How to Verify ESU Subscription Status on Windows 10 in 2026

After October 14, 2025, Windows 10 no longer receives free security updates. Organizations that need continued updates must purchase an Extended Security Updates subscription for 2026, the third and final year of the program. If you manage a fleet of Windows 10 devices, knowing whether each machine has an active ESU license is critical to maintaining compliance and security. This article explains how to check the ESU subscription status on a Windows 10 device using built-in tools and command-line utilities.

What Is the ESU Subscription for Windows 10 in 2026

The Extended Security Updates program provides critical and important security updates for Windows 10 after the end-of-support date. For 2026, the third year, organizations must have an active ESU license purchased through a Volume Licensing agreement or a cloud subscription such as Windows 10 E3 or E5. The subscription is tied to the device hardware and requires a specific product key or activation from a Key Management Service server.

Without an active ESU subscription, Windows 10 devices will not receive any new security patches after the final free update in October 2025. The device continues to function normally, but it becomes vulnerable to newly discovered exploits. Microsoft does not enforce a hard block, so verifying the subscription status is a manual administrative task.

The ESU subscription for 2026 covers Windows 10 version 22H2 only. Devices running older versions must upgrade to 22H2 before the ESU can be applied. The subscription does not include new features, non-security fixes, or technical support outside of security update installation.

How to Check ESU Subscription Status Using Windows Update

The most direct method is to look at the Windows Update history for installed ESU cumulative updates. These updates have a specific KB number that identifies them as ESU releases.

1. Open Windows Update settings
   Press the Windows key, type “Windows Update settings”, and press Enter. The Settings app opens to the Windows Update page.
2. View update history
   Click the “Update history” link. A list of all installed updates appears, sorted by date.
3. Find ESU cumulative updates
   Look for entries that start with “2026-xx Cumulative Update for Windows 10 Version 22H2 for x64-based Systems” or similar. The KB number for ESU updates in 2026 follows the pattern KB50xxxxx. If such an update is present and installation was successful, the ESU subscription is active.
4. Check for error codes
   If an update shows “Failed to install” with error 0x80070422 or 0x80070005, the ESU license may not be applied correctly. Proceed to the command-line verification method for more detail.

How to Verify ESU Status Using SLMgr Command

The Software License Manager tool provides detailed licensing data including the ESU activation state. This method works on both domain-joined and workgroup devices.

1. Open Command Prompt as administrator
   Press the Windows key, type “cmd”, right-click “Command Prompt”, and select “Run as administrator”. Click Yes in the User Account Control prompt.
2. Display license information
   Type the following command and press Enter: slmgr /dlv
   A Windows Script Host dialog box appears showing the detailed license information.
3. Locate the ESU status line
   In the dialog, find the line labeled “Extended Security Updates (ESU) Status”. The possible values are:
   Licensed — the ESU subscription is active and applied to this device.
   Unlicensed — no ESU license is present, or the grace period has expired.
   Notification — the device is in the 90-day grace period after the ESU key was applied but before activation.
4. Check the ESU expiry date
   Look for the line “Extended Security Updates (ESU) Expiration Date”. For the 2026 subscription, this date should be in October 2026. If the date is earlier or missing, the wrong year subscription may be installed.
5. Close the dialog
   Click OK to close the Windows Script Host dialog. The command prompt remains open for additional checks.

How to Verify ESU Status Using the Registry

The Registry stores the ESU activation data in a machine-specific location. This method is useful for scripting or remote verification via PowerShell.

1. Open Registry Editor
   Press Windows key + R, type “regedit”, and press Enter. Click Yes in the User Account Control prompt.
2. Navigate to the ESU key
   In the left pane, expand the following path:
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform
3. Check the ESU status value
   In the right pane, look for a DWORD value named “ESUStatus”. A value of 1 indicates the ESU subscription is active. A value of 0 means no subscription is applied. If the value does not exist, the device has never had an ESU license installed.
4. Confirm the ESU product key
   Also in the same registry path, check the string value “KeyManagementServiceMachine”. For a KMS-activated ESU, this value shows the KMS server hostname. For a MAK activation, the value is empty and the product key is stored in the “ProductKey” value.
5. Close Registry Editor
   Close the window. No restart is required for this verification.

Common Issues When Verifying ESU Subscription Status

The SLMgr dialog shows “Unlicensed” even though I purchased ESU

This usually happens when the ESU product key has not been installed on the device. For MAK-based activation, open an elevated Command Prompt and run: slmgr /ipk [your 25-character ESU MAK key]. Then run: slmgr /ato. For KMS-based activation, ensure the device can reach the KMS server and that the KMS host has the ESU 2026 key installed. After applying the key, run slmgr /dlv again to confirm the status changes to “Licensed”.

Windows Update shows no ESU cumulative updates available

If the ESU status is “Licensed” but no updates appear, the device may be scanning the wrong Windows Update endpoint. Check the registry key HKLM\SOFTWARE\Microsoft\WindowsUpdate\UpdateServiceURL. For ESU updates, this should point to Microsoft Update or your WSUS server configured to approve ESU updates. Also verify that the device is running Windows 10 version 22H2 — older versions do not receive ESU updates.

The ESUStatus registry value is missing entirely

This indicates that the Software Protection service has not yet processed an ESU license on this device. Apply the ESU product key using slmgr /ipk as described above. After a successful activation, the ESUStatus value appears in the registry. If the value still does not appear after activation, run slmgr /rearm and restart the Software Protection service.

SLMgr vs Registry: Accuracy of ESU Verification Methods

Item	SLMgr /dlv	Registry Editor
Data source	Software Licensing service	Local registry hive
ESU status display	Human-readable text (Licensed/Unlicensed)	DWORD value (1 or 0)
Expiry date shown	Yes, in the dialog	No, requires additional registry keys
Requires admin rights	Yes	Yes
Best for	Quick single-device check	Scripting and bulk verification

Both methods read the same underlying activation data. SLMgr presents the information in a formatted dialog that includes the ESU expiration date. The Registry method gives you the raw status value but requires additional steps to retrieve the expiration date from the “ExpirationDate” binary value in the same registry path.

For bulk verification across multiple devices, use PowerShell to read the ESUStatus registry value remotely. A sample command is: Invoke-Command -ComputerName PC01 -ScriptBlock {Get-ItemProperty -Path ‘HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform’ -Name ESUStatus}. This returns 1 for active subscriptions and 0 for inactive ones.

You can now verify the ESU subscription status on any Windows 10 device using Windows Update history, the SLMgr command-line tool, or Registry Editor. Start with SLMgr /dlv for the most complete information including the expiration date. If the status shows “Unlicensed”, apply the correct ESU 2026 product key and reactivate the device. For ongoing monitoring, set up a scheduled task that runs slmgr /dlv weekly and logs the results to a text file or sends them to your management console.