Windows 10 after October 2026: your security updates now run to 2027
Microsoft has extended free and paid Windows 10 Extended Security Updates for home PCs to 12 October 2027. How to check you’re enrolled, how to enrol, why the Enroll now link might be missing, what keeps working without it, and what to do if your PC can’t run Windows 11, with a checker.
HanaHow6 minute readWindows 10 support ended on 14 October 2025. Since then, home PCs have got their security fixes through Extended Security Updates, or ESU, which were due to stop on 13 October 2026. In June 2026 Microsoft moved that to 12 October 2027. If your PC is enrolled, you don’t need to do anything. If it isn’t, it hasn’t had a new Windows security fix since October 2025, and you can still join. The checker below works out where you stand and what to do next.
Are you enrolled in ESU?
Open Settings, then Update & Security, then Windows Update. An enrolled PC says so there. Security updates for enrolled home PCs now run to 12 October 2027.
Enrol, then plan what’s next
Click Enroll now and follow the steps. You’ll need to sign in with a Microsoft account. Once you’re enrolled, the security fixes you’ve missed since October 2025 install too.
- Free if you sync your PC settings to your Microsoft account with Windows Backup.
- Or 1,000 Microsoft Rewards points, or a one-off $30 plus tax, or the same in your currency.
- One enrolment covers up to 10 PCs. On each extra PC, click Enroll now and sign in with the same Microsoft account.
- In the European Economic Area, it’s free without syncing, as long as you keep signing in to Windows with that Microsoft account. If you don’t, the updates stop within 60 days and you have to enrol again. There’s no points option there, and the same rules apply in Switzerland.
Enrolled? Next, see whether this PC can move to Windows 11 before October 2027.
See this in the guideWhy there’s no Enroll now link
Microsoft only offers it when all of these are true.
- Windows 10 Home, Pro, Pro Education or Pro for Workstations. Education and Enterprise editions, common on ex-school and ex-office PCs, don’t get it. Settings, System, About shows your edition.
- Version 22H2 with every update installed. Run Windows Update until it finds nothing more, then restart and check again.
- You’re signed in as an administrator, not on a child account.
- The PC isn’t managed by a work or school: not joined to a domain or Microsoft Entra ID, not managed by device management software, and not in kiosk mode.
Did that bring the link up?
See this in the guideAsk whoever manages it
The free and $30 routes are for personal PCs. A PC managed by a work or school can only get updates if that organisation pays for business ESU, so ask their IT team what they’re doing about Windows 10.
Does PC Health Check pass?
Windows 11 is a free upgrade for PCs that meet its requirements. Microsoft’s PC Health Check app tells you whether yours does, and what’s stopping it. Search for it in the Start menu, or download it from Microsoft.
See this in the guideMove to Windows 11 before October 2027
- Back up first. Windows Backup can use OneDrive, but only 5 GB is free, so copying your folders to an external drive is often easier.
- Open Settings, Update & Security, Windows Update and click Check for updates. When Windows 11 is ready for your PC, it shows there. It’s free.
- If you’re enrolled in ESU, stay enrolled until you’ve upgraded. After that, Windows 11 gets its own updates.
Check TPM is switched on
TPM 2.0 is a security chip on the motherboard or built into the processor. On many home-built PCs it’s there but switched off in the firmware settings.
- Press Windows + R, type tpm.msc and press Enter. If it says “Compatible TPM cannot be found”, the TPM may be switched off, so keep going. If it says the TPM is ready, check that Specification Version, under TPM Manufacturer Information, says 2.0. A 1.2 chip can’t be switched to 2.0.
- If your drive is encrypted with BitLocker or device encryption, find your recovery key first. It’s usually saved in your Microsoft account.
- Look up your PC or motherboard maker’s instructions for turning TPM on in the firmware (UEFI or BIOS) settings. It may be called Intel PTT, AMD fTPM or Security Device.
- Save, restart, and run PC Health Check again.
Does it pass now?
See this in the guideSecure Boot needs UEFI mode
Windows 11 needs a PC that starts in UEFI mode and can use Secure Boot. Older PCs are often set to the legacy BIOS mode instead.
- Press Windows + R, type msinfo32 and press Enter. Check BIOS Mode and Secure Boot State.
- If your drive is encrypted with BitLocker or device encryption, find your recovery key before changing any firmware settings. It’s usually saved in your Microsoft account.
- If it says UEFI, this check should pass. If it doesn’t, look in the firmware settings for a Legacy or CSM option and set UEFI as the first or only choice, following your PC maker’s instructions. Turning Secure Boot on as well is good for security.
- If it says Legacy, two things have to happen, in this order: the disk is converted from MBR to GPT, then the firmware is switched from Legacy (or CSM) to UEFI. Until you make the second change, the PC won’t start. Microsoft’s MBR2GPT tool does the conversion, but it’s a command-line tool and can’t be undone. Back up everything first, check your PC maker says it supports UEFI, and get help if you’re not confident.
Does PC Health Check pass now?
More memory or a bigger drive can fix this one
Windows 11 needs at least 4 GB of RAM and 64 GB of storage. On many desktops and some laptops you can add memory or swap the drive. If the processor and TPM already pass, that may be all it takes.
This PC can’t take Windows 11. Your choices.
If PC Health Check says the processor isn’t supported, no setting changes that. Microsoft’s approved list starts at roughly Intel’s 8th generation or AMD Ryzen 3000. The same goes if there’s no TPM 2.0 or the PC can’t start in UEFI mode.
- Stay on ESU until 12 October 2027 while you save up for a new PC.
- ChromeOS Flex: free from Google, and turns it into something like a Chromebook. Check your model is on Google’s certified list first. It wipes the drive.
- Linux Mint: free, and laid out a lot like Windows. Try it from a USB stick before you install.
- Keep it offline: much safer, but mostly a typewriter.
- Forcing Windows 11 onto it isn’t recommended by Microsoft, and those PCs aren’t guaranteed updates, including security ones.
- Whatever you choose, back up first.
What changed
Microsoft’s consumer ESU programme was due to end on 13 October 2026. On 25 June 2026 Microsoft updated its ESU and end of support pages, and added an editor’s note to a Windows Experience Blog post from June 2025, saying ESU for personal devices is being provided for an additional year, with coverage now available through 12 October 2027. There was no big announcement.
- Already enrolled? Your coverage carries on to that date automatically. There’s nothing to do.
- Not enrolled? You can enrol any time until the programme ends. Once you’re enrolled, the PC gets all the critical and important security updates released since 14 October 2025, so it catches up on what it missed.
What ESU gives you
ESU is critical and important security updates only. There are no new features, and no technical support apart from help with activating ESU and installing its updates. Your PC keeps working either way: without updates, it just stops getting fixes for new security holes in Windows.
Check whether you’re enrolled
Open Settings, then Update & Security, then Windows Update. An enrolled PC says so there. If yours isn’t enrolled, look for an Enroll now link on the same page.
How to enrol
Click Enroll now and follow the steps. You’ll need to sign in with a Microsoft account, and there are three ways to pay for it:
- Free, if you use Windows Backup to sync your PC settings to your Microsoft account.
- 1,000 Microsoft Rewards points.
- A one-off $30 plus tax, or the local equivalent in your currency.
One enrolment covers up to 10 PCs. On each extra PC, click Enroll now and sign in with the same Microsoft account.
In the European Economic Area the rules differ. ESU is free without syncing your settings, as long as you keep signing in to the PC with that Microsoft account; if you don’t, the updates stop within 60 days and you’ll have to enrol again. There’s no Rewards points option there, and the same rules apply in Switzerland. The UK isn’t in the European Economic Area, so the three routes above apply.
No Enroll now link?
Microsoft only offers ESU when all of these are true:
- The PC runs Windows 10 Home, Pro, Pro Education or Pro for Workstations. Education and Enterprise editions, common on ex-school and ex-office PCs, don’t get the consumer offer. Settings, System, About shows your edition.
- It’s on version 22H2 with every update installed, including the ESU licensing preparation package (KB5126256). Run Windows Update until it finds nothing more, restart, and check again.
- You’re signed in as an administrator, not on a child account.
- It isn’t managed by a work or school: not joined to a domain or Microsoft Entra ID, not managed by device management software, and not in kiosk mode. For a PC like that, ask whoever manages it.
What keeps working without ESU
- Microsoft Edge keeps getting updates on Windows 10 22H2 until at least October 2028.
- Microsoft 365 apps (the subscription version of Word, Excel and Outlook) keep getting security updates until 10 October 2028. Their feature updates have stopped. One-off Office is different: Office 2016 and 2019 have already stopped getting fixes, and Office 2021 stops on 13 October 2026.
- Microsoft Defender keeps getting new virus definitions until October 2028.
- Google Chrome still lists Windows 10 as supported.
None of that fixes Windows itself. Microsoft’s own advice is that antivirus on its own isn’t enough: without ESU, new security holes in Windows stay open.
Move to Windows 11 if your PC can
The real deadline is now October 2027. Windows 11 is a free upgrade for PCs that meet its requirements, and Microsoft’s PC Health Check app tells you whether yours does, and what’s stopping it. In plain words, the main things Windows 11 needs are:
- A processor on Microsoft’s approved list: roughly Intel’s 8th generation or AMD Ryzen 3000 onwards, with some exceptions both ways. No setting changes this one.
- TPM 2.0: a security chip on the motherboard or built into the processor. On many home-built PCs it’s there but switched off in the firmware (UEFI or BIOS) settings, where it may be called Intel PTT, AMD fTPM or Security Device. Check your PC or motherboard maker’s instructions before you give up.
- UEFI with Secure Boot: older PCs set to legacy BIOS mode fail this. Fixing it means converting the disk with Microsoft’s MBR2GPT tool, then switching the firmware to UEFI mode, or the PC won’t start. It can’t be undone, so back up first and get help if you’re not confident.
- At least 4 GB of RAM and 64 GB of storage.
If your drive is encrypted with BitLocker or device encryption, find your recovery key before changing any firmware settings. It’s usually saved in your Microsoft account.
If PC Health Check passes, back up, then open Settings, Update & Security, Windows Update and click Check for updates. When Windows 11 is ready for your PC, it shows there.
If your PC can’t run Windows 11
- Stay on ESU until 12 October 2027 while you save up for a new PC.
- ChromeOS Flex is free from Google and turns the PC into something like a Chromebook. Check your model is on Google’s certified list first, and know that installing it wipes the drive.
- Linux Mint is free and laid out a lot like Windows. You can try it from a USB stick before installing it.
- Keep it offline. An offline Windows 10 PC is much safer. It’s also mostly a typewriter.
There are ways to force Windows 11 onto a PC that doesn’t qualify. Microsoft says this isn’t recommended, and that those PCs aren’t guaranteed to receive updates, including security updates. We don’t recommend it either.
Back up first
Whatever you choose, back up your files before you change anything.
- Windows Backup can back up to OneDrive, but only 5 GB of storage is free. Bigger backups need a Microsoft subscription or trial.
- An external drive is often easier: copy your Documents, Pictures, Desktop and any other folders you use onto it, and check they open before you go further.
Read the video transcript
Heard Windows 10 stops getting security updates this October? Microsoft's quietly added a year. If you're enrolled. Windows 10 support ended in October twenty twenty-five. Since then, security fixes have come through Extended Security Updates, or ESU, due to stop on the thirteenth of October, twenty twenty-six. In June, Microsoft moved that to the twelfth of October, twenty twenty-seven. There was no big announcement, just updated support pages and an editor's note on a year-old blog post. Already enrolled? Your updates just carry on. Not enrolled? Then your PC hasn't had a new Windows security fix since October twenty twenty-five. You can still join, and it catches up on what you've missed. ESU is security fixes only: no new features and no technical support. To check, open Settings, Update and Security, Windows Update. An enrolled PC says so there. If yours doesn't, look for the Enroll now link. It's free if you sync your PC settings to a Microsoft account. Otherwise it's a thousand Microsoft Rewards points, or a one-off thirty dollars plus tax, or the same in your currency. One enrolment covers up to ten PCs. No Enroll now link? The PC needs Windows 10 Home or Pro, version 22H2, with every update installed, and you need an administrator account, not a child account. PCs managed by a work or school aren't offered it. Some things carry on without ESU. Microsoft Edge gets updates until at least October twenty twenty-eight. Microsoft 365 apps get security updates until then too, and Defender keeps getting new virus definitions. Chrome still lists Windows 10 as supported. But none of that fixes Windows itself, so without ESU, new holes in Windows stay open. So the real deadline is now October twenty twenty-seven. Before then, move to Windows 11 if your PC can take it. It's free. Microsoft's PC Health Check app tells you whether yours qualifies, and what's stopping it. The usual problems are the processor, which has to be on Microsoft's approved list, roughly Intel's eighth generation or AMD Ryzen three thousand onwards, and TPM 2.0, a security chip on the motherboard or built into the processor. On a lot of home-built PCs, it's there, just switched off in the firmware settings, so check the maker's instructions first. It may have been in there for years, saying nothing. Can't upgrade? Stay on ESU while you save up for a new PC. Or turn it into something like a Chromebook with ChromeOS Flex, free from Google, if your model's on its certified list. Or install Linux Mint, which is free and laid out a lot like Windows. Or keep it offline. An offline Windows 10 PC is much safer. It's also mostly a typewriter. There are ways to force Windows 11 onto a PC that doesn't qualify, but Microsoft says it isn't recommended, and those PCs aren't guaranteed updates, including security ones. Whatever you choose, back up your files first. Windows Backup can use OneDrive, but only five gigabytes is free, so an external drive is often easier. The written guide has a checker for which of these suits your PC. That's HanaHow. See you next time.
Something not quite right?
Let us know
