Microsoft has released the KB5068781 update, the first Windows 10 extended security update since the operating system reached end of support last month.
On October 14, Microsoft released the final Windows 10 cumulative update, after which the operating system no longer receives bug fixes or free security updates.
Both consumers and business customers can enroll in extended security updates (ESU), which continues to provide security updates for up to three years depending on the type of account.
Consumers can enroll in the ESU program by paying $30, using 1,000 Microsoft reward points, or using Windows Backup to synchronize their Windows settings with their Microsoft account. Those in the European Economic Area have more options, as they can receive ESU for free simply by logging in to Windows 10 with a Microsoft account or pay $30 to continue using a local account.
Business customers can use the ESU program for a total of three years, bringing the total cost per device to $427.
However, a bug has prevented some devices from enrolling in the ESU program, with Microsoft releasing an emergency fix today to resolve the issue.
If you running Windows 10 Enterprise LTSC or are enrolled in the ESU program, you can install this update like normal by going into Settings, clicking on Windows Update, and manually performing a 'Check for Updates.'
Source: BleepingComputer
As this update is mandatory, it will also automatically install on its own and prompt you to restart your device when it is completed.
After installing this update, Windows 10 ESU will be updated to build 19045.6575 and Windows 10 Enterprise LTSC 2021 will be updated to build 19044.6575.
What's new in Windows 10 KB5068781
As Microsoft is no longer releasing new features or maintenance fixes for Windows 10, the KB5068781 update only resolves a bug erroneously stating that Windows 10 LTSC devices have reached end of support, even though they receive support until January 2027.
- [Update (known issue)] Fixed: After installing the October 14, 2025 Windows update (KB5066791), the message, "Your version of Windows has reached the end of support", might incorrectly display in the Windows Update Settings page. To view the page, click Start > Settings > Windows Update.
More importantly, this update includes Microsoft's Patch Tuesday security updates, which fix 63 flaws and one actively exploited elevation-of-privilege vulnerability.
Microsoft states that there are no known issues with this update.
For businesses facing delays, blind spots, or prioritization issues with Patch Tuesday updates, join our December 2 webinar with Action1 to learn how modern patch management helps you patch faster and reduce risk.
Test every layer before attackers do
Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
Get the whitepaper
Comments
_Gilgamesh_ - 8 months ago
So, can I install KB5068781 manually after downloading the .msu file from MS Update Catalog if my Win10 is not enrolled in ESU?
PeterAlexLondon - 8 months ago
I advise you to backup your system before you do that
Why is your system NOT enrolled in ESU??
As I live in the Netherlands EU enrollement was free!
I already bought me a Win10 IOT LTSC but to be sure I choose ESU as a safety measurment
For I have to reinstall my whole System, as an Insider from 2-10-2014 I made so many little changes to all my setting. I have to rebuild LTSC from scratch!
_Gilgamesh_ - 8 months ago
Please see my answers below, if you care, of course. :-)
"I advise you to backup your system before you do that
Why is your system NOT enrolled in ESU??"
-- Please consider a use case where the PC has no constant internet connection. E.g., isolated network (VLAN).
"As I live in the Netherlands EU enrollement was free!"
-- Not everyone lives in EU...
"I already bought me a Win10 IOT LTSC but to be sure I choose ESU as a safety measurment"
-- I guess we are on different budgets, no?!
"For I have to reinstall my whole System, as an Insider from 2-10-2014 I made so many little changes to all my setting. I have to rebuild LTSC from scratch!"
-- My question has nothing to do with the insider build.
frac - 8 months ago
Won't work. It will install but when you restart to apply the udpate it fails and rolls back.
_Gilgamesh_ - 8 months ago
"Won't work. It will install but when you restart to apply the udpate it fails and rolls back."
Yeah, makes sense. Looks like it needs to acquire a license, which is a part of the enrollment process.
I already tried it, and it failed as you described with a common error 0x800f0922.
At least it should not attempt to install it, just refuse with something like "update not applicable". As always, Microsoft's misleading error messages...
PeterAlexLondon - 8 months ago
Latest os build: 19045.6575
amag - 8 months ago
We are currently experiencing the same issue with this KB5068781 across our managed Win10 devices, despite purchasing and applying the ESU license (MAK key) to all our devices. The update appears to install successfully, but after a restart, it fails to apply and rolls back with the common error 0x800f0922
Also, what specifically triggers Windows Update to check for new updates once the ESU key is activated? We’ve noticed that on several machines in our pre-pilot ring, Windows doesn’t seem to detect new updates automatically unless we manually set the Win10CommercialKeybasedESUEligible registry value to 1
Should this registry modification still be required if updates are being managed via Intune?
It seems that the OOB update (KB5071959) only applies to consumer systems and not commercial. How would this work for enterprise managed devices?
louiecse - 8 months ago
Hi Amag, I’m having the exact same issue. Have you received any updates on this or found a solution?
amag - 8 months ago
Hi Louiecse,
Microsoft have now officially released a statement that they are aware of the issue with this KB and are currently investigating it. Below statement from MS...
Extended Security Updates (ESU) might fail to install with error 0x800f0922
Status
Confirmed
Affected platforms
Client Versions Message ID Originating KB Resolved KB
Windows 10, version 22H2 WI1186413 KB5068781 -
Some Windows 10 devices enrolled in Extended Security Updates (ESU) might fail to install the November 2025 security update (the Originating KBs listed above) with error 0x800f0922 (CBS_E_INSTALLERS_FAILED). This issue is isolated to devices activated via Windows subscription activation through the Microsoft 365 Admin Center.
Next steps: We are investigating this issue and will provide more information when it is available.
louiecse - 8 months ago
Thank you so much, brother. All the best!
amag - 8 months ago
Hi Louiecse,
Just a further update from Microsoft. It seems they have now released a fix for this KB.
Extended Security Updates (ESU) might fail to install with error 0x800f0922
Status
Resolved
Affected platforms
Client Versions Message ID Originating KB Resolved KB
Windows 10, version 22H2 WI1186413 KB5068781 KB5072653
Some Windows 10 devices enrolled in Extended Security Updates (ESU) for commercial customers might fail to install the November 2025 security update (the Originating KBs listed above) with error 0x800f0922 (CBS_E_INSTALLERS_FAILED). This issue is isolated to devices activated via Windows subscription activation through the Microsoft 365 admin center.
Resolution: This issue is fixed in the update the Resolved KBs listed above: Extended Security Updates (ESU) Licensing Preparation Package for Windows 10, which was released on November 17,2025. Once you install the preparation package (the Resolved KBs listed above), you will be able to deploy the November 11, 2025, security update the Originating KBs listed above.
Regards,
Amag
Computerdave911 - 8 months ago
you dont need to use backup or one drive to get free extended updates, only need to sign in 1 user account with a microsoft account is all you need to do, i even uninstalled one drive and security updates are still coming in
Lawrence Abrams - 8 months ago
My tests showed that even if you were logged in with your Microsoft account, unless you backed up your settings, you couldn't get free enrollment.
This is different in Europe, where all you need is to log in with the Microsoft account.