quality updates have arrived with dates after your enrolment. If the most recent entry predates October 2025, nothing is coming through regardless of what the enrolment screen claims.
Confirm you are still signed in with the Microsoft account you enrolled with. This is the single most common reason coverage silently lapses. Settings, then Accounts, then Your info will show which account the device is using.
If you manage machines for family members, put a reminder in your calendar to check this quarterly. The failure mode here is quiet, and a machine that stopped receiving patches in month three will look and behave exactly like one that is fully covered.
What ESU costs, and how to think about the value
We do not publish figures for Microsoft’s own programme here because they vary by region, by year, and by licensing route, and a stale number is worse than no number. Check the enrolment wizard on your own machine for what applies to you.
What is worth reasoning about is the comparison. Consumer ESU is a one-year rental of security patches on an operating system that is going away regardless. A Windows 11 licence is a permanent thing you own that comes with years of full support ahead of it. In many situations the licence is the cheaper option within eighteen months, and it is unambiguously the better one after that.
The calculus flips when the hardware cannot run Windows 11. If your PC fails the processor or TPM requirements, buying a Windows 11 licence achieves nothing on that machine, and ESU becomes the sensible bridge while you plan a hardware replacement. Our guide to the Windows 11 system requirements lays out exactly what gets checked and which failures are fixable in firmware.
For business ESU the maths is harsher still, because year two and year three escalate steeply. Any organisation seriously considering three years of ESU should model the total against the cost of migrating, and most find migration wins before the end of year two.
ESU compared with the alternatives
| Option | Security patches | New features | Runs on older hardware | Permanent | Best suited to |
|---|---|---|---|---|---|
| Windows 10 with ESU | Yes | No | Yes | No | Buying time before a hardware refresh |
| Windows 10 without ESU | No | No | Yes | No | Offline or air-gapped machines only |
| Upgrade to Windows 11 | Yes | Yes | No | Yes | Any machine that meets the requirements |
| Windows 10 IoT Enterprise LTSC | Yes | No | Yes | Yes | Fixed-function and specialist devices |
| Replace the hardware | Yes | Yes | Not applicable | Yes | Machines already slow or failing |
Read that table with one thing in mind: only two of the five rows end with a machine that is still supported in 2028. ESU is on the temporary side of the line.
The LTSC route, and who it actually suits
Windows 10 IoT Enterprise LTSC deserves more attention than it gets in consumer coverage, because it solves a problem ESU only postpones. The Long Term Servicing Channel branches receive security updates for a decade from their release, without feature updates, without the Store, and without the consumer applications bundled into mainstream Windows. That is a supported Windows 10 machine well past the point where ESU runs out.
The catch is what it is designed for. LTSC exists for fixed-function devices: point of sale terminals, medical equipment, industrial controllers, kiosks, machines running one application forever. It is deliberately stripped down. Some consumer software expects components that are simply not present. Driver support for consumer peripherals can be patchy because manufacturers do not test against it.
For a machine that runs a specific line of business application and needs to keep running it on hardware that cannot move to Windows 11, LTSC is often the right answer and ESU is the wrong one. For a general purpose family computer, it is usually more friction than it is worth.
Licensing it is also different from buying a mainstream Windows licence, and it is worth understanding what you are getting before you commit. It is not a drop-in replacement for Home or Pro and it should not be treated as a way to dodge the Windows 11 question on a general use machine.
A practical migration checklist
If you have decided the year of ESU is a bridge rather than a destination, here is what to do with the time rather than letting it evaporate.
Start with an inventory. List every Windows 10 machine you are responsible for, including the ones you forget about, and for each note whether it passes the Windows 11 requirements. Most people discover at least one machine they had not thought about, and at least one that passes when they assumed it would not.
Check the firmware settings on machines that fail. A meaningful proportion of Windows 11 compatibility failures come down to TPM or Secure Boot being switched off in the BIOS rather than absent from the hardware. Turning them on converts an apparent hardware replacement into a fifteen minute job.
Identify software that will not follow you. Older applications, particularly anything with a hardware dongle or a driver component, are the usual casualties. Test them on an upgraded machine before you commit the whole fleet.
Back up properly before any upgrade, and by properly we mean a copy that exists somewhere other than the machine being upgraded. In-place upgrades usually work. Usually is not always.
Do the upgrades in a sensible order. Start with the least critical machine, learn what breaks, and apply what you learned to the rest. Upgrading the machine you depend on most, first, on a busy week, is how a manageable project becomes a bad day.
Finally, sort out licensing before you start rather than halfway through. Knowing which machines need a new licence and which carry one forward removes the most common source of mid-migration paralysis. If you would rather not untangle it yourself, the buying guides on our site cover the edition differences that matter in practice.
Common myths worth clearing up
That Windows 10 stops working in October. It does not. The machine boots, applications run, and nothing switches off. What stops is the flow of security patches, which is a slower and more serious problem than a sudden shutdown would be.
That ESU is available forever if you keep paying. For consumers it is not; one year is what was offered. For businesses it runs three years and then genuinely ends.
That you can enrol on Microsoft’s website. You cannot. Enrolment lives inside Windows Update on the device itself, and any site claiming to sell you consumer ESU enrolment directly is not what it appears to be.
That a fresh Windows 10 install gets you a clean support window. It does not. Support lifecycles attach to the product version, not to your installation date. A Windows 10 machine installed this morning is exactly as out of support as one installed in 2016.
That upgrading to Windows 11 wipes your files. An in-place upgrade from an activated Windows 10 install keeps files, applications, and settings. Back up anyway, but the upgrade is not a clean install unless you choose to make it one.
The honest trade-offs
Most articles on this topic sell you something. Here is the version with the downsides left in.
ESU is a year of standing still. You pay, or you sync your data to satisfy the free route, and at the end of it you are in exactly the same position with one fewer option. If you use the year to plan and execute a migration, that is money well spent. If you use it to avoid thinking about the problem, you have bought a delay and nothing else.
The free route has a real cost. Windows Backup sync consumes cloud storage, and for most accounts the free allowance is modest. A machine with a lot of settings and app data can push you over the line and into a storage subscription. That is a recurring charge dressed up as a free option, and it is fair to call it that.
The Microsoft account binding is genuinely annoying. Requiring a cloud account to receive security patches on a locally licensed operating system is a policy choice, not a technical necessity, and users who deliberately run local accounts are right to be irritated by it.
Upgrading to Windows 11 is not free of pain either. The interface changes are real, some workflows are slower, and a subset of older peripherals lose driver support in the transition. Anyone telling you the upgrade is entirely seamless has not migrated a machine with unusual hardware attached to it.
And the hardware requirements genuinely exclude working computers. There are perfectly capable machines that fail on processor generation alone, which is a frustrating position to be in and one that no amount of licence buying solves. For those machines, ESU followed by a planned replacement is the realistic path, and pretending otherwise would be dishonest.
What we would actually recommend
If your PC passes the Windows 11 requirements, buy a Windows 11 licence and upgrade rather than renewing your relationship with an operating system that is being retired. You get patches, you get features, and you get years of runway instead of months. Our Windows 11 licence keys are genuine Microsoft licences delivered digitally, and the upgrade path from an activated Windows 10 install keeps your files and applications in place.
If your PC fails the requirements and you need it working for another year or two, enrol in ESU now and plan the replacement deliberately rather than reactively. When you do replace the machine, a clean licence for the new build is the least complicated part of the process, and our Windows licence range covers the editions most people need without the sprawl of a marketplace listing page.
If you are running Windows 10 machines in a business and any of them are domain-joined, do not attempt to route them through the consumer programme. It creates account ownership problems that outlive the machines. Either commit to the volume licensing ESU path or migrate, and if the fleet is small, migrate.
Either way, do it before October. Everything gets more expensive and more rushed once the coverage ends.
What happens when the consumer year ends
Assume for a moment that no second consumer year is announced, because that is the only assumption you can currently plan around. What does 14 October 2026 actually look like for a Windows 10 machine?
Nothing dramatic happens on the day. The machine boots as normal. What ends is the delivery of patches, and from that point the compounding problem described earlier starts running without a brake. The difference between an ESU machine on 13 October and the same machine on 15 October is not visible, which is precisely why it is easy to ignore.
Practically, three groups will be affected. People who enrolled and planned will already be on Windows 11 or on new hardware by then, and the date will pass without incident. People who enrolled and did not plan will face the same decision they faced a year earlier, with less time and probably a more expensive hardware market. People who never enrolled have been exposed since 2025 and the date changes nothing for them.
There is a reasonable argument that Microsoft may extend or repeat the consumer offer, particularly given how the EEA situation played out. There is an equally reasonable argument that the whole point of the exercise was to move people off the platform and a second year would undercut it. Betting your machine’s security on which way that goes is not a strategy.
The one thing worth doing now, regardless of which camp you are in, is finding out where each of your machines stands. That takes minutes. Everything else can be scheduled once you know.
How this compares with previous ESU programmes
Microsoft has done this before, and the differences tell you something about intent.
The Windows 7 programme, which ran from 2020 to 2023, was strictly a business affair. There was no consumer route at all. Home users who wanted patches had to find a volume licensing arrangement or go without, and the great majority went without. Pricing doubled each year, which was the clearest possible signal that Microsoft wanted the programme used briefly and then abandoned.
The Windows 10 programme is the first to open a consumer door, and the first to include routes that cost nothing in money. That is a meaningful change, and it reflects both how many Windows 10 machines were still in daily use at end of support and how much of the installed base is physically blocked from Windows 11 by the hardware requirements. Windows 7 to Windows 10 was an upgrade almost any machine could take. Windows 10 to Windows 11 is not, and the ESU design acknowledges that.
Server ESU programmes work differently again, running through volume licensing with per-core pricing and, in some cases, extended coverage at no additional charge for workloads migrated to Microsoft’s own cloud. Anyone running out-of-support Windows Server should look at that separately, and our comparison of the recent Windows Server releases covers where the current supported versions stand.
What to do with the machine once you have moved on
A Windows 10 PC that has served its owner well does not stop being useful hardware the day its patches stop. It stops being safe to use in the way it was being used, which is a different problem with a different set of answers.
If the machine is going to a family member or a second desk, the honest advice is that handing on an unpatched Windows 10 install is handing on a problem. Either enrol it in ESU first so the new user gets the same protection you had, or wipe it and put something current on it. Passing along a machine with a live browser, a live mailbox and no security updates is not a favour.
If the hardware genuinely cannot run Windows 11 and you do not want to pay for coverage, a lightweight Linux distribution turns an eight-year-old laptop into a perfectly good web and document machine. It is not the answer for anyone who depends on a specific Windows application, and it means learning a new desktop, but for browsing, email and office documents it works and it keeps receiving security updates for free. That trade-off is real in both directions and worth thinking about rather than dismissing.
If the machine is being retired for good, wipe the drive properly before it leaves the building. A quick format is not enough on a mechanical disk, and on an SSD the right move is the drive’s own secure erase rather than a file-by-file overwrite. Sign out of your Microsoft account first so the device is removed from your account’s device list, and deactivate any software that ties a licence to that specific hardware. Doing that in the right order saves an argument with an activation server later.
One point that catches people out: a Windows licence that came preinstalled on the machine is tied to that motherboard and does not travel to a new PC. A retail licence does. If you are not sure which one you have, it is worth checking before you assume you can move it, and our guide on identifying your Windows version and licence type walks through the commands that tell you.
Frequently asked questions
What is Windows 10 ESU?
It is Microsoft’s Extended Security Updates programme for Windows 10. It delivers critical and important security patches to enrolled devices after Windows 10 reached end of support on 14 October 2025. It does not include feature updates, driver work, non-security bug fixes, or general technical support.
How do I enrol in Windows 10 ESU?
Open Settings, go to Update and Security, then Windows Update. If your machine qualifies, an enrolment link appears beneath the end of support notice. Click it and follow the wizard. You will need to be signed in as an administrator and to use a Microsoft account to complete the process.
Why can I not enrol in Windows 10 ESU?
The most common reasons are running a Windows 10 version older than 22H2, missing the servicing updates that enable the enrolment wizard, using a standard rather than administrator account, running an unactivated copy of Windows, or being on a domain-joined or workplace-managed device. Work through those in order and restart between steps.
Is Windows 10 ESU free?
It can be. Consumers can enrol at no monetary cost by syncing their PC settings with Windows Backup or by redeeming Microsoft Rewards points, and in the European Economic Area the consumer year was made free following regulatory pressure. Otherwise there is a one-time consumer fee, and the business programme is always paid.
How long does Windows 10 ESU last?
The consumer programme covers one year, ending 13 October 2026. The business programme runs in annual blocks for up to three years, taking coverage to October 2028. No second consumer year has been announced.
How do I get Windows 10 ESU for free?
Turn on Windows Backup and let your PC settings sync to your Microsoft account, or redeem Microsoft Rewards points during the enrolment wizard. If you are in an EEA country, check the wizard first because the free route there does not require the backup sync.
Can I use Windows 10 ESU without a Microsoft account?
No. The consumer programme binds entitlement to a Microsoft account, and coverage stops if you stop signing in with it on that device. The business programme works differently, through volume licensing rather than personal accounts.
How do I activate Windows 10 ESU after enrolling?
Consumer enrolment activates itself at the end of the wizard, and updates simply resume through Windows Update. There is no separate key to enter. If patches are not arriving, confirm you are still signed in with the enrolling Microsoft account and check the Windows Update history for delivery errors.
When will Windows 10 ESU be available?
It has been available since Windows 10 reached end of support in October 2025. If the enrolment option is not visible on your machine now, that is a prerequisite problem rather than a timing one.
Does ESU cover Microsoft Office on Windows 10?
No. Office and Microsoft 365 applications follow their own support lifecycles independently of the operating system. Running an out-of-support Office release on an out-of-support Windows build compounds your exposure, and both need addressing.
Is buying a Windows 11 licence better than paying for ESU?
If your hardware meets the Windows 11 requirements, yes, in almost every case. A licence is permanent and comes with full support including new features, where ESU is a one-year rental of security patches on a platform being retired. If your hardware fails the requirements, the licence achieves nothing on that machine and ESU is the correct bridge.
What happens if I do nothing at all?
The PC keeps booting and keeps working. It simply stops receiving security patches, so every vulnerability discovered from now on stays open on that machine permanently. For a device that touches the internet, handles email, or stores anything you care about, that is not a position worth being in.
Your next step
Open Settings, go to Windows Update, and find out in thirty seconds whether your machine is enrolled, eligible, or blocked. That single check tells you which of the three paths in this article is actually yours, and everything else follows from it. If it turns out your PC can run Windows 11, browse our genuine Microsoft licence range and make the jump while you still have time to do it calmly.
