Windows 10 After End of Support — ESU, Security and Your Options in 2026

What ESU actually provides

Extended Security Updates deliver critical and important security patches only. There are no new features, no non-security fixes and no expanded support scope. It is a bridge for machines that cannot migrate yet, priced per device per year and escalating each year it continues.

Who can enrol

Consumer and business enrolment paths differ, and the entry requirements move. Check the current terms on Microsoft's own support pages rather than a third-party summary — this is one of the few areas where the details genuinely change between announcements.

If the hardware blocks Windows 11

TPM 2.0 and the supported-CPU list are the usual blockers. Options worth weighing:

• Enable TPM and Secure Boot in UEFI — many machines ship with them disabled rather than absent
• Check the vendor's firmware updates; some older boards gained fTPM support after release
• Consider a supported Linux distribution for browsing-and-documents machines
• Replace the machine if it also fails on RAM or storage — ESU costs add up fast

Activation is a separate question

An activated Windows 10 installation does not become unlicensed when support ends. The licence remains valid; what stops is the patch stream. Confirm your licence state independently.

• Run `slmgr /xpr` to see whether the licence is permanent or has an expiry date
• Run `slmgr /dli` for the licence channel (Retail, OEM, Volume) and the last five key digits
• Open Settings › System › Activation for the plain-language activation state
• For Office, run `ospp.vbs /dstatus` from the Office install folder

Legal ways forward

Whatever the cause, the compliant options are the same.

• A valid Microsoft licence, digital licence or volume agreement is the only fully compliant route
• Windows runs without activation — you get a watermark and locked personalisation, security updates still install
• Office without a licence opens files read-only; the free web and mobile apps stay fully usable
• Business, school and production machines should use the organisation's own licensing agreement

Windows 10 ESU System Requirements & Compatibility (2026)

Windows 10 ESU is engineered for the modern Microsoft activation stack. The tool runs on Windows 7 SP1, Windows 8.1, Windows 10 (all builds from 1507 to 22H2) and every Windows 11 release including 23H2 and 24H2. Both x64 and ARM64 hardware are supported, and the activator also recognises Server SKUs such as Server 2016, 2019 and 2022. On the Office side, Click-to-Run installations of Office 2013, 2016, 2019, 2021, 2024 and Microsoft 365 are detected automatically — including LTSC channels. You do not need to uninstall a previous KMS client or remove an existing product key: the script reads the current edition through slmgr and routes it to the correct activation method (HWID for Windows, Ohook for Office).

• Windows 7 SP1 / 8.1 / 10 / 11 — all editions (Home, Pro, Education, Enterprise, IoT, LTSC)
• Windows Server 2008 R2 through Server 2025
• Office 2010, 2013, 2016, 2019, 2021, 2024 and Microsoft 365 Apps
• Architectures: x86, x64, ARM64
• .NET Framework 4.6+ (preinstalled on Windows 8.1 and later)

Windows 10 ESU Troubleshooting: Common Errors & Fast Fixes

Most Windows 10 ESU failures fall into three buckets: antivirus interference, missing administrator rights, or a corrupted Software Protection Service. If you see error 0xC004F074 the KMS host could not be contacted — disable Defender real-time scanning for two minutes, then re-run the activator. Error 0xC004C003 means the product key is blocked by Microsoft; switch to the HWID method, which bypasses key validation entirely by binding the licence to your motherboard's hardware ID. Error 0x80070005 (Access Denied) is always a UAC issue — right-click the executable and select "Run as administrator". If activation succeeds but reverts after reboot, open services.msc, set "Software Protection" to Automatic, and restart sppsvc.exe. For Office, run the Office Click-to-Run repair from Settings → Apps → Microsoft 365 → Modify → Quick Repair before retrying Ohook.

• 0xC004F074 — pause antivirus, re-run as administrator
• 0xC004C003 — switch to HWID (no key required)
• 0x80070005 — UAC denied, use "Run as administrator"
• Activation reverts on reboot — set "Software Protection" service to Automatic
• Office not detected — run Quick Repair, then re-run Ohook