How to check the Consumer Extended Security Updates status via command line

[bovirus]

@abbodi1406

Many thanks for your scxript.

Is there a way via command line to show current status of "ESU" status?

I run the script with -license option 8as requested by batch) and I got the info

Acquire Consumer ESU License regardless enrollment...
Operation result: Success

Evaluate ESU Eligibility state ...
Eligibility Status: Unknown
Eligibility Result: UNKNOWN_RESULT

Thanks. KR.

[abbodi1406]

reg.exe query "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\ConsumerESU"
values meaning:
https://github.com/abbodi1406/ConsumerESU/blob/master/Consumer_ESU_Enrollment.ps1#L90

0 = "Unknown" means the feature is not enabled, or other unrecognized error occured.

[bovirus]

@abbodi1406

The full log is this

Evaluate ESU Eligibility state ...
Eligibility Status: Eligible
Eligibility Result: SUCCESS

Obtain MSA Token ...
Obtained token for Microsoft user account

Run Consumer ESU Enrollment ...
IsEnrolled result: True

Get ESU Eligibility state ...
Eligibility Status: Unknown
Eligibility Result: UNKNOWN_RESULT

[abbodi1406]

What happen if you run the script again?
there is something with your system that revert (disable) the feature for some reason

[bovirus]

@abbodi1406

I got same message.

[abbodi1406]

Run this in command prompt as administrator and post result:

cmd /c ClipESUConsumer.exe -evaluateEligibility
reg.exe query "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\ConsumerESU"

[bovirus]

@abbodi1406

No result. No message.

[abbodi1406]

@abbodi1406

No result. No message.

The second command always have result
are you sure AV is not blocking registry operations?

[scheffmr]

reg.exe query "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\ConsumerESU" values meaning: https://github.com/abbodi1406/ConsumerESU/blob/master/Consumer_ESU_Enrollment.ps1#L90

0 = "Unknown" means the feature is not enabled, or other unrecognized error occured.

So if I read this correct there should be a 0x5 in the ESUEligibilityResult, otherwise the device is not enrolled. In my case with 7 and 9 I am doomed and have to update?

[abbodi1406]

No,
ESUEligibility = 3 and ESUEligibilityResult = 1 are the correct state

CommercialMigrated means you installed the Consumer ESU license, but the device is still joined to Entra ID/AzureAD/Workplace/Intune...

[Bill-Boquet]

Hi abbodi1406,
First many thanks for again a new great script.
Does your last comment indeed mean that "I am doomed and have to update" ?

I think I have the same issue than scheffmr, with an old corporate backup PC, and also have 7 and 9 in the registry.
I manually changed these values to 3 and 1. After running your script with -License option, I got :

Acquire Consumer ESU License regardless enrollment...
Operation result: Success

Evaluate ESU Eligibility state ...
Eligibility Status: CommercialMigratedDevice
Eligibility Result: COMMERCIAL_MIGRATED_DEVICE

Despite "Operation result: Success", ESU is not enabled (like in my home PC) and registry values are back to 7 and 9.

[abbodi1406]

Despite "Operation result: Success", ESU is not enabled (like in my home PC) and registry values are back to 7 and 9.

Fooling UI message will not make ESU updates installable, they will still check if the device is commercial

why don't you unjoin or disconnect the work/school account?
https://learn.microsoft.com/en-us/troubleshoot/microsoft-365-apps/activation/reset-office-365-proplus-activation-state#sectionc

or use MAS TSforge

[Bill-Boquet]

Hi abbodi1406,
Thanks for your suggestions. I followed the instructions from the link you provided and ran dsregcmd /status command.
The value displayed for the WorkplaceJoined parameter is NO, so I guess this kind of action will be useless.
Thanks anyhow, I will now try MAS TSForge.
Again thanks for your work and your kindness to reply to myriads of questions from the lucky users of your scripts.
Kind regards, Bill

[4bliss]

First is first, many thanks for such a useful script. I ran it, and now this is the status:

Acquire Consumer ESU License regardless enrollment...
Operation result: Success

Evaluate ESU Eligibility state ...
Eligibility Status: DeviceEnrolled
Eligibility Result: SUCCESS

also, when I go to settings/update & security, now it reads "your pc is enrolled to get extended security updates" in the top right area.

The thing is, AFAIK, the only three ways to enroll a (non-corporate) Windows 10 PC in ESU are:

1. By enabling syncing settings to the cloud
2. By redeeming 1000 reward points
3. By paying a 30$ fee

And all of them need a mandatory Microsoft account to complete the enrollment.

I don't have an MS account logged on the PC, I run it using a local account, no MS account in the MS Store, either. Whatever the case, if I understood it well, the tool relies on the free backup setting to enroll the machine. The thing is, I checked it, but I don't see that any settings (or otherwise) are being synced to OneDrive, no payment has been required, and I don't have 1000 points in my rewards balance, so, the question is... can I be confident that, if it says it is enrolled, I will be getting updates come October 15th?

Thanks in advance.

[abbodi1406]

You should have let the script run by default and enroll using Local user account
unless that failed for you?

EnrollUsingBackupV1 function doesn't require or check any backup settings