What ESU is and why it exists
When mainstream support for Windows 10 ended, Microsoft did not stop producing security fixes. Enterprises with large fleets needed more time, so critical and important patches continue through the Extended Security Updates programme.
ESU is not a feature channel — no new functionality, no UI changes. It is security fixes only, delivered through normal Windows Update once the machine is licensed for the programme.
Why an unpatched Windows 10 is a real risk
Every Patch Tuesday that ships for Windows 11 tells attackers exactly which shared components are vulnerable in Windows 10. Because the two share large parts of the kernel, networking and browser stack, an unpatched Windows 10 machine gets measurably less safe each month. Running one online without ESU in 2026 is a genuine exposure, not a theoretical one.
Enabling ESU with TSforge
TSforge is the MAS method that unlocks the ESU channel, and it works fully offline.
- Run MAS as administrator.
- Choose TSforge Activation.
- Select the ESU submenu and the year you need.
- Reboot.
After the reboot, open Settings → Update & Security → Windows Update and check for updates. The end-of-support banner should be gone and new patches should be offered.
Verifying it took
slmgr /dlv
Look for an ESU-related license entry with a licensed status. Then confirm the practical outcome: an update from the current month appearing in your history is the only proof that matters.
If updates still refuse, the usual culprits are a broken Windows Update component store or a metered connection. Reset the components:
net stop wuauserv
net stop bits
ren %systemroot%\SoftwareDistribution SoftwareDistribution.old
net start bits
net start wuauserv
Should you just move to Windows 11?
If your hardware supports it, yes — a supported OS is always the better long-term answer. ESU is a bridge for machines that cannot meet the TPM 2.0 and CPU requirements, for line-of-business software pinned to Windows 10, and for anyone who needs time to plan a migration.
While you are on the bridge, keep the basics tight: a current browser, Defender enabled and updated, and no unpatched third-party runtimes. ESU covers the OS, not everything on it.
Get the script
Open Terminal (Admin) or PowerShell (Admin) and run:
irm https://get.activated.win | iex
Prefer offline? Grab the archive from the download page and run MAS_AIO.cmd as administrator. More help: troubleshooting guide · error decoder · all guides.