Updating Windows 10 21H2 offline with December 2025 MSU package fails

Hi Benn, Campbell,
I’m following up to check whether the issue has been resolved. Feel free to reply if you need further information. If the information provided was helpful, please click "Accept Answer" to help others in the community. Thank you!

Hi Benn, Campbell,

The key line in your log is “ESU: Offline is not supported HRESULT_FROM_WIN32(1625)”. This means the Extended Security Updates (ESU) installer is explicitly blocking offline servicing. In other words, ESU updates for Windows 10 21H2 must be applied through an online servicing session (Windows Update or WSUS), not injected into an offline image with DISM.

Even though you’re using the correct MSU package, the ESU installer DLL is designed to check whether the system is running live and licensed for ESU. When it detects an offline mount, it fails with the error you saw. That’s why the rollback occurs and the update doesn’t stick. Rebuilding or retrying won’t change the outcome, since this is by design.

The countermeasure is to apply the update in an online environment where the system can validate ESU licensing. If you need to update multiple machines, you can distribute the MSU via WSUS, Configuration Manager, or by running the installer interactively on each system. Offline servicing with DISM will not work for ESU packages.

In short, the failure isn’t due to corruption, it’s simply that ESU updates don’t support offline installation. Running the MSU in a live session or using WSUS/SCCM is the correct path forward.

I hope the response provided some helpful insight. If it addressed your issue, please consider marking it as Accept Answer so others facing the same problem can easily find the solution. If you need any further assistance, feel free to leave a comment.

Jason.

The log entry ESU: Offline is not supported HRESULT_FROM_WIN32(1625) indicates that Extended Security Updates (ESU) servicing cannot run in offline mode. The ESU AI (ExtendedSecurityUpdatesAI.dll) installer requires an online, running Windows instance and does not support applying the ESU-enabled cumulative update to an offline image (for example, via DISM against a mounted WIM or offline OS volume).

To install the December 2025 MSU that includes ESU components for Windows 10 21H2:

1. Boot into the target Windows 10 21H2 system (online servicing, not a mounted image).
2. Ensure all ESU prerequisites are met:
   • The Servicing Stack Update (SSU) with AI changes must be installed.
   • The ESU MAK add-on key must be installed and activated for the edition in use.
3. Then run the MSU directly on the live system (double-click or use wusa.exe against the online OS), or deploy via an online mechanism such as Windows Update, WSUS, or Configuration Manager.

If attempting to maintain a reference image, apply the ESU-enabling updates and cumulative updates after deployment, on the running OS, rather than injecting the ESU MSU into the offline image.

If ESU prerequisites are missing, also verify the SSU with AI changes is installed as described in the ESU troubleshooting guidance. If it is not present, install the required SSU first and retry the update on the online system.

References:

• Troubleshoot issues in ESU
• October 10, 2023—KB5031408 (Monthly Rollup)
• October 11, 2022—KB5018454 (Monthly Rollup)
• March 14, 2023—KB5023769 (Monthly Rollup)
• November 14, 2023—KB5032252 (Monthly Rollup)
• October 10, 2023—KB5031441 (Security-only update)
• KB5063523: Windows Recovery Environment update for Windows 10, version 21H2 and 22H2: July 8, 2025