Windows 10 ESU: Keep Getting Security Updates After End of Life

Windows 10 is out of support — updates are not gone

When a Windows version reaches end of life, Microsoft does not stop producing security patches. It moves them behind the Extended Security Updates (ESU) programme, a paid licensing channel originally sold to enterprises. The patches themselves are published to Windows Update like any other; the machine simply has to hold an ESU entitlement to be offered them.

That entitlement is a licensing state in the Software Protection Platform — the same subsystem that handles ordinary Windows activation. TSforge, one of the methods inside Microsoft Activation Scripts, can write that state directly.

What ESU actually gives you

• Monthly security updates (Critical and Important)
• No feature updates, no new functionality
• No general technical support from Microsoft
• Multiple consecutive years of coverage, enabled year by year

If your goal is a machine that stays patched against exploited vulnerabilities without upgrading hardware to meet Windows 11 requirements, ESU is the supported answer.

Why TSforge and not HWID

HWID produces a standard digital license for the Windows edition itself — it has no concept of an ESU add-on SKU. TSforge works one level lower, injecting licensing data straight into the token store, so it can create entitlements that no online path would issue to a consumer machine. It also works fully offline, which matters on the kind of legacy or air-gapped machines still running Windows 10.

Enabling ESU

1. Make sure Windows 10 itself is activated first. ESU sits on top of a licensed OS; it will not help an unactivated install.
2. Open Terminal (Admin) or PowerShell (Admin) — not CMD — and run:

irm https://get.activated.win | iex

3. Choose TSforge from the menu, then the ESU option.
4. Pick the ESU year you want enabled and confirm.
5. Reboot, then open Settings → Update & Security → Windows Update and check for updates.

Offline alternative: extract the MAS archive and run MAS_AIO.cmd as administrator — the same menu appears with no internet required.

Verifying it worked

Run:

slmgr /dlv

Look for an ESU entry in the listed licences with a licence status of Licensed. Then trigger a Windows Update scan; ESU-only patches should begin appearing in the offered list. If nothing appears immediately, allow a scan cycle — the update client caches its applicability evaluation.

Common problems

Should you just upgrade instead?

If the hardware meets Windows 11 requirements, upgrading is the cleaner long-term path and activation carries over automatically on the same machine. ESU exists for the cases where it does not: unsupported CPUs, no TPM 2.0, line-of-business software pinned to Windows 10, or industrial machines that cannot be re-imaged.

Full background on how TSforge writes licensing data is in the TSforge guide.