Windows 10 security updates extended to October 2027: who gets them and how

Many Windows 10 users expected their free security updates to stop on 13 October 2026. They did not: Microsoft quietly extended the consumer Extended Security Updates (ESU) programme by a year, to 12 October 2027. This guide explains who gets the extra year, how to check that a PC is covered, and what businesses and IT teams should do instead.

In short

Windows 10 itself left support on 14 October 2025. Since then, only PCs enrolled in ESU receive security updates.
The consumer ESU programme now runs until 12 October 2027. PCs that were already enrolled stay covered automatically; nothing needs to be done.
You can still enrol until that date if the PC runs Windows 10 version 22H2 and is not joined to a company domain or managed by MDM (such as Intune).
ESU brings critical and important security fixes only: no new features and no technical support.
Company PCs need the paid commercial ESU or an upgrade to Windows 11. The consumer extension does not cover them.

What changed in 2026

When Windows 10 support ended on 14 October 2025, Microsoft offered home users one year of Extended Security Updates, ending on 13 October 2026. In June 2026 Microsoft updated its Windows Experience Blog post and its ESU page: the personal-use programme gets an additional year, with coverage through 12 October 2027.

Microsoft's lifecycle FAQ now lists both dates: year 1 ended on 13 October 2026, and year 2 ends on 12 October 2027. Many articles and forum answers written before June 2026 still give the old date, which is why so many people believe their updates have already stopped.

Which PCs get the extra year

The consumer programme is for personal devices. According to Microsoft's ESU page, a PC qualifies when:

it runs Windows 10, version 22H2, with the latest updates installed;
it runs a personal edition such as Home or Pro;
it is not joined to an Active Directory domain and not managed by a mobile device management service such as Microsoft Intune. Devices that are only registered in Microsoft Entra ID are allowed.

If you enrolled during the first year, your coverage simply continues. Microsoft states that already-enrolled devices stay covered through 12 October 2027 with no action needed.

Check that your PC is covered

Press Windows + R, type winver and press Enter. The window must show Version 22H2. Older versions get no ESU updates at all.
Open Settings > Update & Security > Windows Update. An enrolled PC says so on this page. If it shows an Enroll now link instead, the PC is eligible but not yet enrolled.
Click Check for updates and install everything offered. ESU updates arrive through Windows Update like any other monthly update.
Open Settings > Accounts > Access work or school. If a work account is listed as connected and managed by your organisation, the PC belongs to the commercial world and the consumer programme does not apply.

IT staff can check the join state from a command prompt with dsregcmd /status: DomainJoined : YES or an MDM enrolment means the device needs commercial ESU, not the consumer programme.

How to enrol if you have not yet

Enrolment stays open until the programme ends on 12 October 2027. Sign in to Windows with a Microsoft account that is an administrator on the PC, open Windows Update and select Enroll now. The wizard shows the options available in your region. In the first year these were: syncing your settings with Windows Backup, redeeming 1,000 Microsoft Rewards points, or a one-time purchase of US$30; in the European Economic Area enrolment was free with a Microsoft account. Check the current options on Microsoft's ESU page before you pay for anything.

ESU is a safety net, not a plan. It delivers only critical and important security updates: no new features, no bug fixes outside security, and no technical support from Microsoft.

Businesses and IT teams: the extension is not for you

Devices that are domain-joined or managed with Intune cannot use the consumer programme. For them Microsoft sells commercial ESU through volume licensing, priced per device and rising each year, for up to three years (until October 2028). Windows 10 virtual machines in Windows 365 and Azure Virtual Desktop receive ESU at no extra cost.

For most organisations the cheaper path is to finish the move to Windows 11 and use commercial ESU only for the machines that cannot move yet: production PCs tied to old software, lab equipment, or hardware that fails the Windows 11 requirements. Two things to plan alongside the upgrade:

Disk encryption. Check that every device escrows its BitLocker recovery key before you reinstall or upgrade it. Our guide to BitLocker startup PINs in Intune shows how to confirm escrow from the event log.
Secure Boot. The 2011 Secure Boot certificates expired in 2026. Updating them is a separate job from ESU, explained in our Secure Boot certificate guide.

Should you upgrade to Windows 11 instead?

If the PC can run it, yes: Windows 11 is free on eligible hardware and keeps receiving updates without enrolment. Run Microsoft's PC Health Check app to see whether the PC qualifies. The main requirements are a TPM 2.0 chip, UEFI firmware with Secure Boot, a supported processor, 4 GB of memory and 64 GB of storage.

A PC that fails the check is the case ESU was made for. Enrol it, keep it updated until October 2027, and use that time to plan its replacement instead of facing another deadline at the last minute.

Questions people ask

Did Windows 10 stop getting updates on 13 October 2026?

Not for enrolled consumer PCs. That was the end of ESU year 1. Microsoft extended the consumer programme, so enrolled PCs keep receiving security updates until 12 October 2027.

I enrolled last year. Do I need to pay or click anything again?

No. Microsoft states that devices already enrolled continue automatically through 12 October 2027.

Can I still enrol now?

Yes, until 12 October 2027, as long as the PC runs Windows 10 version 22H2 and is not domain-joined or managed by MDM.

Does ESU also cover Microsoft Office or my antivirus?

No. ESU covers Windows itself. Microsoft 365 apps, Microsoft Defender and third-party products follow their own support dates, so check each one separately.

What happens after 12 October 2027?

Consumer PCs then stop receiving security updates. Only commercial ESU continues, for organisations, until October 2028.