Problem with Windows 10 ESU

Question

Hello,

I'm an IT administrator in a school. We bought Windows 10 ESU 3-year licences for our 21 computers. We activated them according to the instructions from the foollowing site: https://learn.microsoft.com/en-us/windows/whats-new/enable-extended-security-updates#get-the-product-keys-for-activating-extended-security-update-esu-licenses

The "slmgr.vbs /dlv" command says they are all properly activated, but Windows Update says something opposite:

It happens on all computers. They have all updates (up to October) installed

Did you have a similar experience?

I read somewhere that it's only a visual bug end ESU is working correctly.

Can you confirm?

Best regards,

Maciej Sac

Answer 1

It's general (consmetic) bug that appear on all Windows 10 22H2 or even LTSC 2021, because the people who designed the code made only check for Consumer ESU

you can ignore for now, they will probably fix it with next update

Answer 2

Hi Maciej,

You did the right thing checking slmgr, but the banner in Settings is not the authority for ESU. On Windows 10, devices licensed through ESU can keep showing the end-of-support message even when they are eligible and will receive ESU updates. Microsoft's verification method is different from that banner.

The quickest way to confirm ESU on any one machine is to check two things.

First, open Event Viewer and browse to Applications and Services Logs > Microsoft > Windows > ClipESU > Operational. Look for Event ID 113 that says the W365 ESU license was successfully installed. That event is Microsoft's signal that the ESU license is in place.

Second, check the ESU eligibility flag in the registry. From an elevated PowerShell window run:

(Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\ESU').Win10CommercialW365ESUEligible

A value of 1 means the device is enrolled and eligible to receive ESU updates. This key and value are the documented check.

If you see Event 113 and that registry value is 1, you can ignore the Settings banner. The device will pick up the monthly ESU security CUs when Microsoft releases them. Microsoft's ESU pages describe the program and its scope, but they point admins to the ClipESU event and that registry value for confirmation rather than the Settings UI.

If either check is missing on any PC, tell me which one and we will fix that point next.

Answer 3

KB5065429 update installed (released September 9, 2025)

KB5063709 and KB5065429 are the updates required prior to adding a MAK key using slmgr.vbs I do believe...

We have had to edit ESUEligibilty value to 3, however it reverts to 1 after reboot or after some time... Havent been able to determine the missing step..

Answer 4

If I change the ESUEligibility to 3.

Then the Windows update works! For awhile.

After awhile it rolls back to 1.

Has anyone submitted a support incident with MS to determine if and when there will be an update to correct this?

Answer 5

Adding this registry key and restarting the service made it respect the ESU license for our Enterprise version of Windows 10.

if (-not (test-path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\ESU')) {new-item 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\ESU' -force}

New-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\ESU' -Name Win10CommercialKeybasedESUEligible -Type DWORD -Value 1 -Force

Restart-Service wuauserv -force