Self Help Article (External)
Intended Audience: Department ITCs.
Purpose
This article provides step-by-step instructions for applying the Windows 10 Extended Security Updates (ESU) Multiple Activation Key (MAK) for Year 1 to eligible devices.
Windows 10 reaches end of support on October 14, 2025. For background details, see the previous announcement on Windows 10 End of Support. After that date, devices will no longer receive monthly security updates unless they are covered by Extended Security Updates (ESU) and properly activated.
If ESU licenses need to be purchased, please create a Helpdesk ticket using this LINK and include the number of licenses required along with your billing account number.
If your organization has purchased ESU licenses from Microsoft, you must apply the provided Multiple Activation Key (MAK) to each eligible device to maintain continued protection and compliance. See the below options for applying the Windows 10 ESU MAK key.
Prerequisites
Ensure the following before proceeding:
-
The device must be running Windows 10 Pro, Enterprise, or Education (version 22H2).
-
The latest cumulative updates are installed.
Options to Apply Windows 10 ESU MAK Key
The following options describe how to apply the ESU MAK key manually, through Active Directory using Group Policy, or via Intune script.
Option 1: Apply the Windows 10 ESU MAK key manually on each device.
-
Apply the ESU MAK Key
-
Open an elevated Command Prompt and run the following command:
slmgr.vbs /ipk <Your_ESU_MAK_Key>
-
Replace <Your_ESU_MAK_Key> with the key you received.
-
Activate the Key
-
Then run:
slmgr.vbs /ato f520e45e-7413-4a34-a497-d2765967d094
-
This will activate the ESU license on the device.
-
Verify Activation
-
Run the following to check the license status:
slmgr.vbs /dlv
-
Confirm the ESU product is listed and licensed.
-
Receive Security Updates
-
Once the ESU is activated, the device will continue to receive monthly security updates via Windows Updates.
Option 2: Apply the Windows 10 ESU MAK key through Active Directory using Group Policy.
-
Create Organizational Units (OUs) in Active Directory
-
Create sub-OUs in AD named Windows10ESU_MAK_Year1 under your current OUs as needed for Windows 10 devices.
-
Move Devices to OU
-
Move Windows 10 devices into the new OUs.
-
Assign Group Policy
-
Apply group policy named Windows10ESU_MAK_Year1_Install to the relevant OUs.
-
Reboot Computers
-
It may take up to 2 reboots for the policy to fully applied.
-
Verify Activation (Optional)
-
Run the following from elevated Command Prompt to check the license status:
slmgr.vbs /dlv
-
Confirm the ESU product is listed and licensed.
-
Receive Security Updates
-
Once the ESU is activated, the device will continue to receive monthly security updates via Windows Updates or SCCM.
Option 3: Apply the Windows 10 ESU MAK Key using an Intune script (for Azure AD–Joined devices)
-
Submit a Helpdesk Request
-
Create a helpdesk ticket using this LINK to request deployment of Windows 10 ESU MAK Year 1 to the desired Intune device collection.
-
Include the collection name in your request.
-
EIT Deploys Script
-
Wait for EIT to notify you that the script has been deployed.
-
Monitor Deployment
-
In Intune, monitor the script named Windows10ESU_MAK_Year1_Install for success or failure status.
-
If any device fails, perform Option 1 on that device.
-
Receive Security Updates
-
Once the ESU is activated, the device will continue to receive monthly security updates via Windows Updates.