how to enable Windows 10 extended support coverage in regedit

Question

My windows10 clients have older machines and not able to purchase new equipment and want to purchase the annual subscription with the latest updates and versions to qualify for the ESU but the update page never changes to show the enable box.

All have backed up on One Drive.

Is there an edit to regedit that forces the appearance when rebooted?

Answer 1

To enable Windows 10 Extended Security Updates (ESU), you need to follow specific prerequisites and procedures. Unfortunately, there is no registry edit that can force the appearance of the enable box for ESU in Windows 10. The process involves ensuring that your system meets the necessary requirements and that you have the appropriate subscription.

Here are the steps you should follow:

1. Ensure Device Requirements: Make sure your devices are running Windows 10, version 22H2 or later, and have the required updates installed, specifically KB5066791 and the Extended Security Updates (ESU) Licensing Preparation Package for Windows 10 (KB5072653).
2. Administrative Privileges: You need administrative privileges on the device to enable ESU.
3. Subscription Purchase: Ensure that you have purchased the ESU subscription, as it is a paid service that provides critical and important security updates after the end of support date on October 14, 2025.
4. Follow the Official Instructions: Refer to the official Microsoft documentation for detailed instructions on enabling ESU keys in commercial environments.

If you are still having issues with the update page not showing the enable box, it may be necessary to contact Microsoft support for assistance, as they can provide guidance specific to your situation.

---

References:

• Enable Windows 10 Extended Security Updates (ESU) for clients accessing cloud and virtual machines
• Extended Security Updates (ESU) program for Windows 10

Answer 2

Hi,

I wanted to follow up with one critical detail that often prevents the ESU option from appearing, even after applying the registry fixes for UseWUServer and Telemetry.

Since you mentioned these are "older machines" and the registry edit hasn't immediately triggered the button, you must verify the Windows Edition installed on the hardware.

The "Enable" button in Settings is exclusively for Windows 10 Pro and Home. These machines were previously part of a corporate fleet, they might be running Windows 10 Enterprise. The Enterprise edition doesn't support the in-app subscription purchase method (the button will never appear).

Check: Run winver in the Command Prompt.

If it says Enterprise: You can't use the "Enable" button. You must either downgrade the edition to Pro (by changing the product key) to see the subscription offer, or purchase a Commercial ESU Year 1 Key (Volume Licensing) and install it manually via the command line (slmgr /ipk <ESU_Key>).

Also, check your Login Identity: The subscription offer in Settings is designed for local accounts or personal Microsoft Accounts (MSA). If you are signed in with an Azure AD / Entra ID (Work or School) account, Windows often suppresses the consumer marketplace features because it expects the license to be pushed by your organization.

Test: Create a temporary Local Administrator account, log in with that, and check the Update page again.

I hope this clears up why the button might still be elusive. If this helps pinpoint the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

VP

Answer 3

Hi Don Gautereaux,

In 99% of cases where the ESU subscription offer is invisible on eligible Windows 10 machines, it is because the computer still has legacy "Enterprise" or "Managed" update policies active (leftover from old Group Policies, RMM tools, or WSUS configurations). The Windows Update agent sees these keys, assumes the device is managed by an IT department (which would push ESU keys via volume licensing), and therefore suppresses the "Retail/Consumer" subscription box you are looking for.

To "force" the appearance of the subscription box, you must strip these management flags so the device behaves like a standalone unit.

Step 1: You need to delete the keys that tell Windows to look at a corporate server instead of Microsoft directly.

Open Registry Editor (regedit.exe) as Administrator. Navigate to:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU

Look for a value named UseWUServer. If it exists and is set to 1, this is your blocker. Delete it (or set it to 0).

Navigate to:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate

Look for TargetReleaseVersion or TargetReleaseVersionInfo. If these are pinned to an old version (like 21H2), delete them. The ESU offer requires the agent to feel "free" to update.

Step 2: The Telemetry Requirement: The ESU eligibility check fails silently if the diagnostic data is strictly disabled (often done by "Privacy" tools or scripts). The agent cannot validate the hardware ID against the ESU cloud service without it.

Navigate to:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection

Look for AllowTelemetry. If it is set to 0 (Security only), change it to 1 (Basic/Required) or 3 (Full).

If the key doesn't exist, you are usually fine (it defaults to allowed).

Step 3: Flush and Reboot

Once you have removed the UseWUServer blocker and verified Telemetry: Open a Command Prompt as Administrator. Restart the update service to apply the registry changes immediately:net stop wuauservnet start wuauserv

Reboot the computer. Go back to Settings > Update & Security > Windows Update. Click Check for updates. The "Get Extended Security Updates" banner or box should now appear.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

VPHAN