Home » Windows 10 ESU Verification
Applicable For Endpoint Central MSP 
 
 

Windows 10 ESU Verification

With Windows 10 reaching End of Support in October 2025, Microsoft will continue to provide Extended Security Updates to deliver critical security fixes for eligible devices.

This article explains how Endpoint Central validates ESU activation and eligibility status during the installation of Windows 10 ESU-based security updates.

Checking ESU Activation Status Before Installation

If customers want to verify the ESU activation status before deploying ESU updates (to prevent installation failures), they can use the dedicated ESU Checker Patch.

Patch Details:

  • Patch ID: 95204
  • Patch Name: Windows 10 ESU Checker (Deployment-Only)

Note: If you are not able to find the patch ID, go to Patch Database Settings → Windows → enable the Optional Updates checkbox. After enabling, search for patch ID [95204] in the supported patches list.

How Windows 10 ESU Verification Works

Before an ESU security update is deployed, Endpoint Central automatically performs a series of checks to confirm that the system is eligible and properly licensed. If any one of the following checks passes, the deployment proceeds to installation.

The verification process involves the following steps:

1. Region Validation

If the device is located in an EU region, Endpoint Central proceeds with the deployment. This aligns with Microsoft’s announcement offering one year of free ESU support for EU-based systems without additional licensing costs.

2. ESU License Activation Status

Endpoint Central verifies whether the device already has an activated ESU Year License. This validation uses Microsoft’s Activation IDs, which vary for each ESU program year.

Steps to verify if ESU license has been activated successfully:

  1. Open Command Prompt.
  2. Execute slmgr /dlv <Activation ID> and then press Enter.

    3. For example, for 1st year:

    slmgr /dlv f520e45e-7413-4a34-a497-d2765967d094
  3. Verify the License Status. Ensure the status indicates Licensed for the respective ESU program.
    4. ESU Program ESU SKU (or Activation) ID
    Win10 ESU Year 1 f520e45e-7413-4a34-a497-d2765967d094
    Win10 ESU Year 2 1043add5-23b1-4afb-9a0f-64343c8f3f8d
    Win10 ESU Year 3 83d49986-add3-41d7-ba33-87c7bfb5c0fb

    If the license is active, the deployment proceeds. If not, Endpoint Central moves on to eligibility validation.

3. ESU Eligibility Validation

If no active ESU license is detected, Endpoint Central verifies eligibility through a registry-based validation check. If the system is recognized as ESU-eligible, installation continues normally.

If the value is missing or invalid, the process stops, and Error Code: 50023 is returned — indicating that the device is not eligible for ESU updates.