Windows 10 reached end of life, but the update channel did not close — it moved behind Extended Security Updates. TSforge is the Massgrave method that reaches it.

What end of life actually changed

Windows 10 stopped receiving free monthly security patches. The machine keeps working, activation stays valid, and applications keep running. What stops is the security update stream — and over a year or two, that gap becomes the single biggest risk on the box.

Microsoft did not delete the channel. It moved it behind Extended Security Updates (ESU), a licensed add-on originally aimed at enterprises that could not migrate in time.

Where TSforge comes in

ESU is enforced through the same licensing store as everything else. TSforge writes ESU licensing data directly into that store, so Windows Update sees an entitled machine and resumes delivering the monthly security rollups.

This is the only MAS method that does it. HWID activates Windows itself but has no ESU concept. KMS38 sets an expiry date and does not touch ESU. Online KMS is unrelated.

Doing it

Make sure Windows 10 itself is activated first. ESU sits on top of an activated install, not instead of one.
Run MAS_AIO.cmd as administrator.
Choose TSforge Activation → the ESU option.
Reboot. Non-negotiable — the token store is read at service start.
Open Settings → Windows Update → Check for updates.

The first check after enabling ESU often pulls a large backlog. Let it finish and reboot again.

Confirming it worked

slmgr /dlv

Look for an ESU-related licensing entry alongside the base Windows license. In Windows Update, the practical confirmation is simpler: security updates dated after the end-of-life cutoff start appearing.

What ESU does and does not include

Included: monthly security updates for the operating system, rated critical and important.

Not included: feature updates, new functionality, non-security quality fixes, and support for applications that drop Windows 10 on their own schedule. Browsers and productivity suites set their own end dates regardless of ESU.

Is this a long-term plan?

It is a bridge, not a destination. ESU extends the security window by a defined period, and hardware that cannot run Windows 11 will eventually need replacing or repurposing — a lightweight Linux desktop is a reasonable end state for an old laptop.

But for machines that must stay on Windows 10 for a while — legacy software, specific drivers, embedded roles — patched is dramatically better than unpatched, and TSforge is how you get there.

If updates still do not arrive

Restart the update stack:

net stop wuauserv
net stop bits
net start bits
net start wuauserv

Then re-check. If the base Windows activation lapsed, fix that first — ESU on a non-activated install does nothing.

Get the script

Open Terminal (Admin) or PowerShell (Admin) and run:

irm https://get.activated.win | iex

Prefer offline? Grab the archive from the download page and run MAS_AIO.cmd as administrator. More help: MAS script overview · Massgrave Windows guide · troubleshooting · error decoder.

Massgrave and Windows 10 After End of Life: Staying Patched