Windows 10 is out of support — updates are not gone
When a Windows version reaches end of life, Microsoft does not stop producing security patches. It moves them behind the Extended Security Updates (ESU) programme, a paid licensing channel originally sold to enterprises. The patches themselves are published to Windows Update like any other; the machine simply has to hold an ESU entitlement to be offered them.
That entitlement is a licensing state in the Software Protection Platform — the same subsystem that handles ordinary Windows activation. TSforge, one of the methods inside Microsoft Activation Scripts, can write that state directly.
What ESU actually gives you
- Monthly security updates (Critical and Important)
- No feature updates, no new functionality
- No general technical support from Microsoft
- Multiple consecutive years of coverage, enabled year by year
If your goal is a machine that stays patched against exploited vulnerabilities without upgrading hardware to meet Windows 11 requirements, ESU is the supported answer.
Why TSforge and not HWID
HWID produces a standard digital license for the Windows edition itself — it has no concept of an ESU add-on SKU. TSforge works one level lower, injecting licensing data straight into the token store, so it can create entitlements that no online path would issue to a consumer machine. It also works fully offline, which matters on the kind of legacy or air-gapped machines still running Windows 10.
Enabling ESU
- Make sure Windows 10 itself is activated first. ESU sits on top of a licensed OS; it will not help an unactivated install.
- Open Terminal (Admin) or PowerShell (Admin) — not CMD — and run:
irm https://get.activated.win | iex
- Choose TSforge from the menu, then the ESU option.
- Pick the ESU year you want enabled and confirm.
- Reboot, then open Settings → Update & Security → Windows Update and check for updates.
Offline alternative: extract the MAS archive and run MAS_AIO.cmd as administrator — the same menu appears with no internet required.
Verifying it worked
Run:
slmgr /dlv
Look for an ESU entry in the listed licences with a licence status of Licensed. Then trigger a Windows Update scan; ESU-only patches should begin appearing in the offered list. If nothing appears immediately, allow a scan cycle — the update client caches its applicability evaluation.
Common problems
| Symptom | What to check |
|---|---|
No ESU entry in slmgr /dlv | Base Windows activation missing — activate with HWID or KMS38 first |
| Updates still not offered | Run wuauclt /resetauthorization /detectnow, then rescan |
0x80070005 while running | Terminal not elevated |
| Script files vanish | Defender false positive — add a folder exclusion and re-extract |
| Licensing service errors | Repair sppsvc and ClipSVC — see the troubleshooting guide |
Should you just upgrade instead?
If the hardware meets Windows 11 requirements, upgrading is the cleaner long-term path and activation carries over automatically on the same machine. ESU exists for the cases where it does not: unsupported CPUs, no TPM 2.0, line-of-business software pinned to Windows 10, or industrial machines that cannot be re-imaged.
Full background on how TSforge writes licensing data is in the TSforge guide.