Windows 10 Pro ESU not applying on domain-joined PCs

You will not receive Extended Security Updates (ESU) from Windows Update while the OS image channel (OEM_COA_NSPL) does not match the ESU add‑on channel (VOLUME_MAK) even though slmgr shows the ESU add‑on as Licensed. To receive ESU security updates you must either align the OS channel with the ESU key (reimage/convert to a volume-channel image) or obtain an ESU entitlement that is valid for your OEM-channel installations from your reseller; otherwise the devices remain ineligible for ESU servicing despite the Licensed status shown by slmgr.

You are seeing a channel/edition mismatch. Your slmgr output shows the installed OS is Windows 10 Professional — OEM_COA_NSPL channel while the ESU add-on entry is Client-ESU-Year1 … VOLUME_MAK channel. A VOLUME_MAK ESU add-on can appear as "Licensed" at the licensing layer but servicing entitlement checks (Windows Update/ESU patches applicability) will still treat an OEM-channel Pro install as out-of-support when the ESU add-on’s channel does not match the OS channel. That is the root cause of the “Windows has reached end of life” message despite slmgr reporting the ESU add-on as Licensed.

Hi Anthony M,

Has your issue been solved? If it has, please accept the answer so that others can benefit too. If not, is there anything I can help you with? Please let me know.

Vivian

Dear Anthony M,

Here’s a focused checklist to find why machines still report EOL after the ESU key shows activated.

1. Confirm the Windows edition is ESU-eligible (Pro retail versus Pro volume/education/enterprise differences can affect entitlement).
2. Verify you installed the ESU product key correctly and activated it on each machine:
   • slmgr.vbs /ipk <ESU-MAK-key> then slmgr.vbs /ato and confirm with slmgr.vbs /dlv.
   1. Ensure the ESU prerequisite updates (the ESU enabling update that Microsoft required for the release year and the latest servicing stack updates) are installed on every PC; missing these updates causes Windows Update to still treat the device as out of support.
   2. Confirm the monthly ESU quality updates classification is available and that Group Policy or Windows Update for Business policies are not blocking or targeting the devices away from Microsoft Update.
   3. Check date/time and TLS connectivity to Microsoft Update servers so the system can validate entitlement and receive ESU patches.
   4. Inspect Windows Update logs and the Event Viewer Application/System logs for errors referencing ESU, entitlement, or license validation around the times you run activation.
   5. Verify the ESU MAK has remaining activations with your reseller/partner portal if you used MAK rather than an online entitlement; contact your reseller if activations are exhausted.
   6. Re-run slmgr.vbs /ato and capture the output and the Event ID entries for licensing to correlate failures for a single test machine.
   7. If you used a KMS host for other activations, ensure your KMS host or proxy isn’t interfering with ESU MAK activation on endpoints.
   8. As a fallback, test a clean repro on one machine: uninstall any nonessential update blockers, apply the prerequisite ESU update, install the ESU key, activate, and confirm Windows Update now offers ESU security-only updates.

If this helps, please hit “accept answer” — thanks and good luck 🙂

Best regards,

Vivian