Free tools Windows power users keep installed
One-click scans. No signup required.
To activate purchased commercial Windows 10 Extended Security Updates (ESU), retrieve the organization’s ESU Multiple Activation Key (MAK) from the Microsoft 365 admin center, install it on each eligible device, activate the ESU program for the licensed year, and confirm its status is Licensed. This is separate from Windows Enterprise E3/E5 subscription activation. Microsoft also documents distinct ESU entitlements for certain Windows 365 and Azure Virtual Desktop scenarios.
Before you deploy ESU MAKs
Windows 10 reached end of support on October 14, 2025. ESU provides eligible devices with critical and important security updates beyond that date. The commercial MAK workflow described here applies to Windows 10 version 22H2; it is not the general process for LTSB or LTSC releases, which have separate lifecycles and guidance.
Confirm the device prerequisites
For the commercial client process, Microsoft specifies Windows 10 version 22H2 with KB5066791 or a later update, followed by ESU Licensing Preparation Package KB5072653. The person carrying out installation and activation needs local administrative privileges. Check Microsoft’s current servicing instructions before rollout because prerequisites can change.
Confirm the license and admin role
Your organization must have purchased the applicable ESU licenses. To view the key, the administrator’s Microsoft Entra account needs the Product Key Reader or VL Administrator role.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →#1 Best Overall
Find the ESU MAK in Microsoft 365 admin center
- Sign in to the Microsoft 365 admin center with an account assigned Product Key Reader or VL Administrator.
- Go to Billing > Your Products > Volume licensing > View contracts.
- Open the contract under which the ESU licenses were purchased.
- Open the actions for the applicable License ID and select View product keys.
If the key is missing, first check that you have the required role and are viewing the correct contract and License ID. Microsoft directs customers who still cannot find the key to volume licensing support. Treat the MAK as a sensitive organization credential; do not publish or share it outside approved deployment processes.
Activate purchased ESU on a Windows 10 device
Install the MAK
On the eligible Windows 10 device, open Command Prompt as an administrator and install the ESU MAK supplied to your organization:
Rank #2
- 15.6" diagonal, HD (1366 x 768), micro-edge, BrightView, 220 nits, 45% NTSC.
slmgr.vbs /ipk <ESU MAK>Activate the licensed ESU year
Use the activation ID that matches the ESU year your organization licensed. The IDs are Microsoft-published program identifiers, not customer product keys, and are common across eligible ESU editions and enrolled devices.
| ESU program | Activation ID |
|---|---|
| Win10 ESU Year 1 | f520e45e-7413-4a34-a497-d2765967d094 |
| Win10 ESU Year 2 | 1043add5-23b1-4afb-9a0f-64343c8f3f8d |
| Win10 ESU Year 3 | 83d49986-add3-41d7-ba33-87c7bfb5c0fb |
Run the activation command from the elevated prompt, substituting the appropriate ID:
Rank #3
- 10th Generation Intel Core i5-1035G1 processor
- 12GB system memory for full-power multitasking
- 256GB Solid State Drive
- 15.6" Micro-edge touchscreen display
slmgr.vbs /ato <Activation ID>Online activation requires internet connectivity and access to Microsoft Activation Servers.
Verify the ESU license status
Run the detailed licensing display:
slmgr.vbs /dlvFind the relevant ESU program and check that its License Status is Licensed. Do not treat a successful key-install command alone as confirmation that ESU activation is complete.
Rank #4
- Latitude 7480 Laptop 14"
- Intel Core i7 6th Gen i7-6600U -Core Processor 2.6GHz (3.4GHz With Turbo Boost)
- 256 GB SSD Hard Drive & 16GB Memory
- 1920x1080 FHD resolution Non-Touch with Webcam and an integrated graphics chip
- Wireless Wifi & Bluetooth
Activate offline devices or deploy to a fleet
Offline or activation-server-restricted devices
Microsoft documents manual (phone) activation for devices that cannot reach Microsoft Activation Servers. Install the key first, then:
- On the target device, obtain the Installation ID for the relevant ESU program:
slmgr.vbs /dti <Activation ID>. - From a connected computer, use Microsoft’s Product Activation portal to request a Confirmation ID for that Installation ID.
- Apply the Confirmation ID on the target device:
slmgr.vbs /atp <Confirmation ID> <Activation ID>. - Run
slmgr.vbs /dlvon the target and verify that the ESU program reportsLicensed.
Proxy activation for many endpoints
For fleet deployment, Microsoft points administrators to Volume Activation Management Tool (VAMT) proxy activation. VAMT requires updated PkeyConfig files for Windows 10 ESU MAK keys. Follow current Microsoft VAMT and ADK instructions and obtain the applicable configuration files before using this route.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Best Value
Nonpersistent VDI images
For nonpersistent VDI, Microsoft warns that activation order matters to avoid consuming activations. Its documented sequence is to install Windows 10 22H2, install and activate ESU, install the latest update and restart, remove the ESU product key using the applicable activation ID, run Sysprep, and then create the golden image. Follow Microsoft’s current image-specific instructions for exact commands and servicing after updates are released.
When Windows 365 or Azure Virtual Desktop may cover ESU
Not every Windows 10 device needs the purchased commercial MAK workflow. Microsoft describes distinct ESU entitlement scenarios for Windows 365 and Azure Virtual Desktop; eligibility depends on workload and, for local devices, identity and sign-in conditions.
| Scenario | Microsoft-documented ESU treatment | Key conditions |
|---|---|---|
| Windows 10 single-session or multi-session VM in Azure Virtual Desktop | Automatically eligible for ESU without an additional license purchase or activation. | Applies to the described AVD workloads. |
| Existing Windows 10 version 22H2 Cloud PC in Azure | ESUs available at no additional cost. | Applies to the Windows 365 Cloud PC scenario documented by Microsoft. |
| Local Windows 10 device connecting to Windows 365 Enterprise or Windows 365 Flex dedicated Cloud PC | Automatic ESU entitlement for eligible local devices during the offer. | The device must be Microsoft Entra joined or hybrid joined. The user must sign in on that physical device with the same Entra account at least once every 22 days. Entra-registered-only and on-premises AD-only devices do not qualify for this described commercial entitlement. |
Microsoft’s Windows 365 deployment article also states that users with Windows Enterprise E3 or Microsoft 365 E3/E5 are licensed for up to 10 Windows Enterprise instances per user, physical or virtual, and that ESU applies to each licensed instance in that article’s scenario. This does not establish that any Microsoft 365 E3/E5 subscription supplies a commercial ESU MAK for any device. Check the terms for the exact plan and device arrangement.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Keep Enterprise subscription activation separate from ESU
Windows Enterprise E3/E5 subscription activation is an online feature that can step an eligible, licensed Windows Pro device up to Enterprise after identity and licensing requirements are met. Microsoft says it can remove the need for KMS or MAK activation when deploying the Enterprise edition. It does not replace the purchased commercial ESU license and activation workflow.
If Windows Enterprise subscription activation is not working, investigate its own prerequisites—supported Windows Pro, license assignment, Entra join or synchronization, and base Windows activation. Those checks do not establish whether an ESU MAK is licensed; use the ESU program status from slmgr.vbs /dlv for that.
Quick Recap
Troubleshoot common ESU activation problems
- The MAK is not visible: verify the Product Key Reader or VL Administrator role and confirm the purchase is under the contract and License ID you opened.
- The key installs but ESU is not licensed: check Windows 10 version 22H2, KB5066791 or later, KB5072653, the licensed-year activation ID, and the activation result. Confirm the ESU License Status with
slmgr.vbs /dlv. - Online activation cannot connect: use Microsoft’s manual activation process to obtain and apply a Confirmation ID.
- Many endpoints need activation: assess VAMT proxy activation and ensure its ESU key configuration files are current.
- A device may qualify through Windows 365 or AVD: check that it matches the documented workload, plan, join state, and sign-in conditions rather than assuming it needs—or automatically has—a purchased MAK.
Microsoft guidance
- Enable Windows 10 Extended Security Updates (ESU) — commercial ESU activation, key retrieval, and activation methods.
- Enable ESU for Windows 365 scenarios — cloud-related eligibility and local-device requirements.
- Windows 10 ESU for Windows 365 — Windows 365 and AVD entitlement scenarios.
- Deploy Windows Enterprise licenses and Windows subscription activation — separate Enterprise edition activation requirements.
- Activate Windows using a Multiple Activation Key — general MAK activation guidance.
- Windows release health — servicing and release information.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
