Windows 10 ESU: Keep Getting Security Updates After End of Life

Windows 10 support ended, but Microsoft still publishes Extended Security Updates. TSforge can enable the ESU licensing channel locally so patches keep arriving.

Windows 10 is out of support — updates are not gone

When a Windows version reaches end of life, Microsoft does not stop producing security patches. It moves them behind the Extended Security Updates (ESU) programme, a paid licensing channel originally sold to enterprises. The patches themselves are published to Windows Update like any other; the machine simply has to hold an ESU entitlement to be offered them.

That entitlement is a licensing state in the Software Protection Platform — the same subsystem that handles ordinary Windows activation. TSforge, one of the methods inside Microsoft Activation Scripts, can write that state directly.

What ESU actually gives you

  • Monthly security updates (Critical and Important)
  • No feature updates, no new functionality
  • No general technical support from Microsoft
  • Multiple consecutive years of coverage, enabled year by year

If your goal is a machine that stays patched against exploited vulnerabilities without upgrading hardware to meet Windows 11 requirements, ESU is the supported answer.

Why TSforge and not HWID

HWID produces a standard digital license for the Windows edition itself — it has no concept of an ESU add-on SKU. TSforge works one level lower, injecting licensing data straight into the token store, so it can create entitlements that no online path would issue to a consumer machine. It also works fully offline, which matters on the kind of legacy or air-gapped machines still running Windows 10.

Enabling ESU

  1. Make sure Windows 10 itself is activated first. ESU sits on top of a licensed OS; it will not help an unactivated install.
  2. Open Terminal (Admin) or PowerShell (Admin) — not CMD — and run:
irm https://get.activated.win | iex
  1. Choose TSforge from the menu, then the ESU option.
  2. Pick the ESU year you want enabled and confirm.
  3. Reboot, then open Settings → Update & Security → Windows Update and check for updates.

Offline alternative: extract the MAS archive and run MAS_AIO.cmd as administrator — the same menu appears with no internet required.

Verifying it worked

Run:

slmgr /dlv

Look for an ESU entry in the listed licences with a licence status of Licensed. Then trigger a Windows Update scan; ESU-only patches should begin appearing in the offered list. If nothing appears immediately, allow a scan cycle — the update client caches its applicability evaluation.

Common problems

SymptomWhat to check
No ESU entry in slmgr /dlvBase Windows activation missing — activate with HWID or KMS38 first
Updates still not offeredRun wuauclt /resetauthorization /detectnow, then rescan
0x80070005 while runningTerminal not elevated
Script files vanishDefender false positive — add a folder exclusion and re-extract
Licensing service errorsRepair sppsvc and ClipSVC — see the troubleshooting guide

Should you just upgrade instead?

If the hardware meets Windows 11 requirements, upgrading is the cleaner long-term path and activation carries over automatically on the same machine. ESU exists for the cases where it does not: unsupported CPUs, no TPM 2.0, line-of-business software pinned to Windows 10, or industrial machines that cannot be re-imaged.

Full background on how TSforge writes licensing data is in the TSforge guide.

Download Microsoft Activation Scripts (MAS) v3.11

Run Microsoft-Activation-Scripts.zip directly, or download the ZIP archive if your browser blocks the script.

PowerShell one-liner (recommended):

irm https://get.activated.win | iex

If the download or the script doesn't work, please temporarily disable your antivirus (including Windows Defender real-time protection) and try again. Activation tools are commonly flagged as false positives.