You open Settings > Update & Security > Windows Update expecting to see an "Enroll Now" button or banner for Extended Security Updates, and there is nothing. No option, no link, no mention of ESU. The page looks exactly as it did before the programme launched. This is one of the most common questions from people following our Windows 10 ESU guide, and in every case I have investigated, the cause falls into one of five categories. Below we work through them from fastest to check to most involved.
If you are not sure whether ESU is the right move for your machine in the first place, read the post-October 2025 security checklist first. If your hardware is older than about 2012, the cost-benefit analysis may point toward lightweight Linux instead.
What Must Be True Before the Button Appears
The ESU enrollment interface is not always present in Windows Update. Microsoft gates it behind several conditions that must all be met simultaneously. If any single prerequisite is missing, the option is suppressed entirely — there is no partial state or error message telling you which one failed.
- Windows 10 version 22H2. Earlier feature versions (21H2, 21H1, 2004, or anything older) do not support ESU enrollment at all.
- ESU preparation update installed. The specific prerequisite KB (KB5040525 or its successor) must be present. This update adds the enrollment infrastructure to the Windows Update client.
- Current cumulative update. You must be reasonably up to date — at minimum, the last cumulative update before the end-of-support date. Machines that are months behind on updates may not show the option.
- Activated Windows licence. An unactivated or improperly activated installation will not display ESU enrolment. This includes volume licence machines whose KMS activation has lapsed.
- No Group Policy blocking Windows Update features. On domain-joined or Group Policy-tweaked machines, overly restrictive policies can hide the interface.
Check 1: Confirm Your Windows Version
This is a 10-second check and the single most common reason the button is missing.
Open the Run dialog
Press Win + R, type winver, and press Enter.
Read the version line
The dialog shows "Version 22H2" if you are on the correct feature version. If it says 21H2, 21H1, 2004, 1909, or anything else, you need to update first. Go to Settings > Update & Security > Windows Update and install the 22H2 feature update. This may take 30-60 minutes.
If 22H2 is not offered
Some machines with compatibility holds cannot receive 22H2 through Windows Update. Use the Windows 10 Update Assistant from Microsoft's website to force the upgrade. If even the Update Assistant refuses, your hardware may have a known incompatibility — in that case, ESU is not an option on this machine.
Check 2: Verify the ESU Preparation Update
Open update history
Go to Settings > Update & Security > Windows Update > View update history. Search for KB5040525. If it is not listed, the preparation update was never installed.
Install it manually if missing
Visit the Microsoft Update Catalog, search for KB5040525, download the version matching your architecture (x64 or x86), and install it. Reboot when prompted. After reboot, check Windows Update again — the enrollment option often appears within minutes.
If the KB fails to install
A failed installation of the preparation KB usually indicates corruption in the Windows Update component store. Run DISM /Online /Cleanup-Image /RestoreHealth from an elevated Command Prompt, followed by sfc /scannow. Then retry the KB installation. If DISM itself fails with source file errors, you may need a Windows 10 ISO as a repair source.
Check 3: Licence Activation Status
Check activation
Go to Settings > Update & Security > Activation. The status should say "Windows is activated with a digital licence" or "Windows is activated with a digital licence linked to your Microsoft account." Any other message — including "Windows is not activated" or error codes — means the ESU option will not appear.
Reactivate if needed
If activation was lost after a hardware change (motherboard or major component swap), use the Activation Troubleshooter on the same page. It can often reactivate using a linked Microsoft account. For machines that were originally activated via a product key, re-enter the key through "Change product key."
Volume licence and KMS machines
If this is a business machine that originally activated against a KMS server, the activation may have expired if the machine has been off the corporate network for more than 180 days. You will need either a MAK key or renewed KMS connectivity to reactivate. Without valid activation, ESU enrollment is blocked.
Check 4: Group Policy and Registry Blocks
Open Group Policy Editor (Pro and Enterprise)
Press Win + R, type gpedit.msc, and press Enter. Navigate to Computer Configuration > Administrative Templates > Windows Components > Windows Update. Check that "Remove access to use all Windows Update features" is set to Not Configured or Disabled. If it is Enabled, it hides the ESU enrollment interface along with other update controls.
Check WSUS configuration
In the same Group Policy path, look for "Specify intranet Microsoft update service location." If this points to an internal WSUS server that is no longer available, the machine cannot reach Microsoft's update endpoints and will not display the ESU option. Set this to Not Configured to return to default Microsoft Update behaviour.
Home editions: check registry directly
Home editions lack gpedit.msc, but registry keys can still block updates. Open regedit and navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate. If this key exists with restrictive values (such as DisableWindowsUpdateAccess set to 1), delete the value or set it to 0. Reboot afterward.
Check 5: Regional Restrictions and Phased Rollout
Microsoft rolled out ESU enrollment in phases. Some regions received access weeks later than others. If you have verified every check above and the button is still absent, consider these factors:
- Region and language settings. Ensure your Windows region (Settings > Time & Language > Region) matches the country where the licence was purchased. Mismatched region settings have been reported to delay enrollment availability.
- Phased rollout timing. After meeting all prerequisites, allow up to 48 hours for the option to populate. Check Windows Update and run "Check for updates" once daily rather than repeatedly.
- Windows Update reset. If more than a week has passed, try resetting the update components: stop the wuauserv and bits services, rename the
C:\Windows\SoftwareDistributionfolder, restart both services, and run Check for updates. This forces a fresh sync with Microsoft's servers.
When to Stop Trying to Force ESU
If you have completed every check above and the enrollment option has not appeared after a week, the machine is likely not eligible for ESU through normal channels. This can happen if:
- The hardware has a compatibility hold that Microsoft has not documented publicly.
- The Windows installation was upgraded from a version that left residual state the ESU client does not recognise.
- The licence was originally an education, evaluation, or other restricted SKU.
At this point, continuing to troubleshoot yields diminishing returns. The practical options are:
- Stay on Windows 10 without ESU and follow a disciplined security hardening approach — see our security checklist.
- Switch to lightweight Linux if the machine is primarily used for browsing and basic productivity — see our lightweight Linux guide.
- Try ChromeOS Flex for a simpler, auto-updating environment — see our ChromeOS Flex vs Linux comparison.
For machines that are more than ten years old, the laptops worth saving checklist can help you decide whether investing further time in this machine makes sense at all. An SSD upgrade paired with lightweight Linux often delivers a better experience than ESU on marginal hardware anyway.
Microsoft Support and Community Resources
If you believe the machine should be eligible and you have exhausted every check on this page, the remaining escalation paths are:
- Microsoft Support. Open a support request through support.microsoft.com. The "Windows Update" and "Activation" categories are the most relevant. Be ready to provide your Windows version (winver output), activation status, and the list of checks you have already completed.
- Microsoft Answers forum. Search the community forum for your specific symptom. Several ESU enrollment edge cases have been documented by other users, and Microsoft staff do occasionally post workarounds.
- Clean install. As a last resort, a clean installation of Windows 10 22H2 from official media, followed by full Windows Update, sometimes resolves enrollment issues caused by residual state from previous upgrades. Back up everything first — see our backup and safety notes.