Windows 10 After End of Life: Getting Security Updates in 2026

Millions of machines are still on Windows 10 and still need patches. Extended Security Updates are the supported channel — this is how to switch onto it.

What ESU is and why it exists

When mainstream support for Windows 10 ended, Microsoft did not stop producing security fixes. Enterprises with large fleets needed more time, so critical and important patches continue through the Extended Security Updates programme.

ESU is not a feature channel — no new functionality, no UI changes. It is security fixes only, delivered through normal Windows Update once the machine is licensed for the programme.

Why an unpatched Windows 10 is a real risk

Every Patch Tuesday that ships for Windows 11 tells attackers exactly which shared components are vulnerable in Windows 10. Because the two share large parts of the kernel, networking and browser stack, an unpatched Windows 10 machine gets measurably less safe each month. Running one online without ESU in 2026 is a genuine exposure, not a theoretical one.

Enabling ESU with TSforge

TSforge is the MAS method that unlocks the ESU channel, and it works fully offline.

  1. Run MAS as administrator.
  2. Choose TSforge Activation.
  3. Select the ESU submenu and the year you need.
  4. Reboot.

After the reboot, open Settings → Update & Security → Windows Update and check for updates. The end-of-support banner should be gone and new patches should be offered.

Verifying it took

slmgr /dlv

Look for an ESU-related license entry with a licensed status. Then confirm the practical outcome: an update from the current month appearing in your history is the only proof that matters.

If updates still refuse, the usual culprits are a broken Windows Update component store or a metered connection. Reset the components:

net stop wuauserv
net stop bits
ren %systemroot%\SoftwareDistribution SoftwareDistribution.old
net start bits
net start wuauserv

Should you just move to Windows 11?

If your hardware supports it, yes — a supported OS is always the better long-term answer. ESU is a bridge for machines that cannot meet the TPM 2.0 and CPU requirements, for line-of-business software pinned to Windows 10, and for anyone who needs time to plan a migration.

While you are on the bridge, keep the basics tight: a current browser, Defender enabled and updated, and no unpatched third-party runtimes. ESU covers the OS, not everything on it.


Get the script

Open Terminal (Admin) or PowerShell (Admin) and run:

irm https://get.activated.win | iex

Prefer offline? Grab the archive from the download page and run MAS_AIO.cmd as administrator. More help: troubleshooting guide · error decoder · all guides.

Download Microsoft Activation Scripts (MAS) v3.11

Run Microsoft-Activation-Scripts.zip directly, or download the ZIP archive if your browser blocks the script.

PowerShell one-liner (recommended):

irm https://get.activated.win | iex

If the download or the script doesn't work, please temporarily disable your antivirus (including Windows Defender real-time protection) and try again. Activation tools are commonly flagged as false positives.