Windows 10 ESU year 2: cost, dates and MAK activation for businesses

Windows 10 ESU year 2 is the second annual block of paid security updates for business PCs still on Windows 10. Microsoft's lifecycle table shows Year 1 coverage ending on October 13, 2026 and Year 2 coverage ending on October 12, 2027. At list price, Year 2 costs $122 per device, double the $61 Year 1 price, and Microsoft only sells it to organizations that also pay for Year 1.

Below are the dates, the cost math and the activation steps an IT team needs before the first Year 2 security release. Prices are in US dollars and all details are as of October 2026.

Windows 10 ESU dates for all three years

Windows 10 reached end of support on October 14, 2025, and the ESU period started that day. Microsoft's Lifecycle FAQ for Extended Security Updates lists these coverage windows for organizations:

• Year 1: October 14, 2025 to October 13, 2026
• Year 2: from the end of Year 1 to October 12, 2027
• Year 3: from the end of Year 2 to October 10, 2028

Each end date falls on that month's Patch Tuesday, so the October 13, 2026 security release is the last one inside the Year 1 window. The next scheduled monthly release is on November 10, 2026, which means Year 2 keys should be installed and activated on every enrolled device before then. Our Patch Tuesday calendar for 2026 and 2027 lists the other release dates inside the Year 2 window.

Microsoft describes three years as the maximum for commercial and educational devices, so October 10, 2028 is the last date of paid coverage on business PCs.

How much Windows 10 ESU year 2 costs

Microsoft's ESU program page sets the commercial Year 1 price at $61 per device through volume licensing and says the price doubles every consecutive year. Applying that rule gives:

• Year 1: $61 per device
• Year 2: $122 per device
• Year 3: $244 per device

The Year 2 and Year 3 figures are calculated from Microsoft's doubling rule rather than quoted from a price list. The original Windows IT Pro blog announcement also notes that regional prices vary with exchange rates at the time SKUs are ordered, so confirm the number with your licensing partner.

That same post announced a lower Year 1 price of $45 per device for organizations that manage updates with Microsoft Intune or Windows Autopatch, plus special pricing for nonprofits. Microsoft later said it would publish availability details for the cloud-based offer on its price list, so check whether it is on your agreement before you budget around it.

Joining late means paying for Year 1

ESU is cumulative. Microsoft states that an organization entering the program in Year 2 also has to pay for Year 1. At list price, bringing a device that skipped Year 1 into Year 2 costs $183, and covering one device for all three years costs $427. Licenses are sold by the year only, so a six-month purchase is not possible, and the minimum order is one license.

Which devices qualify for commercial ESU

• Windows 10 version 22H2. Older versions are not eligible.
• Pro, Enterprise or Education editions in commercial use, according to the Lifecycle FAQ.
• Not LTSB or LTSC releases. These follow their own lifecycles and sit outside the Windows 10 ESU program.

The LTSC exclusion matters this month. Microsoft's September 2026 Windows news roundup says Windows 10 Enterprise LTSB 2016 and IoT Enterprise LTSB 2016 reach the end of extended support on October 13, 2026, and Windows 10 Enterprise LTSC 2021 follows on January 12, 2027. Those devices need their own plan, and Microsoft points to separate ESU offerings for both releases.

Free coverage in Microsoft cloud and virtual environments

Windows 10 virtual machines receive ESU at no extra cost in Windows 365, Azure Virtual Desktop, Azure virtual machines, Azure Dedicated Host, Azure Local, Azure Stack Hub and Azure Stack Edge, with no key required, according to Microsoft's cloud and virtualization guide. The ESU program page also lists Azure VMware Solution (including Citrix and Omnissa Horizon) and Nutanix Cloud Clusters on Azure as no-cost destinations, but the guide warns that these platforms may need manual activation with a key from your Microsoft account team.

Physical Windows 10 PCs used to reach Windows 365 Cloud PCs can be covered too. Microsoft's conditions:

• The user has an active Windows 365 Enterprise license, or a Windows 365 Flex Cloud PC in dedicated mode.
• The local device is Microsoft Entra joined or Entra hybrid joined. Devices that are only Entra registered or only joined to on-premises Active Directory do not qualify.
• Admins deploy the EnableESUSubscriptionCheck setting through Intune or another MDM tool.
• The user signs in to the physical device with the same Entra ID account they use for the Cloud PC at least once every 22 days.

How to activate Windows 10 ESU year 2 with a MAK

For physical PCs licensed through volume licensing, each ESU year has its own activation ID, so the Year 2 license is installed and activated separately from Year 1. The steps in Microsoft's ESU enablement guide are:

1. Make sure the device runs Windows 10 22H2 with a security update released on or after October 14, 2025, followed by the ESU Licensing Preparation Package. Devices enrolled in Year 1 already meet this. For devices joining now, the current package is KB5126256, published September 8, 2026, which supersedes earlier licensing packages.
2. Get the MAK for your Year 2 licenses in the Microsoft 365 admin center: Billing, Your Products, the Volume licensing tab, View contracts, then View product keys for the contract. Seeing keys requires the Product Key Reader or VL Administrator role.
3. In an elevated Command Prompt, install the key with slmgr.vbs /ipk followed by the MAK.
4. Activate it with slmgr.vbs /ato 1043add5-23b1-4afb-9a0f-64343c8f3f8d, the Year 2 activation ID. For reference, Year 1 uses f520e45e-7413-4a34-a497-d2765967d094 and Year 3 uses 83d49986-add3-41d7-ba33-87c7bfb5c0fb.

Devices must reach Microsoft's activation endpoints. Machines without internet access can use phone activation with slmgr.vbs /dti and /atp, and large disconnected fleets can use proxy activation in the Volume Activation Management Tool once its ESU update is installed. If reimaging eats into the activation count, you can request a higher MAK limit.

Check that ESU is active

Run slmgr.vbs /dlv from an elevated prompt. Microsoft says the output shows the name of the ESU program with a License Status of Licensed, so after the switch you should see a licensed entry for Year 2. On non-persistent VDI, Microsoft recommends removing the ESU key with slmgr.vbs /upk and the activation ID before running sysprep on the golden image, so cloned machines do not use up MAK activations.

Consumer ESU now runs to 2027, but it is not for company fleets

The personal-use program was first announced as a single year. Microsoft has since added an editor's note to its June 2025 Windows Experience blog post saying consumer ESU is being provided for an additional year, and the consumer ESU page now gives October 12, 2027 as the end date. Devices already enrolled continue automatically, and that date matches the end of commercial Year 2.

Consumer enrollment is free for users who sync PC settings, or costs 1,000 Microsoft Rewards points or a one-time $30, and one license covers up to 10 devices. It cannot be used on kiosk devices, on PCs joined to Active Directory or Microsoft Entra ID, or on PCs enrolled in an MDM solution (Entra registered devices are allowed), so managed business PCs stay on commercial ESU.

Microsoft 365 Apps and Defender on Windows 10

Office follows a separate timeline. Microsoft says Microsoft 365 Apps on Windows 10 receive security updates through October 10, 2028, the same day ESU Year 3 ends. Feature updates stop at Version 2608, after which devices stay on that version with security fixes only. Support cases for these apps on Windows 10 are limited, with or without ESU.

The Defender for Endpoint requirements page says devices on an out-of-support Windows version keep receiving Defender product updates. That keeps detection current, but it does not patch the operating system, which is the job ESU does.

Checklist before November 10, 2026

• Count the Windows 10 22H2 devices still in service after October 13, 2026, and mark those that can move to Windows 11, Windows 365 or Azure Virtual Desktop instead.
• Order Year 2 licenses for the rest, adding Year 1 for any device that was never enrolled.
• Pull the Year 2 MAK and push the slmgr install and activation commands through your management tooling.
• Confirm with slmgr.vbs /dlv, then watch the November release install on a sample of devices.

More Windows patching coverage is in our Security section, and Windows 365 and Azure topics are in Cloud.

Frequently asked questions

How much does Windows 10 ESU year 2 cost?

At list price it is $122 per device, because Microsoft prices commercial Year 1 at $61 and doubles the price each year. Regional prices vary, and the device must also be licensed for Year 1.

When does Windows 10 ESU year 2 start?

Year 2 takes over when Year 1 ends on October 13, 2026 and runs through October 12, 2027. The first monthly security release after the changeover is scheduled for November 10, 2026.

Can I buy Windows 10 ESU year 2 without year 1?

No. Microsoft says ESU is cumulative, so an organization that joins in Year 2 pays for Year 1 as well.

When does Windows 10 consumer ESU end?

As of October 2026, Microsoft's consumer ESU page says coverage for personal devices runs through October 12, 2027, one year longer than first announced. Enrolled devices continue without any action.

What is the Windows 10 ESU year 2 activation ID?

Microsoft lists 1043add5-23b1-4afb-9a0f-64343c8f3f8d for Win10 ESU Year2. Use it with slmgr.vbs /ato after installing the Year 2 MAK, then confirm the result with slmgr.vbs /dlv.