Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Important
Looking for consumer information? For individuals or Windows 10 Home customers, more information about Extended Security Updates for Windows 10 is available in the following resources:
- For more information on enabling ESU for home use, see Windows 10 Consumer Extended Security Updates (ESU) program
- For general information, see the frequently asked questions section of the End of support for Windows 10 page.
The Windows 10 Extended Security Updates (ESU) program allows organizations to receive critical and important security updates for PCs enrolled in the paid subscription service. ESU extends the use of Windows 10 devices past the end of support date on October 14, 2025. This article provides instructions on how to enable the ESU keys in commercial environments.
Prerequisites
To enable ESU for Windows 10, you must meet the following prerequisites:
Device requirements:
- Windows 10, version 22H2 with KB5066791, or a later update installed
- Administrative privileges on the device
Windows 10 Long Term Servicing releases (LTSB/LTSC) have their own lifecycles and are NOT covered via the Windows 10 ESU program. For more information, see Microsoft Lifecycle.
Microsoft 365 admin center:
- You must have the Product Key Reader or VL Administrator role assigned to your Microsoft Entra ID account to view the MAK in the Microsoft 365 admin center. For more information, see Understand volume licensing roles.
Endpoints for client activation:
https://go.microsoft.com/https://login.live.comhttps://activation.sls.microsoft.com/http://crl.microsoft.com/https://validation.sls.microsoft.com/https://activation-v2.sls.microsoft.com/https://validation-v2.sls.microsoft.com/https://displaycatalog.mp.microsoft.com/https://licensing.mp.microsoft.com/https://purchase.mp.microsoft.com/https://displaycatalog.md.mp.microsoft.com/https://licensing.md.mp.microsoft.com/https://purchase.md.mp.microsoft.com/
Locating your Windows 10 ESU Multiple Activation Key (MAK)
If you purchased ESU licenses, you need to activate them on each Windows 10 device using a Multiple Activation Key (MAK) that you get from the Microsoft 365 admin center.
Note
You must have the Product Key Reader or VL Administrator role assigned to your Microsoft Entra ID account to view the MAK. For more information, see Understand volume licensing roles.
To find the ESU license MAK, use the following steps:
- In the admin center, go to the Billing > Your Products page, then select the Volume licensing tab.
- In the Contracts section, select View contracts.
- On the Contracts page, find the License ID that the ESU licenses were purchased under, select the three dots (More actions), then select View product keys. The Product keys details page includes contract details and a list of all keys for that contract.
If you can't find your MAK, Contact volume licensing.
Install and activate the ESU key
You manage licensing and activation on devices using slmgr.vbs. The device needs access to the internet and to Microsoft Activation Servers. If the device can't access either the internet or the Microsoft Activation Servers, see Activate ESU keys by phone. To install the ESU key on clients, use the following steps:
Open an elevated Command Prompt window on the device.
Run the following command to install the ESU key, replacing
<ESU MAK>with the actual ESU MAK you obtained from the Microsoft 365 admin center:slmgr.vbs /ipk <ESU MAK>After you run this command, you should see a Windows Script Host dialog box that states the product key was installed successfully.
Find the ESU Activation ID using the following table:
ESU Program Activation ID Win10 ESU Year1 f520e45e-7413-4a34-a497-d2765967d094 Win10 ESU Year2 1043add5-23b1-4afb-9a0f-64343c8f3f8d Win10 ESU Year3 83d49986-add3-41d7-ba33-87c7bfb5c0fb Note
The activation IDs are the same across all eligible Windows ESU editions and all devices enrolled for that program.
From the elevated Command Prompt window, run the following command to activate the ESU key, replacing
<Activation ID>with the actual ESU Activation ID you obtained in the previous step:slmgr.vbs /ato <Activation ID>After you run this command, you should see a Windows Script Host dialog box that states the product was activated successfully.
To verify that the ESU key is installed and activated, run the following command from an elevated Command Prompt:
slmgr.vbs /dlvThe output should show the Name of the corresponding ESU program and the License Status as
Licensedfor that program.
Activate ESU keys by phone
If the device doesn't have access to the internet or to the Microsoft Activation Servers, use the following steps for a manual phone activation:
Open an elevated Command Prompt window on the device. You'll be managing licensing and activation on devices using slmgr.vbs.
Run the following command to install the ESU key, replacing
<ESU MAK>with the actual ESU MAK you obtained in the previous section:slmgr.vbs /ipk <ESU MAK>After you run this command, you should see a Windows Script Host dialog box that states the product key was installed successfully.
To verify that the ESU key is installed, run the following command from an elevated Command Prompt:
slmgr.vbs /dlvNote
The activation IDs are the same across all eligible Windows ESU editions and all devices enrolled for that program.
Find the ESU Activation ID using the following table:
ESU Program Activation ID Win10 ESU Year1 f520e45e-7413-4a34-a497-d2765967d094 Win10 ESU Year2 1043add5-23b1-4afb-9a0f-64343c8f3f8d Win10 ESU Year3 83d49986-add3-41d7-ba33-87c7bfb5c0fb Note
The activation IDs are the same across all eligible Windows ESU editions and all devices enrolled for that program.
Get the Installation ID (IID) from the device by running the following command in an elevated Command Prompt, replacing
<Activation ID>with the actual ESU Activation ID you obtained in the previous step:slmgr.vbs /dti <Activation ID>Once you have the Installation ID, call the Microsoft Licensing Activation Center for your region. They'll walk you through the steps to get the Confirmation ID. Make a note of your Confirmation ID. You can also request to receive a text message with a link to a web page where you can look up your Confirmation ID by entering the Installation ID. The link can only be used for two devices at a time.
From the elevated Command Prompt window, run the following command to activate the ESU key, replacing
<Activation ID>with the actual ESU Activation ID you obtained from the chart and<Confirmation ID>with the actual Confirmation ID you received from the Microsoft Licensing Activation Center:slmgr.vbs /atp <Confirmation ID> <Activation ID>Note
The
<Confirmation ID>shouldn't have spaces in it.To verify that the ESU key is installed and activated, run the following command from an elevated Command Prompt:
slmgr.vbs /dlvThe output should show the Name of the corresponding ESU program and the License Status as
Licensedfor that program.
Activate large numbers of devices that don't have internet access
For more information on how to do manual activation of large numbers of devices, review the Volume Activation Management Tool (VAMT) Proxy Activation scenario. You should install the latest Automated Deployment Kit (ADK) tool to ensure that you have the latest VAMT. You'll also need to install an update to the VAMT from https://www.microsoft.com/download/details.aspx?id=106364 so it includes updated PkeyConfig files for Windows 10 ESU MAK keys.
For more information on adding additional activations to a Windows 10 ESU MAK, see Request an increase to MAK activation limits.