How to fix missing Extended Security Updates enroll option on Windows 10 before support ends

Some users are missing the Extended Security Updates enrollment option on Windows 10.
If your PC meets the requirements, you can try different troubleshooting steps and even manually force the option to appear by modifying the Registry and running the ClipESUConsumer.exe tool

On Windows 10, the option to enroll your computer in the Extended Security Updates (ESU) program should now be available through the “Windows Update” settings. However, if this is not the case, there are several troubleshooting steps you can take to resolve the issue.

Support for Windows 10 officially ends on October 14, 2025, which means Microsoft will stop providing security patches, maintenance updates, and technical support. Since many users aren’t ready to upgrade to Windows 11, the software giant is offering the ESU program to extend critical security updates until October 13, 2026.

The problem is that the enrollment option is still not showing up for many users. If this is your case, you can perform some troubleshooting steps to help resolve the issue and join the program.

Before proceeding with the troubleshooting steps, it’s worth noting that Microsoft has previously stated that the enrollment option is rolling out gradually and will take time to arrive on every compatible computer. However, it is expected to appear by October 14, 2025.

In addition, although it’s recommended to sign up as soon as possible, you can complete the enrollment before or after the operating system support ends.

In this guide, I’ll outline the different troubleshooting steps you can use to resolve the missing enrollment option issue on Windows 10.

Windows 10 ESU enrollment requirements
Fix missing Windows 10 ESU enrollment option

Windows 10 ESU enrollment requirements

To enroll in the Extended Security Updates program, the computer must meet the following requirements:

Edition: Windows 10 Home, Professional, Pro Education, or Workstation.
Version: Windows 10 22H2 with the latest updates installed.
Profile: Microsoft account profile configured as an administrator.

If you’re using a local account, you’ll be prompted to sign in with a Microsoft account. You cannot use an account with lower privileges than administrator.

The program is not available for other editions other than those mentioned above. Additionally, you cannot sign up for the security updates program on commercial devices, such as those connected to Active Directory, Mobile Device Management (MDM), or devices in Kiosk mode.

Fix missing Windows 10 ESU enrollment option

If the “Windows 10 support ends in October 2025” notification with the “Enroll now” option is missing on your computer, follow these recommendations.

Install the latest updates

Microsoft is making the ESU available for devices running Windows 11 22H2 with the latest cumulative update installed. This means that, at the time of writing, the device must already have the September 2025 Security Update (or a later update) installed.

To download and install the latest updates of Windows 10, follow these steps:

Open Settings.
Click on Update & Security.
Click on Windows Update.
Turn on the “Get the latest updates as soon as they’re available” toggle switch.
Click the “Check for updates” button to download the latest updates available.
(Optional) Click the “Download and install” option to apply a preview update.

Quick note: A preview is an optional update that includes all the non-security patches that Microsoft plans to release in the next Patch Tuesday rollout. You are not required to download these updates during the preview period.
Click the Restart now button.

Once you complete the steps, if an update is available, it will download and install automatically on your computer.

Sign in with a Microsoft account

As part of the enrollment process, the company is making it a requirement to use a Windows 10 administrator account linked to a Microsoft account, as the Extended Security Updates activation must be saved on your account. This is because Extended Security Updates is technically a paid service, although it can still be obtained for free.

In addition, it’s worth noting that you can enroll up to 10 computers using the same Microsoft account.

You may still find the option to enroll if you’re a local account, but to complete the process, you will have to link your Microsoft account. However, it might also be a reason why the option is missing on your computer.

To link your local account to your Microsoft account, follow these steps:

Open Settings.
Click on Accounts.
Click on Your Info.
Click the “Sign in with a Microsoft account instead” option for the Local account setting under the “Account settings” section.
Confirm your Microsoft account email address.
Click the Next button.
Confirm the account password.
Click the Sign in button.
Confirm the local account password.
(Option 1) Click the “Skip for now” option to skip the Windows Hello setup.
(Option 2) Click the Next button to create a PIN.
Create the new PIN to sign in to Windows 10.
Click the OK button.

After completing the steps, restart the computer and check the Windows Update settings for the “Enroll now” option.

Compatible Windows 11 PCs may not get the enrollment option

Some users have reported that computers compatible with Windows 11 are not displaying the ESU option. However, I do have a device that meets the requirements for the new version of the operating system, and the option is available.

If the option is missing, you can try temporarily disabling TPM 2.0 in the Unified Extensible Firmware Interface (UEFI) firmware to make the device incompatible, to see if this action triggers the Extended Security Updates enrollment options in the “Windows Update” settings.

To disable TPM 2.0 in the motherboards’ UEFI, follow these steps:

Open Settings.
Click on Update & Security.
Click on Recovery.
Click the Restart now button under the “Advanced startup” section.
Click on Troubleshoot.
Click on Advanced options.
Click the “UEFI Firmware settings” option.
Click the Restart button.
Click on the Advanced Security or Trusted Computing menu. Sometimes the option is available inside a sub-menu.
Select the TPM 2.0 option and choose the Disabled option.

It’s important to note that the option could have different names, such as Security Device, Security Device Support, or TPM State.

If the motherboard doesn’t have a TPM chip but you have an AMD-based system, the security chip is likely built into the processor. The option will then appear as “fTPM” (firmware-based TPM 2.0), “AMD PSP fTPM” or “AMD fTPM switch.”

If the device is an Intel-based system, TPM 2.0 will be available as “Intel Platform Trust Technology” or “Intel PTT.”

Once you complete the steps, you can check for updates in the “Windows Update” settings to see if the option becomes available.

Force Windows 11 ESU enrollment option manually

If, after trying the above troubleshooting steps, the sign-up option is still unavailable, you can attempt to force the option manually by ensuring that the “Connected User Experiences and Telemetry” service is enabled and adjusting the Registry.

Warning: Modifying system files can further damage your Windows installation if it’s not done correctly. It’s assumed that you know what you are doing and have previously created a full backup of your computer. Proceed with caution and use this as the last course of action.

To enable the enrollment option manually, follow these steps:

Open Start.
Search for Command Prompt (or Terminal), right-click the top result, and choose the Run as administrator option.
Type this command to set the Connected User Experiences and Telemetry service to start automatically and press Enter:
```
sc.exe config DiagTrack start= auto
```
Type this command to enable the DiagTrack service and press Enter:
```
sc.exe start DiagTrack
```

Type this command to add the following Registry key and press Enter:

reg.exe add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 4011992206 /t REG_DWORD /d 2 /f

Registry enable ESU keys

Restart the computer.
Open Start.
Search for Command Prompt (or Terminal), right-click the top result, and choose the Run as administrator option.

Type this command to enable the Extended Security Updates program and press Enter:

cmd /c ClipESUConsumer.exe -evaluateEligibility reg.exe query "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\ConsumerESU"

ClipESUConsumer enable ESU enroll option

Restart the computer.

After completing the steps, if the output is null (nothing) or 0x0, open the “Windows Update” settings, and confirm that the “Enroll now” option for the Windows 10 ESU program is available.

Update (1) September 25, 2025: If you receive the “You’ll need the Internet for this” message while trying to enroll your computer, please note that I’m seeing the same error on devices that already have the option available. As a result, this could be a problem with the operating system or the Microsoft cloud. If this is the case, wait some time and try again.

Windows 10 ESU Internet error / Image: Mauro Huculak

Update (2) September 25, 2025: After a few hours, clicking the “Retry” button or starting the process again started working on my installation.