Microsoft Windows 10 22H2 SEoL is a Nessus finding (plugin 192814) that flags hosts still running Windows 10 version 22H2, which reached end of support on October 14, 2025. To fix it, upgrade the device to a supported Windows 11 release. Devices that cannot move yet should be enrolled in paid Extended Security Updates (ESU) and tracked as exceptions.
What the scanner is actually detecting
The finding title is Microsoft Windows 10 22H2 SEoL, reported by Tenable Nessus plugin 192814 in the Windows family. SEoL is Tenable’s term for security end of life: the vendor no longer ships security patches for that version. The plugin is a local check, so it only evaluates in a credentialed scan or through a Nessus Agent. Its published solution is to upgrade to a currently supported version of Windows.
A second plugin often appears next to it: 278073, Microsoft Windows 10 22H2 ESU Status Check. It is informational, uses WMI, and reports when Windows 10 22H2 is receiving Extended Security Updates. Read 192814 as “unsupported release” and 278073 as “still getting paid security patches”. Windows 10 22H2 is OS build 19045.
Real-world risk
Without ESU, the host stopped receiving security updates after October 2025. Fixes Microsoft ships after that date for supported Windows versions never reach it, so any of those flaws that also exist in Windows 10 stay open indefinitely, and the gap widens every Patch Tuesday.
With ESU, enrolled devices keep receiving Critical and Important security updates, so day-to-day exposure is close to that of a patched system. ESU excludes new features, non-security fixes and general technical support, and it is a paid, time-limited bridge. Microsoft’s lifecycle FAQ lists the coverage years as ending on October 13, 2026 (Year 1), October 12, 2027 (Year 2) and October 10, 2028 (Year 3). Devices not activated for Year 2 stop getting patches after the first date.
Tenable gives SEoL detections a default severity of Low, and the 192814 page shows no CVSS score. Treat that as a posture signal, not a verdict: an unenrolled laptop that browses the web and opens email is a far bigger problem than the label suggests, while an ESU-enrolled kiosk on a restricted VLAN is mostly a lifecycle and audit item.
How to confirm it on the host
Check the version and build first. Trust the build number over the product name string, because the ProductName registry value is known to still read “Windows 10” on some Windows 11 installs.
Get-ItemProperty 'HKLM:SOFTWAREMicrosoftWindows NTCurrentVersion' |
Select-Object ProductName, EditionID, DisplayVersion, CurrentBuild, UBR
Get-CimInstance Win32_OperatingSystem | Select-Object Caption, Version, BuildNumberA CurrentBuild of 19045 with DisplayVersion 22H2 confirms the finding. Windows 11 builds start at 22000, and Windows 11 version 25H2 is build 26200.
Next, check whether an ESU license is installed and activated. Microsoft publishes one activation ID per ESU year; this checks all three:
$esu = 'f520e45e-7413-4a34-a497-d2765967d094', # Year 1
'1043add5-23b1-4afb-9a0f-64343c8f3f8d', # Year 2
'83d49986-add3-41d7-ba33-87c7bfb5c0fb' # Year 3
Get-CimInstance SoftwareLicensingProduct -Filter "PartialProductKey IS NOT NULL" |
Where-Object { $esu -contains $_.ID } |
Select-Object Name, ID, LicenseStatusA LicenseStatus of 1 means Licensed. No output means no ESU key is installed. Finally, check Windows 11 hardware readiness from an elevated PowerShell session:
Get-Tpm | Select-Object TpmPresent, TpmReady
Get-CimInstance -Namespace rootcimv2securitymicrosofttpm -ClassName Win32_Tpm |
Select-Object SpecVersion
Confirm-SecureBootUEFIConfirm-SecureBootUEFI returns True when Secure Boot is on, False when the device supports it but it is off, and “Cmdlet not supported on this platform” on legacy BIOS machines. For a definitive answer, run the Windows 11 setup compatibility scan from mounted 25H2 media. It exits with 0xC1900210 when no issues are found and 0xC1900208 when something blocks the upgrade:
$p = Start-Process -FilePath 'D:setup.exe' `
-ArgumentList '/auto upgrade /quiet /eula accept /compat scanonly' -Wait -PassThru
'{0:X}' -f $p.ExitCodeHow to fix it
Option 1: Upgrade to Windows 11 version 25H2
Target 25H2 rather than 24H2. Per Microsoft’s Windows 11 release information, 24H2 Home and Pro reach end of updates on October 13, 2026, while 25H2 is supported until October 12, 2027 for Pro and October 10, 2028 for Enterprise and Education. Roll the upgrade out in waves, as you would in a ring-based patch deployment.
Microsoft Intune. Go to Devices > Windows > Windows updates > Feature updates > Create profile, pick Windows 11, version 25H2 under Feature update to deploy, choose Make available to users as a required update, set rollout options and assign device groups. Devices must be Entra joined or hybrid joined, with diagnostic data at least Required and the wlidsvc service running. If an update ring also targets them, set Feature update deferral period (days) to 0 once devices report OfferReady.
Group Policy (Windows Update client policies). Enable Computer Configuration > Administrative Templates > Windows Components > Windows Update > Manage updates offered from Windows Update > Select the target Feature Update version, with product version Windows 11 and target version 25H2. Older ADMX templates label that node Windows Update for Business. A common reason devices never upgrade is an old policy pinning them to Windows 10; check it with:
Get-ItemProperty 'HKLM:SOFTWAREPoliciesMicrosoftWindowsWindowsUpdate' |
Select-Object ProductVersion, TargetReleaseVersion, TargetReleaseVersionInfoA ProductVersion of “Windows 10” with TargetReleaseVersionInfo “22H2” keeps the device on Windows 10 indefinitely.
WSUS or Configuration Manager. Enable the Windows 11 product and the Upgrades classification, synchronize, then approve a single Windows 11 25H2 feature update for the target group. Be careful with automatic approval rules that include Upgrades, since they can move devices to a new OS without a change window.
Scripted upgrade from media. For stragglers, run setup unattended. With /quiet, Windows 11 setup requires /eula accept or fails with 0xC190010E.
setup.exe /auto upgrade /quiet /eula acceptOption 2: Activate ESU for devices that cannot move yet
ESU for organizations covers Windows 10 22H2 Enterprise, Education and Pro in commercial use. Microsoft currently lists KB5066791 or later, plus the ESU Licensing Preparation Package KB5072653 installed after it, as prerequisites; recheck the Microsoft Learn page before rollout. Get the ESU MAK from the Microsoft 365 admin center, then run elevated:
slmgr.vbs /ipk <ESU MAK>
slmgr.vbs /ato <Activation ID>
slmgr.vbs /dlv| ESU program | Activation ID | Coverage ends |
|---|---|---|
| Win10 ESU Year 1 | f520e45e-7413-4a34-a497-d2765967d094 | October 13, 2026 |
| Win10 ESU Year 2 | 1043add5-23b1-4afb-9a0f-64343c8f3f8d | October 12, 2027 |
| Win10 ESU Year 3 | 83d49986-add3-41d7-ba33-87c7bfb5c0fb | October 10, 2028 |
ESU is cumulative: you cannot buy Year 2 without Year 1. Devices without internet access can use phone activation (slmgr.vbs /dti and /atp) or VAMT proxy activation. Windows 10 virtual machines in Windows 365, Azure Virtual Desktop and Azure get ESU at no additional cost. ESU updates arrive monthly, so keep these devices in your normal Patch Tuesday planning cycle.
Option 3: Replace, rebuild or formally accept
Windows 11 needs TPM 2.0, UEFI firmware that is Secure Boot capable, a compatible 64-bit processor, 4 GB of RAM and 64 GB of storage. Hyper-V generation 1 VMs cannot be upgraded in place and must be rebuilt as generation 2 with a virtual TPM. Devices that fail these requirements and lack ESU need a replacement date, network isolation and a time-boxed decision through your vulnerability risk acceptance process.
How to verify the fix and rescan
- Rerun the registry query. An upgraded device should show CurrentBuild 26200 and DisplayVersion 25H2.
- In Intune, check Reports > Windows Updates > Reports > Feature Updates report for the device.
- For ESU devices, confirm slmgr.vbs /dlv shows the current ESU year as Licensed and that the UBR keeps advancing monthly.
- Run a credentialed Nessus scan or wait for the next agent upload; an unauthenticated scan cannot confirm closure of a local check. An upgraded host should no longer report 192814. For an ESU host, keep the 278073 output with the exception record.
What can break and how to roll back
A feature update is a full OS upgrade. The usual casualties are old drivers, VPN clients, endpoint security agents, disk encryption tools and line-of-business apps with hard version checks. Microsoft safeguard holds also block the offer on hardware with known issues until the hold lifts. Pilot on a representative ring first.
By default, Windows keeps a 10-day window to go back to Windows 10. Check it, extend it (run on the upgraded device) and trigger a rollback with DISM:
DISM /Online /Get-OSUninstallWindow
DISM /Online /Set-OSUninstallWindow /Value:30
DISM /Online /Initiate-OSUninstallValues below 2 or above 60 fall back to the default of 10. DISM /Online /Remove-OSUninstall removes the rollback option entirely. Keep in mind that rolling back returns the host to Windows 10 22H2, so the finding comes back. ESU activation is low risk to the running system; the common failures are blocked activation endpoints and running out of MAK activations after reimaging, which you can raise with Microsoft.
Common false positive reasons
- Stale results. The device was upgraded, but the last credentialed scan or agent upload predates the upgrade.
- Credential failure. Local checks do not run without working credentials, so an old 192814 result can linger instead of closing. Check the credential status for that host.
- LTSC confusion. Confirm the build really is 19045. Windows 10 Enterprise LTSC 2021 (build 19044) and LTSC 2019 (build 17763) have different lifecycle dates.
- ESU enrollment. Not a false positive: ESU does not change the OS version. It is a legitimate exception, and 278073 is its evidence.
FAQ
Does ESU make plugin 192814 go away?
Do not count on it. ESU keeps security updates flowing, but the host still runs an end-of-support release. Tenable reports ESU status through the separate informational plugin 278073, so document the host as an exception tied to that evidence.
Can I upgrade to Windows 11 24H2 instead?
You can, but 24H2 Home and Pro reach end of updates on October 13, 2026. Choose 25H2 so the device does not land in a new SEoL report within weeks.
Is Windows 10 LTSC covered by Windows 10 ESU?
No. Microsoft states that LTSB and LTSC releases have their own lifecycles and are not covered by the Windows 10 ESU program.
Tracking this finding across many hosts
On a large estate the hard part is proving every host actually moved. If you want help with that, SITEY is a self-hosted vulnerability management platform that imports findings from 16 scanners, including Nessus results uploaded as exported .nessus files, and merges duplicate findings reported by the same scanner. After an upgrade it can re-test individual Nessus findings such as 192814, so a host is closed based on a fresh result rather than a ticket status.
Sources
- Tenable: Microsoft Windows 10 22H2 SEoL (plugin 192814)
- Tenable: Microsoft Windows 10 22H2 ESU Status Check (plugin 278073)
- Microsoft Learn: Enable Windows 10 Extended Security Updates (ESU)
- Microsoft Learn: Product Lifecycle FAQ, Extended Security Updates
- Microsoft Learn: Configure Windows feature update policies in Intune