Search for Windows 10's deadline this week and you will still find page after page counting down to Tuesday, October 13, 2026, the day security patches for home PCs were supposed to stop. Plenty of those pages were written before June and never updated, and the date they repeat is now out of date. In late June, Microsoft moved the end of its consumer Extended Security Updates (ESU) program to October 12, 2027, and it did so without a press release: ZDNET found the change in two small edits to an existing support page and in an editor's note, dated June 25, 2026, stuck on the end of a blog post from June 2025. If you set a calendar reminder to panic next Tuesday, you can delete it. What you should do instead is spend ten minutes confirming that your PC is actually enrolled, because the extension only protects machines that signed up, and a Windows 10 PC that never enrolled has been missing Windows security patches since October 14, 2025.
What Microsoft Actually Changed
Windows 10 itself reached end of support on October 14, 2025. The consumer ESU program was Microsoft's one-year bridge after that date, delivering fixes rated critical or important through Windows Update to PCs running Windows 10 version 22H2. That bridge was due to close on October 13, 2026, and now closes on October 12, 2027. If you enrolled at any point in the past year, Microsoft says your coverage continues automatically, with nothing for you to click.
Two details matter more than the new date. You can still enroll today, or on any day before the program ends, and Microsoft says an enrolled PC then receives all the critical and important updates released since October 14, 2025, so the gap closes retroactively. But nothing protects the PC until it enrolls: Microsoft's own page warns that devices are "more vulnerable and susceptible to viruses and malware" before enrollment. ESU also covers security fixes only, which means no new features, no other bug fixes, and no technical support from Microsoft.
Check Whether Your PC Is Covered
Do this on every Windows 10 machine you look after, including the one in your parents' kitchen.
Open Settings, go to Update & Security, then Windows Update, and scroll to the bottom of the page. An enrolled PC shows a status message saying it is receiving security updates. A PC that never enrolled says "Your version of Windows has reached the end of support. Your device is no longer receiving security updates," and if the PC qualifies, you will also see an Enroll now link. When the link is missing, go back to Microsoft's prerequisites: Windows 10 version 22H2 in the Home, Pro, Pro Education, or Workstations edition, the latest Windows update installed, a Microsoft account with administrator rights that is not a child account, and a small licensing package called KB5126256. ZDNET's Ed Bott advises checking updates and your Microsoft account sign-in first, then installing that package by hand if the offer still doesn't appear; it adds license files but no security fixes.
Some machines will never see the offer at all. Microsoft excludes PCs in kiosk mode, PCs joined to an Active Directory domain or Microsoft Entra, PCs managed through mobile device management software, and anything that already carries an ESU license. Business customers pay a different rate, which ZDNET reports starts at $61 per device per year.
Three Ways to Enroll, and the One to Pick
All three routes get you the same protection through October 12, 2027, and all of them require signing in to a Microsoft account during enrollment.
- Sync your PC settings with Windows Backup. This costs nothing, and it is the fastest path if you already use Windows Backup.
- Redeem 1,000 Microsoft Rewards points. If you browse in Edge with a Microsoft profile, you may already have the balance. Starting from zero, ZDNET says the Bing mobile app earns about 500 points over two days, and daily quizzes and polls add roughly 100 to 200 points a day.
- Pay $30 once, plus tax, and be done before your coffee cools.
The Windows Backup route has a catch that the cheerful "free" label hides. The same screen offers to copy your personal folders to OneDrive, which starts with 5GB of default storage, so a PC with a bulging Documents folder can end up with a half-synced mess and a storage warning. ZDNET's workaround is to make sure you are not signed in to OneDrive before you enroll. My advice: check your Rewards balance first, and if it falls short, pay the $30 instead of turning on a backup you didn't want. For anyone who isn't going to enjoy a week of Bing quizzes, that is money well spent.
One license covers up to 10 Windows 10 PCs signed in to the same Microsoft account, so a household with three aging laptops pays once, not three times. On each additional PC, open the same Windows Update screen and select Enroll now, then choose Add device if you're already signed in with the enrolling account. And once a PC is activated, it stays covered even if you later sign out and go back to a local account, according to ZDNET, which is handy when the computer belongs to a relative who hates being asked for a password.
Can the PC Run Windows 11 Instead?
ESU buys time; it is not a destination. Microsoft's published minimums for Windows 11 are a 1GHz or faster processor with two or more cores on its compatible-CPU list, 4GB of RAM, 64GB of storage, UEFI firmware with Secure Boot, a TPM 2.0 chip, a DirectX 12 graphics card, and a 720p display larger than 9 inches. Microsoft's free PC Health Check app tells you whether your machine passes, and if it does, the upgrade arrives as a free download in Windows Update. Enrolling in ESU doesn't block that upgrade, so there is no reason to hold off on one for the other.
The processor is where most older machines fail. ZDNET puts the rough dividing line at PCs more than five or six years old, which tend to hit an error saying the CPU isn't on the official list. A TPM that is present but switched off is a different story, because Microsoft publishes instructions for turning one on in your firmware settings, and that fix costs nothing.
The workarounds deserve a straight answer. A registry edit and a USB installer built with Rufus both skip the CPU check, ZDNET has documented both, and Bott argues that the "you may not be entitled to future updates" warning Setup shows is a scare tactic. Microsoft, though, removed its own instructions for the registry change in December 2024, and Windows 11 24H2 and later require a CPU with SSE4.2 and PopCnt instructions, a check that even Rufus can't get around. Try this on a spare machine, not on the PC that holds your tax files. For a computer someone depends on, stay on supported Windows 10 with ESU until you replace it.
The Other October Dates: Secure Boot and Windows 11
Separately from ESU, the Microsoft Windows Production PCA 2011 certificate, which signs the Windows boot loader, expires on October 19, 2026, and Microsoft is replacing it with a 2023 certificate called Windows UEFI CA 2023. Two related 2011 certificates already expired in June. Your PC will keep starting and keep installing ordinary updates either way, but Microsoft says machines without the new certificates can no longer receive new protections for the early boot process, such as fixes to the Windows Boot Manager.
The new certificates are delivered through Windows Update, and according to ZDNET that covers Windows 11 PCs and Windows 10 PCs with an ESU subscription, which is one more reason to enroll. To check, open Windows Security, go to Device security, then Secure Boot. A green checkmark alone doesn't settle it; look for the sentence "Secure Boot is on and all required certificate updates have been applied." A yellow badge usually means a hardware or firmware limit is blocking the update, and Microsoft's advice is to contact the PC's manufacturer, because some models need a firmware update first. Per ZDNET, PCs built between 2012 and 2024 shipped with the 2011 certificates, while newer machines mostly have the replacements already. Before you touch any Secure Boot setting, save your BitLocker recovery key, because switching Secure Boot off can mean you need that key to open an encrypted drive.
Windows 11 owners have a date of their own. Per Microsoft's lifecycle page, version 24H2 for Home and Pro stops receiving updates on October 14, 2026, while 25H2 runs to October 13, 2027, and 26H2 became available on September 29. If Windows Update shows a newer feature update waiting, install it before the 14th.
If the PC Can't Make the Jump
A year of extra coverage gives you the chance to replace a machine on your own schedule instead of this week's. Just don't count on prices falling while you wait. We covered the laptop memory shortage in August, and when ZDNET reported on the extension in June, it described the AI-fueled RAM shortage as pushing PC prices sky-high with no signs of slowing, and read the extension partly as Microsoft avoiding a fight with PC makers who fear falling sales. If the old PC still handles email, banking, and a browser without complaint, enroll it and keep it running. Put the money toward the next machine when this one actually starts to fail.
A second option for a browser-and-email computer is to drop Windows entirely. Linux Mint offers a desktop that looks familiar to Windows users, and Google offers ChromeOS Flex as a free install for older PCs, though neither runs your Windows-only programs.
Microsoft may well stretch the deadline a second time; Bott's advice is not to bet against it, which is a fair read of a company that has already done it once. Planning around another reprieve is still a bad idea. Enroll this week, and set the reminder that actually matters for September 2027, a month before the program ends.