Windows 10 After End of Life: Getting Security Updates in 2026

Millions of machines are still on Windows 10 and still need patches. Extended Security Updates are the supported channel — this is how to switch onto it.

What ESU is and why it exists

When mainstream support for Windows 10 ended, Microsoft did not stop producing security fixes. Enterprises with large fleets needed more time, so critical and important patches continue through the Extended Security Updates programme.

ESU is not a feature channel — no new functionality, no UI changes. It is security fixes only, delivered through normal Windows Update once the machine is licensed for the programme.

Why an unpatched Windows 10 is a real risk

Every Patch Tuesday that ships for Windows 11 tells attackers exactly which shared components are vulnerable in Windows 10. Because the two share large parts of the kernel, networking and browser stack, an unpatched Windows 10 machine gets measurably less safe each month. Running one online without ESU in 2026 is a genuine exposure, not a theoretical one.

Enabling ESU with TSforge

TSforge is the MAS method that unlocks the ESU channel, and it works fully offline.

  1. Run MAS as administrator.
  2. Choose TSforge Activation.
  3. Select the ESU submenu and the year you need.
  4. Reboot.

After the reboot, open Settings → Update & Security → Windows Update and check for updates. The end-of-support banner should be gone and new patches should be offered.

Verifying it took

slmgr /dlv

Look for an ESU-related license entry with a licensed status. Then confirm the practical outcome: an update from the current month appearing in your history is the only proof that matters.

If updates still refuse, the usual culprits are a broken Windows Update component store or a metered connection. Reset the components:

net stop wuauserv
net stop bits
ren %systemroot%\SoftwareDistribution SoftwareDistribution.old
net start bits
net start wuauserv

Should you just move to Windows 11?

If your hardware supports it, yes — a supported OS is always the better long-term answer. ESU is a bridge for machines that cannot meet the TPM 2.0 and CPU requirements, for line-of-business software pinned to Windows 10, and for anyone who needs time to plan a migration.

While you are on the bridge, keep the basics tight: a current browser, Defender enabled and updated, and no unpatched third-party runtimes. ESU covers the OS, not everything on it.

Get the script

Open Terminal (Admin) or PowerShell (Admin) and run:

irm https://get.activated.win | iex

Prefer offline? Grab the archive from the download page and run MAS_AIO.cmd as administrator. More help: troubleshooting guide · error decoder · all guides.

Get MAS from the official project

This site does not host its own build of the scripts. The buttons below go to the project’s own repository and mirrors, so what you get is what the developers published.

Download from official repositoryView official releasesView source

PowerShell one-liner published by the project:

irm get.activated.win | iex

Check the domain before running it, and see how to verify what you run.

Activation tooling is routinely classified as riskware by antivirus software. That is expected for this category and is not by itself evidence of malware — nor proof that a particular copy is clean. Verify the source before running anything.