Windows 10 Pro ESU not applying on domain-joined PCs

Dear Anthony M,

Here’s a focused checklist to find why machines still report EOL after the ESU key shows activated.

1. Confirm the Windows edition is ESU-eligible (Pro retail versus Pro volume/education/enterprise differences can affect entitlement).
2. Verify you installed the ESU product key correctly and activated it on each machine:
   • slmgr.vbs /ipk <ESU-MAK-key> then slmgr.vbs /ato and confirm with slmgr.vbs /dlv.
   1. Ensure the ESU prerequisite updates (the ESU enabling update that Microsoft required for the release year and the latest servicing stack updates) are installed on every PC; missing these updates causes Windows Update to still treat the device as out of support.
   2. Confirm the monthly ESU quality updates classification is available and that Group Policy or Windows Update for Business policies are not blocking or targeting the devices away from Microsoft Update.
   3. Check date/time and TLS connectivity to Microsoft Update servers so the system can validate entitlement and receive ESU patches.
   4. Inspect Windows Update logs and the Event Viewer Application/System logs for errors referencing ESU, entitlement, or license validation around the times you run activation.
   5. Verify the ESU MAK has remaining activations with your reseller/partner portal if you used MAK rather than an online entitlement; contact your reseller if activations are exhausted.
   6. Re-run slmgr.vbs /ato and capture the output and the Event ID entries for licensing to correlate failures for a single test machine.
   7. If you used a KMS host for other activations, ensure your KMS host or proxy isn’t interfering with ESU MAK activation on endpoints.
   8. As a fallback, test a clean repro on one machine: uninstall any nonessential update blockers, apply the prerequisite ESU update, install the ESU key, activate, and confirm Windows Update now offers ESU security-only updates.

If this helps, please hit “accept answer” — thanks and good luck 🙂

Best regards,

Vivian

Hi Anthony M,

Has your issue been solved? If it has, please accept the answer so that others can benefit too. If not, is there anything I can help you with? Please let me know.

Vivian

You are seeing a channel/edition mismatch. Your slmgr output shows the installed OS is Windows 10 Professional — OEM_COA_NSPL channel while the ESU add-on entry is Client-ESU-Year1 … VOLUME_MAK channel. A VOLUME_MAK ESU add-on can appear as "Licensed" at the licensing layer but servicing entitlement checks (Windows Update/ESU patches applicability) will still treat an OEM-channel Pro install as out-of-support when the ESU add-on’s channel does not match the OS channel. That is the root cause of the “Windows has reached end of life” message despite slmgr reporting the ESU add-on as Licensed.

You will not receive Extended Security Updates (ESU) from Windows Update while the OS image channel (OEM_COA_NSPL) does not match the ESU add‑on channel (VOLUME_MAK) even though slmgr shows the ESU add‑on as Licensed. To receive ESU security updates you must either align the OS channel with the ESU key (reimage/convert to a volume-channel image) or obtain an ESU entitlement that is valid for your OEM-channel installations from your reseller; otherwise the devices remain ineligible for ESU servicing despite the Licensed status shown by slmgr.

Hi Anthony M,

You must obtain the lisenses directly from Microsoft via either your organization’s Microsoft 365 Admin Center (if you have a tenant) or through a Microsoft Volume Licensing / Cloud Solution Provider (CSP) agreement. The correct way is to work with Microsoft or an authorized CSP partner to add the ESU subscription to your tenant, then assign those licenses to the devices.

1. Through Microsoft 365 Admin Center (if you already have a tenant)

Sign in at https://admin.microsoft.com with your global admin account.

Go to Billing → Purchase services.

Search for Windows 10 Extended Security Updates.

Select the ESU subscription (Year 1, 2025–2026) and purchase the required number of licenses.

Once purchased, assign the licenses to the appropriate users/devices.

2. Through Microsoft Volume Licensing or CSP

• If your organization has an Enterprise Agreement (EA) or Microsoft Products and Services Agreement (MPSA), contact your Microsoft account team to add ESU.
• If you don’t have an EA, you can still buy ESU through a Microsoft Cloud Solution Provider (CSP).
  • Find a CSP partner here: Microsoft Solution Providers.
  • Ask specifically for Windows 10 Enterprise ESU licensing.

If you find this information useful to some extent, don't forget to accept the answer so that your experience with the issue would help contribute to the whole community. Thank you :)

Vivian