Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
The Extended Security Updates (ESU) program allows organizations to receive critical and important security updates for devices enrolled in the paid subscription service. ESU extends the use of enrolled devices past the end of support date. This article provides instructions on how to enable the ESU keys in commercial environments.
Select your Windows 10 release to see the requirements and activation IDs that apply to your device:
ESU extends the use of Windows 10 Enterprise 2016 LTSB and Windows 10 IoT Enterprise 2016 LTSB devices past the end of support date on October 13, 2026.
Prerequisites
Before you enable ESU, make sure that your devices meet the following prerequisites:
Device requirements:
- Windows 10 Enterprise LTSB 2016 or Windows 10 IoT Enterprise 2016 LTSB
- September 2026 servicing stack update (SSU) (KB5122874) and September 2026 Windows security update (KB5123099), or later updates
- Administrative privileges on the device
Microsoft 365 admin center:
To view the Multiple Activation Key (MAK) in the Microsoft 365 admin center, your Microsoft Entra ID account must have the Product Key Reader or VL Administrator role assigned. For more information, see Understand volume licensing roles.
Endpoints for client activation:
https://go.microsoft.com/https://login.live.com/https://activation.sls.microsoft.com/http://crl.microsoft.com/https://validation.sls.microsoft.com/https://activation-v2.sls.microsoft.com/https://validation-v2.sls.microsoft.com/
Locating your Windows 10 ESU Multiple Activation Key (MAK)
If you purchased ESU licenses, you need to activate them on each Windows 10 device by using a Multiple Activation Key (MAK) that you get from the Microsoft 365 admin center.
Note
You must have the Product Key Reader or VL Administrator role assigned to your Microsoft Entra ID account to view the MAK. For more information, see Understand volume licensing roles.
Note
For MAK keys for Windows 10 IoT Enterprise LTSB 2016, please contact your OEM partner.
To find the ESU license MAK, follow these steps:
- In the admin center, go to the Billing > Your Products page and select the Volume licensing tab.
- In the Contracts section,select View contracts.
- On the Contracts page, find the License ID where the ESU licenses are. Select the three dots (More actions), then select View product keys. The Product keys details page includes contract details and a list of all keys for that contract.
If you can't find your MAK, Contact volume licensing.
Install and activate the ESU key
Use slmgr.vbs to manage licensing and activation on devices. The device needs access to the internet and to Microsoft Activation Servers. If the device can't access either of these, see Activate ESU keys offline via Microsoft Product Activation Portal. To install the ESU key on clients, use the following steps:
Open an elevated command prompt window on the device.
Run the following command to install the ESU key. Replace
<ESU MAK>with the actual ESU MAK you got from the Microsoft 365 admin center:Windows command prompt
slmgr.vbs /ipk <ESU MAK>After you run this command, a Windows Script Host dialog box appears and states the product key was installed successfully.
Find the ESU Activation ID by using the following table:
For Windows 10 Enterprise 2016 LTSB:
ESU Program Activation ID Win10 2016 LTSB ESU Year1 1b7dbf52-c417-4134-8d68-259906682e61 Win10 2016 LTSB ESU Year2 deb6f308-6dff-4148-9d6f-eb2bd2fee619 Win10 2016 LTSB ESU Year3 f2571710-2c24-4677-8fb5-a07d41d3c1aa For Windows 10 IoT Enterprise 2016 LTSB:
ESU Program Activation ID Win10 IoT 2016 LTSB ESU Year1 d9e51906-1f62-433c-a51c-fac68409f27e Win10 IoT 2016 LTSB ESU Year2 582e0cc5-e6a0-446d-9171-fba8df936af4 Win10 IoT 2016 LTSB ESU Year3 d1a20517-ad12-4bc3-9db2-c5b1647fbc87
Note
The activation IDs are the same across all eligible Windows ESU editions and all devices enrolled for that program.
From the elevated command prompt window, run the following command to activate the ESU key. Replace
<Activation ID>with the actual ESU Activation ID you got in the previous step:Windows command prompt
slmgr.vbs /ato <Activation ID>After you run this command, a Windows Script Host dialog box appears and states the product was activated successfully.
Verify that the ESU key is installed and activated. To do this, run the following command from an elevated command prompt:
Windows command prompt
slmgr.vbs /dlvThe output shows the Name of the corresponding ESU program and the License Status as ”Licensed” for that program.
Activate ESU keys offline via Microsoft Product Activation Portal
If the device doesn't have internet access or can't reach the Microsoft Activation Servers, you can activate ESU keys manually. Use the following steps on a device that can access the internet.
Open an elevated command prompt window on the device.
Use slmgr.vbs to manage licensing and activation on devices.
Run the following command to install the ESU key. Replace
<ESU MAK>with the actual ESU MAK you got in the previous section:Windows command prompt
slmgr.vbs /ipk <ESU MAK>After you run this command, a Windows Script Host dialog box appears and states the product key was installed successfully.
Verify that the ESU key is installed. To do this, run the following command from an elevated command prompt:
Windows command prompt
slmgr.vbs /dlvFind the ESU Activation ID using the following table:
For Windows 10 Enterprise 2016 LTSB:
ESU Program Activation ID Win10 2016 LTSB ESU Year1 1b7dbf52-c417-4134-8d68-259906682e61 Win10 2016 LTSB ESU Year2 deb6f308-6dff-4148-9d6f-eb2bd2fee619 Win10 2016 LTSB ESU Year3 f2571710-2c24-4677-8fb5-a07d41d3c1aa For Windows 10 IoT Enterprise 2016 LTSB:
ESU Program Activation ID Win10 IoT 2016 LTSB ESU Year1 d9e51906-1f62-433c-a51c-fac68409f27e Win10 IoT 2016 LTSB ESU Year2 582e0cc5-e6a0-446d-9171-fba8df936af4 Win10 IoT 2016 LTSB ESU Year3 d1a20517-ad12-4bc3-9db2-c5b1647fbc87
Note
The activation IDs are the same across all eligible Windows ESU editions and all devices enrolled for that program.
Get the Installation ID (IID) from the device. To do this, run the following command in an elevated command prompt. Replace
<Activation ID>with the actual ESU Activation ID you got in the previous step:Windows command prompt
slmgr.vbs /dti <Activation ID>Once you have the Installation ID, connect to the Microsoft Product Activation portal from another device. It walks you through the steps to get the Confirmation ID. Make a note of your Confirmation ID.
From the elevated command prompt window, run the following command to activate the ESU key. Replace
<Activation ID>with the actual ESU Activation ID you got from the chart. Replace<Confirmation ID>with the actual Confirmation ID you received from the Microsoft Licensing Activation Center:Windows command prompt
slmgr.vbs /atp <Confirmation ID> <ActivationID>Note
The Confirmation ID shouldn't have spaces in it.
Verify that the ESU key is installed and activated. To do this, run the following command from an elevated command prompt:
Windows command prompt
slmgr.vbs /dlvThe output should show the Name of the corresponding ESU program and the License Status as ”Licensed” for that program.
Activate large numbers of devices that don't have internet access
For more information about manually activating large numbers of devices, see the Volume Activation Management Tool (VAMT) Proxy Activation scenario. To help ensure you have the latest VAMT, install the latest Automated Deployment Kit (ADK) tool. Additionally, install an update to the VAMT from the Microsoft Download Center to include updated configuration files for Windows 10 ESU MAK keys.
Adding activations to Windows 10 ESU keys
You might need to add activations to an ESU key, such as for reimaging scenarios. For more information about adding activations to a Windows 10 MAK, see Request an increase to MAK activation limits.