How to get Extended Security Updates for eligible Windows 7 devices

[Brink]

Update 11.26.2019: Windows 7 Extended Security Updates (ESUs) will be available via the Cloud Solution Partner (CSP) program beginning Monday, December 2, 2019. To purchase Windows 7 ESUs through a CSP, please contact a CSP partner. If you are a partner and need details on procuring Windows 7 ESUs through the Partner Center, see Purchasing Windows 7 ESUs as a Cloud Solution Provider.

While many of you are well into your journey of deploying and/or servicing Windows 10, we understand that everyone is at a different point in the upgrade process. If your organization is unable to complete the transition from Windows 7 Pro or Enterprise to Windows 10—or from Windows Server 2008 and 2008 R2 Datacenter, Enterprise, or Standard to the latest version of Windows Server—prior to the end of support on January 14, 2020, we want to help you by ensuring that these devices running these select editions and versions continue to receive security updates while you complete your Windows and Windows Server upgrade projects.

In this blog, we’ll explain how volume license customers can purchase, install, and deploy Extended Security Updates today for eligible Windows 7, Windows Server 2008, and Windows Server 2008R2 devices to ensure those devices stay protected after January 14, 2020. Again, if you are a Windows 7 Pro customer looking to take advantage of paid Extended Security Updates via CSP partners, you will be able to do so once they are available on December 1, 2019. More information on this option will be available in the Windows 7 and Office 2010 End of Support FAQ.

Purchasing Windows 7 ESU through Volume Licensing

Extended Security Updates are available through specific volume licensing programs. Coverage will be available in three consecutive 12-month increments following Windows 7 end of support on January 14, 2020. Extended Security updates are available for purchase in 12-month increments only, starting January 14, 2020. You cannot buy partial periods (e.g. 6 months).

Eligible customers can use the Azure Hybrid Benefit (available to customers with active Software Assurance or Server Subscriptions) to obtain discounts on the license of Azure virtual machines or Azure SQL Database managed instances. ESUs for select Windows Embedded products are available via your embedded device manufacturer.

Now, let’s walk through how and where to purchase Windows 7 ESU, as well as download the appropriate key from the VLSC.

1. Visit the Volume Licensing Service Center (https://www.microsoft.com/vlsc) and sign in.
2. Select Licenses > Relationship Summary > Licensing ID > Product Keys.
   
   
   

Installation prerequisites

The following steps must be completed before installing and activating ESU keys:

1. Install the following SHA-2 code signing support update and servicing stack update (SSU) or a later SSU:

Windows 7 SP1 and Windows Server 2008 R2 SP1:
Servicing stack update for Windows 7 SP1 and Windows Server 2008 R2 SP1: March 12, 2019
and
SHA-2 code signing support update for Windows Server 2008 R2, Windows 7, and Windows Server 2008: Se...

Windows Server 2008 SP2:
Servicing stack update for Windows Server 2008 SP2: April 9, 2019
and
SHA-2 code signing support update for Windows Server 2008 R2, Windows 7, and Windows Server 2008: Se...​

2. Install the following SSU and monthly rollup:

Windows 7 SP1 and Windows Server 2008 R2 SP1:
Servicing stack update for Windows 7 SP1 and Server 2008 R2 SP1: September 10, 2019 (KB4516655)
and
October 8, 2019: Monthly Rollup (KB4519976)

Windows Server 2008 SP2:
Servicing stack update for Windows Server 2008 SP2: September 10, 2019 (KB4517134)
and
October 8, 2019: Monthly Rollup (KB4520002)​

3. Once activated, continue to use your current update and servicing strategy to deploy ESU through Windows Update, Windows Server Update Services (WSUS), Microsoft Update Catalog, or whichever patch management solution you prefer.

Installation and activation

Once you have addressed the prerequisites, you’re ready to install and activate Extended Security Updates for machines connected to the internet.

First, install the ESU product key using the Windows Software Licensing Management Tool (slmgr):

1. Open an elevated Command Prompt.
2. Type slmgr /ipk <ESU key> and select Enter.
3. If the product key installed successfully, you will see a message similar to the following:
   
   
   

Next, find the ESU Activation ID:

1. In the elevated Command Prompt, type slmgr /dlv and select Enter.
2. Note the Activation ID as you will need it in the next step.
   
   
   

Now, you’ll activate the ESU product key:

1. Open an elevated Command Prompt.
2. Type slmgr /ato <ESU Activation Id> and press Enter.
   
   
   

Once you have activated the ESU product key, you can verify the status at any time by following these steps:

1. Open an elevated Command Prompt.
2. Type slmgr /dlv and select Enter.
3. Verify Licensed Status shows as Licensed for the corresponding ESU program, as shown below:
   
   
   

Note: We recommend using a management tool, such as System Center Configuration Manager, to send the slmgr scripts to your enterprise devices.

To install and activate ESU for machines that are not connected to the Internet, you will need to follow these steps:

1. Download and install the Volume Activation Management Tool (VAMT).
2. Download the VAMT- ESU configuration file and update your VAMT configuration file.
3. Configure the client device’s firewall for VAMT.
4. Add the ESU product key to VAMT.

For systems that will not connect to the internet for activation, you can use the VAMT to perform proxy activation; however, KB4519972 must first be installed.

Note: We will be providing instructions on purchasing, installing, and activating Windows 7 ESU purchased through CSPs at a later date.

Azure virtual machines and Windows Server

You do not need to deploy an additional ESU key for Azure virtual machines (VMs), Windows 7 ESU with Windows Virtual Desktop, or for bring-your-own images on Azure for Windows 7, Windows Server 2008, and Windows Server 2008 R2. Like on-premises devices, these devices will also require the installation of the SSUs detailed in KB4516033 and KB4519972, or later SSUs/rollups. A pre-patched Windows 7 image and a pre-patched Windows Server 2008 R2 SP1 image are available from the Azure Marketplace. Azure Stack VMs or Azure VMware solutions should follow the same process as on-premises devices.

After installing the SSUs noted above, VMs will be enabled to download the ESU updates.

For answers to commonly asked questions about ESU for Windows Server 2008 and 2008 R2, see the ESU FAQ.

Next steps

If your organization still has devices running Windows 7, Windows Server 2008, or Windows Server 2008 R2, we recommend that you take the steps outlined above today to take advantage of Extended Security Updates and help ensure that your devices continue to receive necessary security updates after January 14, 2020.

If you are interested in learning more about Extended Security Updates, please see the following resources:

• Announcement: Availability of ESU for purchase
• Prepare for Windows Server 2008 end of support
• Extended Security Updates FAQ
• Windows 7 end of support information for enterprises
• Windows 7 end of support FAQ

Read more: https://techcommunity.microsoft.com...rity-Updates-for-eligible-Windows/ba-p/917807

Tweet

— Twitter API (@user) View on Twitter

 

[Tharthan]

[W]e understand that everyone is at a different point in the upgrade process

What you fail to understand is that Windows 10 is not an upgrade. It is a downgrade.

So a lot of people don't want to trade fantastic for subpar.

But I know that pointing this out is like talking to a brick wall. You people don't care about anyone who is not a Windows 10 toady.

Shame on you Microsoft. Shame on you.

At least be honest about your motives.

 

[TheNewGuyHere]

"Purchasing Windows 7 ESU through Volume Licensing"

Geeze, who can afford it......

 

[TechnoMage2016]

What you fail to understand is that Windows 10 is not an upgrade. It is a downgrade.
So a lot of people don't want to trade fantastic for subpar.
But I know that pointing this out is like talking to a brick wall. You people don't care about anyone who is not a Windows 10 toady.
Shame on you Microsoft. Shame on you.
At least be honest about your motives.

And, what you're not saying, is that many on this, like other forums, for whatever reason, will not say what they actually think about Windows 10. It's not popular with those who choose to align themselves with MS. (I've still not figured out the "why" of that.)

Speak too loudly, in a negative manner about MS, and you may find yourself Banned from the forum. Don't ask me how I know this to be a fact.:sarc:

In my opinion, only one OS has come out of MS, since Win-7, that's even worth mentioning.
That would have to be, Windows 8.1. (NOT Windows 8.0)
Granted, it cries out for the Classic Shell, but it comes with a really GREAT package of hardware drivers and will install on just about any PC or Laptop. And from my own testing, appears to be very stable.

Since I've retired from the PC business, all this OS stuff is now just a part of my hobby and has nothing to do with the Retail world, licensing, etc. That's all in the past.

I enjoy downloading the latest and greatest OS's and installing them on spare HD's, just to see what they can and will do.
But, Windows 7, Pro, SP1, x86 remains my choice for my everyday OS.

Here's wishing y'all a very good day and Happy DST, tomorrow.

TM

 

[Brink]

Windows 7 Extended Security Updates (ESUs) will be available via Cloud Solution Providers beginning Monday, December 2, 2019. For details, contact a CSP.

Tweet

— Twitter API (@user) View on Twitter

 

[huffman]

Extended Windows Security Updates

Bypass discovered to allow Windows 7 Extended Security Updates on all systems | ZDNet


What is this all about??

 

[huffman]

A few things to consider:


I have two computers that are working very well. One has Windows 7 (64 bit) and the other has Windows 10. I use both on a daily basis. I intend to keep both as long as possible.


I agree, I have NO intention of paying for an antivirus for Win 7. There are too many good free ones available. I have used MSE with Win 7 since it became available and it has served me well, but soon it will be time to let it go.


I will say I like Windows 7 slightly better than Windows 10, but NOT enough to go crazy about.


Thanks for the responses and have a great day.

 

[erpster4]

from Askwoody.com's recent blog - "Microsoft says it’ll sell Win7 Extended Security Updates to Ultimate users "



Microsoft says it’ll sell Win7 Extended Security Updates to Ultimate users @ AskWoody


so yes Ultimate users are included for Win7 ESUs

 

[freeagent]

I have two computers that are working very well. One has Windows 7 (64 bit) and the other has Windows 10. I use both on a daily basis. I intend to keep both as long as possible.

I agree, I have NO intention of paying for an antivirus for Win 7. There are too many good free ones available. I have used MSE with Win 7 since it became available and it has served me well, but soon it will be time to let it go.

I have Win7 and Win10. Both on same Lenovo but on separate drives that I can switch between from BIOS.

On Win7, I at one time used WSE and other AVs. But now only have Malwarebytes Premium. Also have uBlock origin on browsers.

On Win10 recently installed (and on a second Win10 laptop), I only have Defender plus free version of Malwarebytes (must run manually) plus uBlock Origin.

I hesitate to add yet another AV program. Used several of them in past until Malwarebytes and Defender improved protection.

Never had a virus infection, but MWB and uBlock do catch malware and other bad sites.

Hopefully well enough covered??

PS: For everyday use, I don't see any advantage to using Win10 (after trying both for some time)

 

[feetand nches]

PissedOffhaha

What the heck is CSP Cloud Service Provider? I don't see where to get one or pay for the service at all. Nothing like a bunch of techies to make things as difficult as possible to figure out.

I also wonder if I can Change my Product Key from Pro to Ultimate?

Why don't MS just allow the general public to pay for the extra service ESU? Stingy bastards lol.

 

[torchwood]

Hi Nasty7

NOT for free, and i'd be wary of buying it of the web.


Roy

 

[feetand nches]

So I cannot get into ESU with Ultimate unless I have Volume Licensing or an Azure right? If so what is the first year 50.00US right? I guess my idea of using Ultimate is not good as I don't have a Volume License or Azure.

Thanks

 

[Tharthan]

I love how condescending Microsoft sounds; "we understand that everyone is at a different point in the upgrade [sic] process". I hate to break it to you, Microsoft, but the people who haven't "upgraded" yet probably don't want to. Consider coming out with a good replacement for Windows 7.

Perhaps Microsoft ought to consider this for their 2020s logo:

 

[freeagent]

I have dual booting to 7 and 10. Today I booted from 7 for the first time in a couple of weeks. Just to see if my laptop was going self destruct
All I got, was a Lenovo health check, an Adobe Flash update AND a Windows update. THis on January 15th.

So what was updated? This is what was reported;

FOR SOMR REASON, BARMAN DELETED MY ATTACHMENT. THis site wants a url for images. So I put screen shot in Dropbox and provided a link. If that is not allowed, please explain and tell me how I upload an image using the image icon.

Or don't bother. This site will be dead before long anyway.

 

[feetand nches]

Well, that most likely one of the last updates you will see, or maybe one more this month even. After that, yes, you can expect your laptop to self destruct!

 

[freeagent]

Well, that most likely one of the last updates you will see, or maybe one more this month even. After that, yes, you can expect your laptop to self destruct!

For one reason or another, I thought I might keep using Win7. So I have it on my laptop's main SSD (SATA III port) while Win10 is on an mSATA SSD that is SATA II. Probably OK, but maybe I should delete Win 7 soon and move Win 10 over there.

 

[feetand nches]

You can't just swap the drives, or is one an External?

 

[freeagent]

You can't just swap the drives, or is one an External?

mSATA is just like a memory stick that fits into a slot on the laptop motherboard. 250GB though! The other drive is also an SSD (500GB) and it fits into the normal hard drive bay. On this Lenovo, there is also the option to put yet another drive in a caddy that fits into the DVD bay. But I only use that when cloning or whatever.

 

[feetand nches]

Do a little Cloning dance and move Windows 7 to another external, and 10 to the internal, and 7 back to the mSATA. See what kind of mess that makes for you haha

 

[freeagent]

Do a little Cloning dance and move Windows 7 to another external, and 10 to the internal, and 7 back to the mSATA. See what kind of mess that makes for you haha

No need to move Win7 back. It's a dead OS now anyway.