Windows 7 ESU: Your Questions Answered About Extended Security Updates
Windows 7 ESU: All Your Burning Questions, Answered!¶
image just illustration
Hey everyone! So, you’re still rocking Windows 7? We get it, it’s a classic. But with mainstream support gone, you’re probably wondering about security. That’s where Extended Security Updates (ESU) come in. We’ve compiled this handy FAQ to answer all your burning questions about Windows 7 ESU. Let’s dive in!
What Exactly Are Windows 7 ESU?¶
Windows 7 Extended Security Updates (ESU) are like a life raft for your trusty Windows 7 machine. They give you crucial security updates for critical and important issues (as defined by the Microsoft Security Response Center, or MSRC) for up to three years after January 14, 2020. If your PC is running Windows 7 after that date and you haven’t purchased ESU, it’s going to be vulnerable to all sorts of nasty stuff. So, ESU is essential for staying protected.
Important Note: Office 2010 is not included in the ESU program and won’t be getting any extended support.
Which Editions Can Get ESU?¶
ESU is available for Windows 7 Professional and Enterprise editions.
When Can I Get It?¶
ESU has been available since April 1, 2019, through the Volume Licensing Service Center (VLSC) and since December 2, 2019, from Cloud Solution Providers (CSPs).
Where Can I Find Out More About Year 2 (and beyond)?¶
The process for buying and installing ESU is the same each year. Check out this link for more info: Year two of Extended Security Updates for Windows 7 and Windows Server 2008
What About Embedded Systems?¶
If you need Windows 7 ESU for embedded systems, you’ll need an Ecosystem Partner Servicing Offering (EPSO) support contract. You can’t purchase Embedded ESU through Volume Licensing. Support end dates for Windows 7 Embedded vary, so be sure to check these links for specific details:
For ESU for Windows Server 2008 R2 for Embedded Systems and SQL Server 2008 R2 for Embedded Systems, reach out to the device’s original manufacturer (OEM).
ESU Purchasing: The Nitty Gritty¶
Purchase Deadlines?¶
You can purchase ESU anytime during the three years it’s offered (2020, 2021, and 2022). However, if you wait until year two or three, you’ll have to pay for the previous years as well, because the security updates are cumulative. You want all of them! Also, keep in mind that without ESU, you won’t have received any bug fixes or security updates since January 14, 2020, and Microsoft Support won’t be there to help.
Catch-Up Costs?¶
Yep, if you buy ESU for the first time in year two or three, you have to pay for the previous year(s) too. Those updates are cumulative, remember? You need year one’s coverage to buy year two, and year two’s coverage to buy year three. You can buy coverage for past years at the same time you buy coverage for the current period, though.
How Does Purchasing Through CSPs Work?¶
CSP Partners can find Windows 7 ESU offerings in the Partner Center under Software on the subscription software price list. For step-by-step instructions, check out this link: Purchasing Windows 7 ESU through a Cloud Solution Provider
Can I Return ESU Purchased Through CSP?¶
There are some limitations. Returns for Windows 7 ESU 2021 purchased through CSP can only be processed after the Year 2 coverage period begins (January 13, 2021).
ESU for Education?¶
Educational institutions can purchase the commercial ESU offering from CSPs. Volume Licensing customers should contact their Account Team CE for pricing. If you’re interested in purchasing through a CSP, you can find a partner here.
What’s the SKU Called in CSP?¶
It’s called “Windows 7 Extended Security Updates 2020.”
Does It Auto-Renew?¶
Nope. Windows 7 ESU is a separate SKU for each year it’s offered (2020, 2021, and 2022). You have to purchase each year separately. Don’t forget! Also, to install the Year 2 SKU, you must have purchased the Year 1 SKU (but installation and activation of the Year 1 SKU isn’t required).
Here’s a breakdown of the coverage dates:
- Windows 7 Extended Security Updates 2020: January 14, 2020 - January 12, 2021
- Windows 7 Extended Security Updates 2021: January 13, 2021 - January 11, 2022
- Windows 7 Extended Security Updates 2022: January 12, 2022 - January 10, 2023
For more details, see: Lifecycle FAQ-Extended Security Updates
Minimum Purchase Requirements?¶
None! Buy what you need.
Do I Need Software Assurance?¶
No, but Volume Licensing customers with subscription licenses for Windows Enterprise SA or Windows Enterprise E3 get better pricing. There are no separate Windows 7 ESU SKUs for CSP customers with active Software Assurance.
Licensing in Virtual Machines?¶
ESU is licensed per device. For on-premises or dedicated VDI, each endpoint accessing a VM running Windows 7 ESU needs a license. It’s the terminals you count, not the VMs. If you’re using Azure Virtual Desktop (AVD), ESU is included at no extra cost for the full three-year period. Bonus!
ESU and Unified Support?¶
ESU is only available through Volume Licensing and CSPs, not Unified Support.
ESU and MPSA?¶
Nope, it’s out-of-scope for MPSA.
Invoice Timing?¶
If you buy ESU before the monthly invoice date, the purchase will appear on the previous month’s invoice.
ESU Coverage: What’s Included?¶
What about Windows XP or Vista?¶
Support for Windows XP and Vista has ended. Time to upgrade to Windows 10!
What About .NET Framework?¶
Windows 7 ESU covers .NET Framework 4.5.2-4.8 (as of January 2020) and .NET Framework 3.5 SP1. Note that .NET Framework 4.5.2, 4.6, and 4.6.1 will reach end of support on April 26, 2022. After that, only .NET Framework 4.6.2 through 4.8 and .NET Framework 3.5 SP1 will be covered.
ESU for Embedded Systems?¶
Yes! There’s a dedicated ESU program for embedded devices. See the section above for more details.
ESU for Windows 7 Pro OEM?¶
Yes, OEM customers can purchase ESU.
ESU for Windows 7 VMs on Azure?¶
It’s delivered the same way as for on-premises clients. See the “ESU deployment” section below for more details.
What about Microsoft Security Essentials (MSE)?¶
MSE will still get signature updates after January 14, 2020, but the platform itself won’t be updated.
What About System Center Endpoint Protection (SCEP)?¶
SCEP definition and engine updates will continue for Windows 7 regardless of ESU status. All supported versions of SCEP offer anti-spyware and anti-virus updates on version 4.10.209. Only SCEP Current Branch will offer AV updates (until January 2023) after the 2012 version reaches end of support in July 2022.
Is Technical Support Included?¶
If you buy directly from Microsoft (VL or CSP direct partners), you can use an active support contract (Software Assurance, Premier, or Unified Support) to get help with Windows 7. Partners can also use Partner Support Plans.
Limits on Technical Support?¶
Technical support for ESU is limited to deployment/installation of ESU keys and updates, and servicing requests for code flaws caused by updates. No other support is provided.
Support without ESU?¶
If you don’t purchase ESU, you can’t log support tickets for Windows 7, even with a support plan.
Can I Use Unified or Premier Support with ESU?¶
Yes, if you purchased ESU through Volume Licensing.
Support for CSP Customers?¶
CSP customers should use their partners for technical support or buy a pay-per-incident plan through Microsoft Professional support.
Can Partners Submit Support Incidents?¶
Yes, CSP direct partners can use their Partner Support plans to request assistance for Windows 7 ESU. Resellers should work with their CSP indirect partners.
How to Get Support?¶
All ESU customers must call Microsoft Support to request technical support. Premier and Unified customers can find the number in Services Hub. Others can find it here.
How Does Support Verify ESU Purchase?¶
Microsoft is working to automate verification. If you bought ESU as part of your Enterprise Agreement, the agent might ask for your Enterprise Agreement number or full customer name. You can find your Agreement Number in the Volume License Service Center.
What if I Need a New Feature?¶
No new features will be developed for Windows 7. ESU is about security and helping you transition to a supported version of Windows (like Windows 10).
What Kind of Support Can I Expect?¶
Microsoft is committed to helping you upgrade to a supported Windows version or migrate to the cloud. ESU support is best-effort for troubleshooting.
Internet Explorer 11 Coverage?¶
Yes, IE 11 gets necessary security updates through Windows 7 ESU.
When Are Updates Released?¶
Usually on the second Tuesday of each month. If there are no critical or important updates for Windows 7 in a given month, there won’t be any ESU updates that month. Off-cycle updates are possible if needed.
Advance Notification of Updates?¶
Currently, no. But you can see past updates here.
Full List of Updates?¶
You can find that here.
ESU Deployment: Getting Started¶
Any Prerequisites?¶
Yes! Before you deploy ESU, read this: Obtaining Extended Security Updates for eligible Windows devices
Installing and Activating the MAK Key?¶
Check out the same link as above for instructions. For info on installing and activating MAK keys on multiple devices in an on-premises Active Directory domain, see this article: Activate Windows 7 ESUs on multiple devices with a MAK
Note: Installing MAK keys allows you to receive ESU. It doesn’t replace your current product key or reactivate your system. You’ll need a new MAK key for each year you use ESU.
Do I Need to Uninstall the Year 1 Key to Install the Year 2 Key?¶
Nope! Just install the Year 2 key like you did the Year 1 key.
Can I Install Updates Anytime?¶
Yes, you can! This lets you stick with your existing update process.
Why ESU License Preparation Packages?¶
The ESU License Preparation Packages (for Windows 7 SP1 and Windows Server 2008 R2 SP1 and for Windows Server 2008 SP2) improve the activation process and reduce disruption.
How is ESU Delivered for Volume Licensing?¶
If you use Volume Licensing, you’ll get a MAK key in the VLSC. This key is separate from your Windows 7 activation key and won’t interfere with your KMS activation. You can find the key in the VLSC under Licenses > Relationship Summary > [Licensing ID] > Product Keys.
Note: [Licensing ID] is your organization’s licensing ID.
The product key list will include the ESU key (called Windows 7 Ext Security Year 1 MAK). You can then deploy the new MAK key and any required servicing stack updates, and then continue with your usual update process using Windows Update, WSUS, or your preferred solution.
New MAK Key Each Year?¶
Yes, you’ll need a new key for each year.
When Does My ESU Key Expire?¶
The yearly ESU MAK keys don’t expire. However, they only allow updates within their designated time frame. A Year 1 key will let you install Year 1 updates even after Year 1 ends, but it won’t get you Year 2 updates.
Reinstalling Windows 7 with ESU?¶
If you buy ESU through a partner, contact them for additional activations. If you purchased through VLSC, open a VLSC support case.
ESU Delivery Channels?¶
ESU is delivered through all the usual channels, including Configuration Manager (current branch, version 1910 or later), Windows Update, WSUS, and the Microsoft Update Catalog. Note that ESU License Preparation Packages aren’t available through Windows Update.
Offline Servicing?¶
No, online servicing is required.
Checking Remaining Activations on MAK Key, Additional Activations, and Phone Activation:¶
For these and other questions, refer to the resources linked throughout this FAQ. Specifically, the guide on Obtaining Extended Security Updates offers detailed instructions.
ESU for Windows 7 Embedded: Specific Details¶
Embedded Systems and ESU?¶
Yes! There’s a specific ESU program for embedded devices, including Windows 7 for Embedded Systems, Windows Embedded Standard 7, and Windows Embedded POSReady 7. It also covers Windows Server 2008 R2 for Embedded Systems and SQL Server 2008 R2 for Embedded Systems. Contact your OEM for all embedded ESU needs.
More Info on Embedded ESU?¶
Reach out to your OEM.
Why Isn’t WES ESU Available through CSP or Volume Licensing?¶
Because it’s an embedded-only OS available only from OEMs.
Cost of WES ESU?¶
Contact your OEM.
Are WES Devices Unprotected After October 13, 2020?¶
Devices will have the latest updates until the next batch of security updates is released. Without ESU, they become vulnerable. For more on security update ratings, visit the Microsoft Security Response Center (MSRC): https://aka.ms/msrc_ratings
Post a Comment