Windows 10 ESU in Year 2: What Extended Security Updates Cost and How IT Teams Enroll a Fleet

Updated: November 2026. Prices, coverage dates, activation IDs and known issues checked against Microsoft Learn, Microsoft Support and Microsoft's consumer ESU page on 11 November 2026.

Commercial Extended Security Updates for Windows 10 moved into Year 2 in October, and Year 2 needs its own license and its own activation ID. A PC that got last month's security fixes won't keep getting them until someone buys and activates Year 2. This Windows 10 ESU guide covers what each license costs today, when the free routes apply, and how to enroll, switch and verify a fleet.

TL;DR

• Year 2 cost. Microsoft's $61 commercial price doubles yearly, so Year 2 is $122 by our math, and new buyers pay $183.
• What it covers. Critical and Important security fixes for Windows 10 22H2, sold by the year to 10 October 2028.
• Free routes. Windows 365 Cloud PCs and Windows 10 VMs in Azure get it at no extra cost.
• The switch. Since KB5131096 on 10 November 2026, commercial PCs need a Year 2 license.
• Proof. Activate each key with slmgr, then check every PC's license status after Patch Tuesday.

What Windows 10 ESU Covers in Year 2

Windows 10 ESU is a paid program that keeps security fixes coming to Windows 10 PCs after end of support. Coverage started on 14 October 2025 and is sold one year at a time, for up to three years.

You get Critical and Important security updates, as rated by the Microsoft Security Response Center. No new features, no non-security fixes. ESU support covers only activation, installation and problems the ESU updates cause, and it needs an active support plan.

The PC has to run Windows 10, version 22H2: Enterprise, Education, or Pro in commercial use. Which PCs should stay on Windows 10 at all is a separate call, covered in our Windows 10 end-of-life guide. This one keeps the survivors patched.

Every ESU year ends on a Patch Tuesday and holds 12 monthly releases. Microsoft's ESU overview still says Year One starts in November 2025, which is when the first update shipped. Our Patch Tuesday guide explains the monthly cycle.

The calendar below puts the three commercial years next to the consumer end date and the LTSC 2021 dates.

How Much Windows 10 Extended Security Updates Cost Today

Microsoft's ESU overview sets the commercial price at $61 per device for Year 1, doubling every year after that. You buy whole years only, up to three, with a minimum of one license. CSP partners have sold it since 1 September 2025.

Prices below are in US dollars per device, read from Microsoft's pages on 11 November 2026. The figures marked "our math" come from the doubling rule, because Learn doesn't print them.

Two offers stay out of the table because no Learn page prints their prices: the Intune and Autopatch discount, and the separate LTSC 2021 program. Both come up below.

You can order every year ahead, but a year's keys don't work until its coverage starts. A Year 3 key bought today sits idle until 13 October 2027.

Why Late Buyers Still Pay for Year 1

ESU has no partial periods. Microsoft's ESU overview says a Year 2 buyer pays for Year 1 too, because ESUs are cumulative. So a PC enrolled this month costs $183, Year 1 plus Year 2.

Think of Year 1 as the entry fee. Each monthly ESU update is cumulative, so the first one a late buyer installs carries every earlier fix.

What that $183 buys shrinks every month you wait. This is our arithmetic from list prices, counting the release from the month you start.

The September buyer then pays another $244 for Year 3, by our math, to stay covered past 12 October 2027. Waiting saves nothing.

Education and the Intune Offer

Microsoft's Education Blog lists $1, $2 and $4 per license for Years 1, 2 and 3, for every education customer from K-12 to higher education. It calls those US prices accurate as of April 2024.

The blog doesn't say whether a late education buyer pays for Year 1 too. If the cumulative rule applies, a school starting now pays $3 per device, so confirm it with your partner.

A 2024 post on Microsoft's Windows IT Pro Blog priced Year 1 at $45, about 25% off, for PCs managed by Intune or Windows Autopatch. Computerworld and Redmondmag reported it at the time. Learn lists only $61, and we found no Microsoft page with a Year 2 or Year 3 price for that offer. Ask your partner.

To carry these lines into next year's numbers, start from our IT budget planning template.

Free Windows 10 ESU in Windows 365, Azure Virtual Desktop and Azure

Windows 10 running inside Microsoft's cloud gets ESU at no extra cost. Windows 365 and Azure's own services need no keys, though Citrix, Omnissa Horizon or Nutanix on Azure's VMware service may need one. The PC on the user's desk is a different story.

The cloud desktop is covered. The PC the user sits at is a separate device, and Windows 365 Business and Azure Virtual Desktop don't extend ESU to it.

Learn names one exception for physical PCs, with strings attached. The user needs Windows 365 Enterprise or a Flex Cloud PC in dedicated mode. The local PC must be Microsoft Entra joined or hybrid joined. The user must sign in to it with the same Entra account at least once every 22 days. Entra registered or on-premises AD joined PCs don't qualify. Learn sends personal BYOD devices to consumer ESU instead.

IT then deploys one policy through Intune or another MDM: OMA-URI ./Device/Vendor/MSFT/Policy/Config/Licensing/EnableESUSubscriptionCheck, type Integer, value 1. The PC also needs to reach dls.microsoft.com and login.windows.net.

Consumer ESU and Who Can Use It

Consumer ESU covers personal PCs until 12 October 2027, with no Year 3, and enrolled devices carry over automatically. Before the enrollment wizard appears, the PC needs:

• Windows 10, version 22H2, in Home, Pro, Pro Education or Workstations
• The latest Windows update, plus the ESU licensing preparation package KB5126256
• A Microsoft account with administrator rights, and not a child account

Then open Settings > Update & Security > Windows Update and select Enroll now. One license covers up to 10 devices: enroll each the same way, or use Add device while signed in with the same account.

The wizard isn't offered on kiosk devices, PCs joined to Active Directory or Entra ID, PCs enrolled in MDM, or PCs that already hold an ESU license. Entra registered devices can use it. Microsoft's consumer page rules it out for commercial use, and a consumer-enrolled PC that later joins a commercial setup has it suspended. Our Windows MDM guide explains what counts as MDM enrollment.

In the European Economic Area, consumer ESU is free while the user stays signed in with the Microsoft account used to enroll. Stop signing in, and updates stop after up to 60 days until the device re-enrolls. A one-time $30 purchase is the alternative, and it allows a local account.

ExplainingComputers made the video below, titled Windows 10 Consumer ESUs Extended to October 2027. Company PCs follow the commercial runbook in the next section instead.

How to Enroll Company PCs in Commercial ESU

This runbook covers PCs you license through Volume Licensing or CSP. It's the same for every ESU year, apart from the key and the activation ID.

1. Prepare the PC. Install a security update from 14 October 2025 or later, such as KB5066791, then KB5126256.
2. Check access. Use an admin account, and allow the activation endpoints listed on Learn's Enable ESU page.
3. Buy. Use Volume Licensing or a CSP partner, one license per device.
4. Find the MAK. It's in the Microsoft 365 admin center.
5. Activate. Run slmgr with the key and that year's activation ID.
6. Confirm. slmgr.vbs /dlv should show License Status Licensed.

Learn's Enable ESU page still names KB5072653 as the preparation package. KB5126256's own Support page says each new package supersedes every earlier one, so install KB5126256. It only applies to PCs that aren't enrolled yet, and it doesn't enroll or patch anything by itself.

Find the MAK in the Microsoft 365 Admin Center

For Volume Licensing, go to Billing > Your products > Volume licensing > View contracts. Pick the License ID, then More actions > View product keys. You need the Product Key Reader or VL Administrator role.

CSP purchases land in the Software section of the customer's page in Partner Center, and the customer sees the keys in their own Microsoft 365 admin center.

In January 2026, an r/sysadmin poster with one domain-joined Windows 10 Pro PC bought ESU through a CSP and couldn't find it in the admin center. Two replies had the fix: under Billing > Your products, use Change billing account to switch to the account the reseller created. That step comes from practitioners, not from Learn.

Install and Activate the Key With slmgr

Open an elevated Command Prompt and run these, with your key and the activation ID for the year you bought:

code
slmgr.vbs /ipk <ESU MAK>
slmgr.vbs /ato <Activation ID>
slmgr.vbs /dlv

The last command should show the ESU program name and License Status Licensed. The activation IDs are the same on every eligible edition and device.

Offline PCs run slmgr.vbs /dti <Activation ID> for an Installation ID. Trade it for a Confirmation ID at Microsoft's product activation portal (aka.ms/aoh), then run slmgr.vbs /atp <Confirmation ID> <Activation ID>. Leave no spaces in the Confirmation ID.

To see which keys a PC already holds, our Windows product key guide covers the commands.

Move Enrolled PCs to Year 2

KB5131096, the 10 November 2026 update (OS build 19045.7846), is the first Year 2 security release. Its Support page says commercial 22H2 PCs need an ESU Year 2 license to keep receiving security updates. November is the first month a Year 1 PC falls behind.

The switch is the same three commands with the Year 2 key and the Year 2 activation ID, 1043add5-23b1-4afb-9a0f-64343c8f3f8d. Learn lists a separate ID per year, and Partner Center sells each year as its own product, so take the Year 2 key from your admin center or partner.

The Year 2 steps don't include removing the Year 1 key. Microsoft doesn't say whether Year 1 has to stay active once Year 2 is on. No Microsoft page says whether a late buyer activates the Year 1 key at all, either. Ask your partner, and file the Year 1 purchase record either way.

Our November 2026 Patch Tuesday breakdown covers that first Year 2 release.

Activate a Fleet With Intune or a Script

Typing slmgr PC by PC works for a small office and nowhere else. For a fleet, push the same commands as a script. An Intune remediation pair works, with detection checking for the Year 2 license and remediation running slmgr. So does a Win32 app or your RMM's script runner. Treat any script as a starting point, test it on one PC, and keep the MAK where users can't read it.

PowerShell on endpoints meets the execution policy first, and our PowerShell execution policy guide covers the settings.

For an MSP, each client's keys live in that client's tenant, so activation runs tenant by tenant. Each year is its own purchase, so put every client's renewal on a calendar now.

Billing it is a separate decision, and our MSP pricing models guide covers pass-through licenses.

An r/msp thread from 8 October 2025, the week before Windows 10 support ended, asked why buying ESU is so hard for a small partner. Replies converge on CSP through a direct or indirect provider, with no minimum order, keys landing in the client's admin center, and activation with slmgr or VAMT.

Golden Images, Reimaging and Offline PCs

Every MAK has an activation limit, so images need care. For nonpersistent VDI, Microsoft's order is: install 22H2, install and activate the ESU key, install the latest update and restart, remove the key with slmgr.vbs /upk <Activation ID>, then sysprep and capture. Repeat it every update cycle, or the image burns activations.

Our Sysprep walkthrough covers the generalize and capture steps.

Error 0xC004C020 means the MAK has hit its limit. Microsoft grants more activations by exception through the Request an increase to MAK activation limits form, which needs the VL Administrator, Key Administrator or Key Viewer role.

For offline PCs in bulk, use VAMT proxy activation, with the latest ADK and the VAMT update that adds PkeyConfig files for Windows 10 ESU MAKs.

Check Which Devices Are Covered

slmgr.vbs /dlv answers the question for one PC. For a fleet, query the licensing WMI class for the three ESU activation IDs. This sample isn't from a Microsoft page, so treat it as a starting point and test it on one PC first. LicenseStatus 1 means Licensed.

powershell
$esu = @{
  'f520e45e-7413-4a34-a497-d2765967d094' = 'Year 1'
  '1043add5-23b1-4afb-9a0f-64343c8f3f8d' = 'Year 2'
  '83d49986-add3-41d7-ba33-87c7bfb5c0fb' = 'Year 3'
}
Get-CimInstance SoftwareLicensingProduct -Filter "PartialProductKey IS NOT NULL" |
  Where-Object { $esu.ContainsKey($_.ID) } |
  Select-Object @{n='EsuYear';e={$esu[$_.ID]}}, Name, LicenseStatus

Run it after every Patch Tuesday and log the result per device in the device table you keep for Windows 10. A PC that shows Year 1 only, or no ESU row at all, missed this month.

PCs on the Windows 365 route have no MAK to query. Check for Win10CommercialW365ESUEligible = 1 under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\ESU, and Event ID 113 in Event Viewer under Applications and Services Logs > Microsoft > Windows > ClipESU.

A licensed PC still needs the update installed, which is what patch compliance reporting tracks.

Keep the MAK records, purchase confirmations and query output together. In a software license audit, they prove each Windows 10 PC was covered.

Any RMM with a script runner can run a check like this on a schedule. OpenFrame is open, AI-native infrastructure for IT and security, where Fae resolves support requests and Mingo runs IT operations, including patching. It costs $1 per device per month, with a 14-day free trial. Flamingo builds OpenFrame, so read this mention with that in mind.

Known Windows 10 ESU Issues and Fixes

On 11 November 2026, Microsoft's Windows 10 22H2 release health page (updated 10 November) listed no open ESU issue. These are the resolved ones, plus setup traps that look like bugs.

KB5126256 comes through Windows Update, Windows Update for Business, WSUS and the Microsoft Update Catalog, so PCs without direct internet access can still get it.

On a WSUS server, it sits under the product Windows 10, version 1903 and later, classified as Security Updates.

For update failures outside ESU, start with our guide to Windows Update errors.

Windows 10 LTSC 2021 Has Its Own ESU

The 22H2 program doesn't cover LTSB or LTSC editions. Two of them now have their own paid ESU: Enterprise LTSB 2016 (with IoT Enterprise LTSB 2016) and Enterprise LTSC 2021. One Learn page, updated in August 2026, covers both.

Enterprise LTSC 2021 support ends on 12 January 2027. Its ESU went on sale on 1 September 2026, per Microsoft's message center, and needs the January 2027 servicing stack and security updates first. It doesn't apply to IoT Enterprise LTSC 2021, which gets updates to 13 January 2032 anyway.

Learn doesn't print prices or an end date for it. Microsoft's Windows IT Pro Blog post on LTSC 2021 end of support does, as reported by Borncity. It puts Year 1 at $61, or $45 with Intune or Autopatch, doubling each year, with coverage possible to 8 January 2030.

Enrollment follows the same runbook, with its own activation IDs.

One table on that Learn page adds a stray character to the Year 2 ID. The valid one above matches the page's offline activation table.

Enterprise LTSB 2016 support ended on 13 October 2026, and its 10 November update, KB5131291, says eligible devices must be enrolled in ESU to keep getting updates. The February 2026 message center post that announced ESU for LTSB 2016 also covered Windows Server 2016, and our Server 2016 guide covers that deadline.

Plan the Exit Before Year 3

Three years is the cap. Commercial ESU ends on 10 October 2028, and there's no Year 4 to buy at any price. Consumer ESU ends a year earlier, on 12 October 2027.

Windows Server 2012 R2 already ran this course, and its last ESU year ended on 13 October 2026. Our Server 2012 R2 guide covers that timeline.

Treat every Windows 10 PC still on ESU as a replacement with a date on it. Our IT asset lifecycle management guide covers how to plan the refresh.

Summary and What to Read Next

Year 2 of Windows 10 ESU started on 14 October 2026, and KB5131096 is the first update that needs it. Commercial PCs need the Year 2 license, activated against its own ID, plus a monthly check that proves each PC has it. Cloud PCs and Azure VMs stay covered at no extra cost, and consumer ESU runs to 12 October 2027. Next, our guide to Windows patch management shows how to fold ESU PCs into the patch process for the rest of the fleet.