The end of mainstream support for Windows 10 on October 14, 2025, marks a critical juncture for organizations and individual users alike. While many are encouraged to upgrade to Windows 11 for continued security and feature updates, a significant number of systems will remain on Windows 10. For these systems, Microsoft offers the Extended Security Updates (ESU) program, providing crucial security patches beyond the official end-of-life date. The idea of “free” enrollment in Windows 10 ESU often circulates, leading to confusion. This article aims to clarify the realities of Windows 10 ESU, addressing whether free enrollment is truly possible, outlining the scenarios where ESU might be included, and detailing the standard paid enrollment process for those who require it.
Understanding Windows 10 Extended Security Updates (ESU)
The Extended Security Updates (ESU) program is a paid offering from Microsoft designed to provide continued security updates for operating systems beyond their official end-of-life date. For Windows 10, the ESU program will deliver critical and important security updates for up to three years after October 14, 2025. These updates are essential for protecting systems from newly discovered vulnerabilities that could be exploited by malicious actors. Without ESU, Windows 10 devices would become increasingly susceptible to cyberattacks after the support deadline, posing significant risks to data integrity and operational continuity.
The ESU program covers security updates for vulnerabilities rated “Critical” or “Important” by the Microsoft Security Response Center (MSRC) across all components of Windows 10. It does not, however, include new feature releases, non-security updates, or free technical support beyond what is provided through existing paid support agreements. This distinction is crucial: ESU is about security, not feature parity or comprehensive support.
The Reality of “Free” Extended Support
The notion of “free” enrollment in Windows 10 ESU is largely a misconception for the vast majority of users and organizations. Microsoft’s primary strategy for continued free support is the upgrade to Windows 11. For devices that meet the hardware requirements, upgrading to Windows 11 is a free process that provides access to ongoing security patches, feature updates, and technical support. This is the most straightforward and recommended path for users seeking to avoid ESU costs.
However, there are specific, limited scenarios where ESU might be included as part of another service or program, which can sometimes be perceived as “free” by the end-user or organization. It is important to understand that in these cases, the cost of ESU is typically bundled into a broader subscription or service fee, rather than being a standalone free offering.
Scenarios Where ESU Might Seem “Free” (or is Included)
While direct, standalone “free” enrollment for Windows 10 ESU is not available, certain deployment models and subscriptions can effectively include ESU without an additional, explicit purchase:
1. Azure Virtual Desktop (AVD) and Windows 365
One of the most notable exceptions applies to cloud-hosted instances of Windows 10. Customers running Windows 10 Enterprise or Education editions through Azure Virtual Desktop (AVD) or Windows 365 (Cloud PC) will automatically receive Extended Security Updates for free until October 2028. This is a significant benefit for organizations leveraging Microsoft’s desktop-as-a-service offerings. The cost of ESU is essentially integrated into the subscription price of AVD or Windows 365, making it a “free” inclusion from the perspective of an additional ESU license purchase. This approach aligns with Microsoft’s cloud-first strategy, incentivizing migration to their cloud platforms.
2. Eligible Microsoft 365 Subscriptions (Potentially Bundled)
While not a direct “free” offering, certain higher-tier Microsoft 365 subscriptions, particularly those targeting enterprise customers, might include ESU entitlements as part of their comprehensive licensing bundles for managed devices. This often applies to Windows 10 Enterprise E3/E5 licenses when coupled with specific Microsoft 365 plans. Organizations should consult their Microsoft licensing agreements and representatives to determine if their existing subscriptions include ESU benefits for their managed Windows 10 endpoints. It’s crucial to understand that this is not a universal “free” benefit but rather a potential inclusion within a larger paid enterprise agreement.
3. Education Sector Considerations
Microsoft often provides specific licensing benefits for educational institutions. While a blanket “free” ESU program for all education users is not explicitly stated, educational institutions should explore their volume licensing agreements and contact their Microsoft education specialists. It’s plausible that ESU could be included or offered at a significantly reduced rate as part of broader academic licensing programs.
The Paid Path: Enrolling in Windows 10 ESU
For most organizations and users who cannot or choose not to upgrade to Windows 11 and do not fall into the above “included” categories, enrolling in the Windows 10 ESU program is a paid process. The program is structured into three consecutive years, with the price increasing each year, encouraging users to migrate to a supported operating system.
ESU Year 1, 2, and 3
Microsoft has outlined the pricing structure for ESU, typically on a per-device basis, with the cost generally doubling each year. For instance, the ESU Year 1 typically costs $61 per device, Year 2 costs $122, and Year 3 costs $244 (these are illustrative prices and may vary based on region and licensing agreements). This escalating cost model is a clear incentive to move off Windows 10.
Enrollment Process
Enrollment for the ESU program primarily occurs through Volume Licensing Service Center (VLSC) for commercial customers. The process generally involves:
- Eligibility Confirmation: Ensure your Windows 10 devices are running either Windows 10 Pro, Enterprise, Education, or IoT Enterprise. Home editions are typically not eligible for ESU.
- Purchase ESU Licenses: Acquire the necessary ESU licenses through your Microsoft licensing reseller or partner. These are typically annual licenses.
- Activation and Deployment: Once licenses are purchased, you will receive activation keys (MAK keys) through the VLSC. These keys need to be deployed to the eligible Windows 10 devices using tools like Volume Activation Management Tool (VAMT), or through Configuration Manager (SCCM) or other management solutions. The ESU updates are then delivered via Windows Update, Windows Server Update Services (WSUS), or Microsoft Update Catalog.
- Annual Renewal: The ESU license must be purchased and activated annually for up to three years if continued support is required.
Important Note: Each year of ESU is cumulative. To activate ESU Year 2, you must have purchased and activated Year 1. Similarly, Year 3 requires activation of both Year 1 and Year 2.
Alternatives to ESU
Given the costs and complexities associated with ESU, exploring alternatives is often the most prudent path for organizations.
1. Upgrade to Windows 11
As previously mentioned, upgrading to Windows 11 is the most recommended and truly free solution for continued support. For devices meeting the hardware requirements (TPM 2.0, Secure Boot, etc.), this offers a seamless transition to a modern, secure, and feature-rich operating system. Microsoft continues to invest heavily in Windows 11, providing regular security and feature updates.
2. Migrate to Cloud-Based Solutions
For organizations with aging hardware or those looking to modernize their infrastructure, migrating to solutions like Azure Virtual Desktop or Windows 365 offers significant benefits, including the included ESU for Windows 10 instances. This allows organizations to leverage virtualized desktops, reduce local hardware dependencies, and benefit from cloud-scale management and security.
3. Hardware Refresh and Modernization
For devices that do not meet Windows 11 requirements, a hardware refresh might be a necessary investment. Replacing older hardware with new devices that support Windows 11 not only provides a path to a fully supported OS but also offers performance improvements, enhanced security features, and a better user experience. This can be a long-term cost-saving measure compared to recurring ESU fees for outdated hardware.
Related Articles
- Mastering Edge Computing And IoT
- How to harden your Debian server
- Penetration Testing Reconnaissance
- What are the benefits of Writing your own BEAM?
Conclusion
The “free” enrollment in Windows 10 Extended Security Updates is a nuanced topic. While direct, standalone free ESU is not available for general users, the program’s cost can be effectively absorbed or included within specific cloud services like Azure Virtual Desktop and Windows 365, or potentially within high-tier enterprise licensing agreements. For the vast majority, the most genuinely “free” and recommended path to continued security and support is to upgrade eligible devices to Windows 11. For those who must remain on Windows 10, the ESU program offers a paid lifeline of security updates, emphasizing the need for a strategic plan for eventual migration to a fully supported operating system. Understanding these distinctions is crucial for informed decision-making and maintaining a secure computing environment beyond October 2025.
References
Microsoft Learn. (n.d.). Windows 10 end of support (14 October 2025). Available at: https://learn.microsoft.com/en-us/windows/whats-new/windows-10-end-of-life (Accessed: November 2025) Microsoft Learn. (n.d.). Ways to install Windows 11. Available at: https://learn.microsoft.com/en-us/windows/whats-new/ways-to-install-windows-11 (Accessed: November 2025) Microsoft. (n.d.). Windows 10 ESU program. Available at: https://www.microsoft.com/en-us/windows/business/extended-security-updates (Accessed: November 2025)