Windows 10’s journey has reached a significant milestone. While Microsoft officially ended support for the operating system some time ago, many individuals and businesses still rely on it. For those who want to keep using Windows 10 beyond that date, Extended Security Updates (ESU) offer a lifeline – but not without their own challenges. Recently, users attempting to install these crucial security updates have been encountering frustrating errors, and Microsoft has responded with an out-of-band update: update KB5072653. This article will explain what’s happening, why it matters, and how this new update resolves the issue.
The End of Free Windows 10 Support & The Rise of ESU
On October 14, 2025, Windows 10 officially ended its free support cycle. This means Microsoft no longer releases general feature updates or free security patches for the operating system. While many users migrated to newer versions of Windows (or other operating systems), a significant number remain on Windows 10 due to various reasons – compatibility with specific software, hardware limitations, or simply preference.
Recognizing this need, Microsoft introduced Extended Security Updates (ESU). These updates provide continued security protection for Windows 10 devices that are no longer receiving free updates. However, accessing these updates isn’t entirely straightforward and requires a financial commitment.
Understanding the Cost of Continued Protection
The cost of ESU varies depending on whether you’re a consumer or an enterprise customer:
Consumers: Can obtain ESU for one additional year by paying $30, backing up their Windows settings to their Microsoft account, or redeeming 1,000 Microsoft Rewards points.
Enterprise Customers: Can purchase a three-year ESU license, costing approximately $427 per device.
The November 2025 Patch Tuesday marked the release of the first Windows 10 extended security update (KB5068781). This was intended to provide continued protection for those who had purchased their ESU licenses. However, things didn’t go as planned.
The Problem: Installation Errors & The 0x800f0922 Headache
Following the release of the November extended security update (KB5068781), a significant number of users – both consumers and businesses – reported encountering issues when attempting to install it. Common complaints included the update simply not being offered, or failing with a frustrating 0x800f0922 (CBS_E_INSTALLERS_FAILED) error message. This left many feeling vulnerable, as they were paying for ESU but unable to actually receive the security updates they needed.
Enter Update KB5072653: The Fix is Here!
Thankfully, Microsoft has stepped in with a solution. They’ve released an out-of-band update – update KB5072653, officially titled “Extended Security Updates (ESU) Licensing Preparation Package for Windows 10.” This package specifically addresses the issues that were preventing the successful installation of the November extended security updates.
According to Microsoft’s support bulletin, “The organizations affected by this issue can resolve it by installing KB5072653: Extended Security Updates (ESU) Licensing Preparation Package for Windows 10, which was released on November 17, 2025.” Essentially, update KB5072653 acts as a prerequisite to properly install the November ESU update.
How to Install Update KB5072653 & Get Your Security Updates
The installation process is relatively straightforward:
- Prerequisites: Ensure your device is running Windows 10 22H2 and has the October 2025 cumulative update (KB5066791) already installed.
- Check for Updates: Open Windows Update through the Settings app.
- Automatic Installation: Update KB5072653 should automatically appear as an available update and install itself.
- Restart Your Device: After installation, restart your computer.
- Re-run Windows Update: Once restarted, run Windows Update again to install the November extended security update (KB5068781).
This process should now successfully install the necessary security updates and keep your Windows 10 device protected.
Challenges for Corporate Environments: WSUS & SCCM Considerations
While the above steps are generally applicable, some corporate environments using Windows Server Update Services (WSUS) or System Center Configuration Manager (SCCM) have reported that these tools aren’t correctly identifying the need for the extended security update, even when devices are enrolled in the ESU program. This means administrators might not see the update KB5072653 offered through their usual deployment channels.
Microsoft is aware of this issue and has stated they will release a new “Scan Cab” with updated metadata to properly perform compliance checks. This Scan Cab will be available in the near future, allowing WSUS and SCCM to accurately identify devices requiring the extended security update. They’ve indicated that updates on this front will be communicated through their support channels.
Looking Ahead: Staying Secure on Windows 10
The release of update KB5072653 demonstrates Microsoft’s commitment to supporting users who have chosen to continue using Windows 10 with ESU. While the cost involved may not be insignificant, it provides a crucial layer of security for those who cannot or do not wish to migrate to newer operating systems immediately. Keep an eye out for the updated Scan Cab if you’re managing updates through WSUS or SCCM and ensure your devices are receiving the necessary protection.
Key Takeaways
- Windows 10 support ended, but ESU provides continued security.
- Update KB5072653 fixes installation errors preventing ESU deployment.Ensure you’re running Windows 10 22H2 and have the October 2025 update installed before attempting to install update KB5072653.
- Corporate environments should monitor for the updated Scan Cab for accurate compliance checks.
