%3CLINGO-SUB%20id%3D%22lingo-sub-1140224%22%20slang%3D%22en-US%22%3ERe%3A%20Preparing%20to%20Deploy%20Extended%20Security%20Updates%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1140224%22%20slang%3D%22en-US%22%3ESecurity%20Only%20update%20for%20January%202020%20(KB4534314)%20or%20December%202019%20(KB4530692)%2C%20both%20contain%20the%20needed%20prerequisite%20to%20install%20ESU%20keys%2C%20quality%20monthly%20rollup%20is%20not%20needed%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1141021%22%20slang%3D%22en-US%22%3ERe%3A%20Preparing%20to%20Deploy%20Extended%20Security%20Updates%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1141021%22%20slang%3D%22en-US%22%3E%3CP%3EJon%2C%20I'm%20sorry%20but%20this%20statement%20is%20not%20true%2C%20or%20at%20least%20badly%20worded%3A%3C%2FP%3E%3CP%3E%22The%20key%20for%20ESU%20are%20Multiple%20Activation%20Keys%20(MAK)%20and%20you%20cannot%20use%20KMS%20to%20activate%20them.%22%3C%2FP%3E%3CP%3EWhile%20you%20can't%20use%20the%20KMS%20to%20auto-activate%20the%20MAK%20key%20for%20the%20ESU%20updates%20the%20manual%20activation%20of%20the%20key%20using%20you%20KMS%20(VAMT%20to%20be%20precise)%20is%20100%25%20supported%20and%20also%20intended.%20We%20opened%20a%20support%20case%20a%20few%20weeks%20ago%20about%20the%20specifics%20of%20the%20ESU%20activation%20and%20it%20was%20specifically%20confirmed%20to%20be%20the%20only%20supported%20ESU%20activation%20method%20for%20systems%20unable%20to%20reach%20th%20MS%20cloud%20activation%20servers.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1141093%22%20slang%3D%22en-US%22%3ERe%3A%20Preparing%20to%20Deploy%20Extended%20Security%20Updates%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1141093%22%20slang%3D%22en-US%22%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F539089%22%20target%3D%22_blank%22%3E%40spucktier%3C%2FA%3E%20Thanks%20for%20pointing%20out%20the%20confusing%20statement.%20I%20am%20updating%20the%20post%20to%20clarify%20the%20use%20of%20VAMT.%20It%20is%20correct%20that%20VMAT%20is%20100%25%20supported%20and%20the%20intended%20method%20when%20systems%20are%20not%20internet%20connected.%20I%20do%20have%20a%20follow%20up%20post%20that%20will%20cover%20the%20use%20of%20VAMT.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1139851%22%20slang%3D%22en-US%22%3EPreparing%20to%20Deploy%20Extended%20Security%20Updates%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1139851%22%20slang%3D%22en-US%22%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3EUpdate%2002.03.2020%3A%20Updated%20post%20to%20confirm%20that%20Security%20Only%20Quality%20Updates%20from%20November%202019%20and%20onward%20satisfy%20the%20pre-requisites%20for%20the%20ESU%20key.%3C%2FSTRONG%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWith%20the%20end%20of%20support%20for%20these%20Operating%20Systems%20on%20January%2014%2C%202020%2C%20many%20of%20our%20customers%20are%20asking%20for%20help%20on%20how%20to%20get%20ready%20to%20deploy%20Extended%20Security%20Updates%20(ESU).%20To%20that%20end%2C%20I%20would%20like%20to%20share%20the%20work%20of%20Curtis%20Ricard%20a%20Senior%20Premier%20Field%20Engineer%20on%20how%20to%20use%20Microsoft%20Endpoint%20Configuration%20Manager%20(ConfigMgr)%20to%20ensure%20that%20your%20clients%20are%20ready%20to%20receive%20the%20ESU%20updates.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ECurtis%20and%20I%20both%20engage%20with%20customers%20that%20have%20chosen%20to%20utilize%20the%20Extended%20Security%20Update%20program.%20If%20you%20would%20like%20to%20know%20more%20about%20the%20program%20please%20review%20%3CA%20href%3D%22https%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F4497181%2Flifecycle-faq-extended-security-updates%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F4497181%2Flifecycle-faq-extended-security-updates%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThere%20are%20a%20few%20key%20points%20to%20consider%20with%20this%20program%3A%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3EThe%20Extended%20Security%20Update%20(ESU)%20program%20is%20a%20last%20resort%20option%20for%20customers%20who%20need%20to%20run%20certain%20legacy%20Microsoft%20products%20past%20the%20end%20of%20support.%20It%20includes%20Critical*%20and%2For%20Important*%20security%20updates%20for%20a%20maximum%20of%20three%20years%20after%20the%20product%E2%80%99s%20End%20of%20Extended%20Support%20date.%20Extended%20Security%20Updates%20will%20be%20distributed%20if%20and%20when%20available.%3C%2FLI%3E%0A%3CLI%3EESUs%20do%26nbsp%3B%3CSTRONG%3E%3CEM%3Enot%26nbsp%3B%3C%2FEM%3E%3C%2FSTRONG%3Einclude%20new%20features%2C%20customer-requested%20non-security%20updates%2C%20or%20design%20change%20requests.%3C%2FLI%3E%0A%3CLI%3EAll%20Windows%207%20customers%20will%20get%20an%20update%20on%20January%2014%2C%202020%20as%20the%20operating%20system%20is%20in%20support%20until%20then.%20Updates%20for%20these%20operating%20systems%26nbsp%3B%3CEM%3Eafter%26nbsp%3B%3C%2FEM%3EJanuary%2014%2C%202020%20will%20be%20for%20ESU%20customers%20only.%20ESU%20is%20available%20for%20Win%207%20Professional%20%26amp%3B%20Win%207%20Enterprise.%3C%2FLI%3E%0A%3CLI%3ECustomers%20use%20the%20support%20plan%20they%20have%3B%20ESU%20offering%20does%20not%20include%20technical%20support*%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%3CEM%3E*If%20any%20root%20cause%20investigation%20determines%20that%20resolution%20requires%20product%20enhancement(s)%20available%20in%20a%20more%20recent%20release%2C%20then%20customer%20may%20be%20required%20to%20upgrade%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAlso%20see%20the%20%E2%80%9CHow%20to%20get%20Extended%20Security%20Updates%20for%20eligible%20Windows%20devices%E2%80%9D%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2FWindows-IT-Pro-Blog%2FHow-to-get-Extended-Security-Updates-for-eligible-Windows%2Fba-p%2F917807%22%20target%3D%22_self%22%3Eblog%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%3CEM%3E*For%20licensing%20purchase%20questions%2C%20please%20contact%20your%20Microsoft%20Account%20Team.%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIf%20you%20have%20chosen%20to%20purchase%20ESU%20support%20then%20there%20are%20some%20prerequisites%20for%20your%20on-premise%20device(s)%20that%20must%20be%20met%20to%20ensure%20that%20your%20systems%20will%20be%20able%20to%20install%20the%20ESU%20updates%3A%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3EInstall%20the%20following%20SHA-2%20code%20signing%20support%20update%20and%20servicing%20stack%20update%20(SSU)%20or%20a%20later%20SSU%20update%3A%3CUL%3E%0A%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Fsupport.microsoft.com%2Fhelp%2F4474419%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E4474419%3C%2FA%3E%20SHA-2%20code%20signing%20support%20update%20for%20Windows%20Server%202008%20R2%2C%20Windows%207%2C%20and%20Windows%20Server%202008%3A%20September%2023%2C%202019%3C%2FLI%3E%0A%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F4490628%2Fservicing-stack-update-for-windows-7-sp1-and-windows-server-2008-r2%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E4490628%3C%2FA%3E%20Servicing%20stack%20update%20for%20Windows%207%20SP1%20and%20Windows%20Server%202008%20R2%20SP1%3A%20March%2012%2C%202019%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3C%2FLI%3E%0A%3CLI%3EFor%20Windows%207%20and%20Windows%20Server%202008%20R2%2C%20install%20at%20least%20one%20of%20the%20following%20servicing%20stack%20updates%20(SSU)%3A%3CUL%3E%0A%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F4516655%2Fcompatibility-update-for-installing-windows-7-sp1-and-server-2008-r2%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E4516655%3C%2FA%3E%20%3CFONT%20size%3D%223%22%3EServicing%20stack%20update%20for%20Windows%207%20SP1%20and%20Server%202008%20R2%20SP1%3A%20September%2010%2C%202019%3C%2FFONT%3E%3C%2FLI%3E%0A%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F4523206%2Fservicing-stack-update-for-windows-7-sp1-and-server-2008-r2-sp1%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E4523206%3C%2FA%3E%26nbsp%3BServicing%20stack%20update%20for%20Windows%207%20SP1%20and%20Server%202008%20R2%20SP1%3A%20November%2012%2C%202019%3C%2FLI%3E%0A%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F4531786%2Fservicing-stack-update-for-windows-7-sp1-and-server-2008-r2-sp1%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E4531786%3C%2FA%3E%26nbsp%3BServicing%20stack%20update%20for%20Windows%207%20SP1%20and%20Server%202008%20R2%20SP1%3A%20December%2010%2C%202019%3C%2FLI%3E%0A%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F4536952%2Fservicing-stack-update-for-windows-7-sp1-and-server-2008-r2-sp1%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E4536952%3C%2FA%3E%26nbsp%3BServicing%20stack%20update%20for%20Windows%207%20SP1%20and%20Server%202008%20R2%20SP1%3A%20January%2014%2C%202020%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3C%2FLI%3E%0A%3CLI%3EFor%20Windows%20Server%202008%2C%20install%20at%20least%20one%20of%20the%20following%20servicing%20stack%20updates%20(SSU)%3A%3CUL%3E%0A%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F4517134%2Fcompatibility-update-for-installing-windows-server-2008-sp2%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E4517134%3C%2FA%3E%26nbsp%3BServicing%20stack%20update%20for%20Windows%20Server%202008%20SP2%3A%20September%2010%2C%202019%3C%2FLI%3E%0A%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F4526478%2Fservicing-stack-update-for-windows-server-2008-sp2%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E4526478%3C%2FA%3E%26nbsp%3BServicing%20stack%20update%20for%20Windows%20Server%202008%20SP2%3A%20November%2012%2C%202019%3C%2FLI%3E%0A%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F4531787%2Fservicing-stack-update-for-windows-server-2008-sp2%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E4531787%3C%2FA%3E%26nbsp%3BServicing%20stack%20update%20for%20Windows%20Server%202008%20SP2%3A%20December%2010%2C%202019%3C%2FLI%3E%0A%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F4536953%2Fservicing-stack-update-for-windows-server-2008-sp2%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E4536953%3C%2FA%3E%26nbsp%3BServicing%20stack%20update%20for%20Windows%20Server%202008%20SP2%3A%20January%2014%2C%202020%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3C%2FLI%3E%0A%3CLI%3EFor%20Windows%207%20and%20Windows%20Server%202008%20R2%2C%20install%20at%20least%20one%20of%20the%20following%20security%20updates%3A%3CUL%3E%0A%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F4519976%2Fwindows-7-update-kb4519976%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E4519976%3C%2FA%3E%26nbsp%3BOctober%208%2C%202019%E2%80%94KB4519976%20(Monthly%20Rollup)%3C%2FLI%3E%0A%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F4525235%2Fwindows-7-update-kb4525235%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E4525235%3C%2FA%3E%20November%2012%2C%202019%E2%80%94KB4525235%20(Monthly%20Rollup)%3C%2FLI%3E%0A%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F4525233%2Fwindows-7-update-kb4525233%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E4525233%3C%2FA%3E%20November%2012%2C%202019%E2%80%94KB4525233%20(Security-only%20update)%3C%2FLI%3E%0A%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F4530734%2Fwindows-7-update-kb4530734%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E4530734%3C%2FA%3E%20December%2010%2C%202019%E2%80%94KB4530734%20(Monthly%20Rollup)%3C%2FLI%3E%0A%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F4530692%2Fwindows-7-update-kb4530692%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E4530692%3C%2FA%3E%20December%2010%2C%202019%E2%80%94KB4530692%20(Security-only%20update)%3C%2FLI%3E%0A%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F4534310%2Fwindows-7-update-kb4534310%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E4534310%3C%2FA%3E%20January%2014%2C%202020%E2%80%94KB4534310%20(Monthly%20Rollup)%3C%2FLI%3E%0A%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F4534314%2Fwindows-7-update-kb4534314%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E4534314%3C%2FA%3E%20January%2014%2C%202020%E2%80%94KB4534314%20(Security-only%20update)%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3C%2FLI%3E%0A%3CLI%3EFor%20Windows%20Server%202008%2C%20install%20at%20least%20one%20of%20the%20following%20security%20updates%3A%3CUL%3E%0A%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F4520002%2Fwindows-server-2008-update-kb4520002%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E4520002%3C%2FA%3E%20October%208%2C%202019%E2%80%94KB4520002%20(Monthly%20Rollup)%3C%2FLI%3E%0A%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F4525234%2Fwindows-server-2008-update-kb4525234%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E4525234%3C%2FA%3E%20November%2012%2C%202019%E2%80%94KB4525234%20(Monthly%20Rollup)%3C%2FLI%3E%0A%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F4525239%2Fwindows-server-2008-update-kb4525239%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E4525239%3C%2FA%3E%20November%2012%2C%202019%E2%80%94KB4525239%20(Security-only%20update)%3C%2FLI%3E%0A%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F4530695%2Fwindows-server-2008-update-kb4530695%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E4530695%3C%2FA%3E%20December%2010%2C%202019%E2%80%94KB4530695%20(Monthly%20Rollup)%3C%2FLI%3E%0A%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F4530719%2Fwindows-server-2008-update-kb4530719%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E4530719%3C%2FA%3E%20December%2010%2C%202019%E2%80%94KB4530719%20(Security-only%20update)%3C%2FLI%3E%0A%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F4534303%2Fwindows-server-2008-update-kb4534303%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E4534303%3C%2FA%3E%20January%2014%2C%202020%E2%80%94KB4534303%20(Monthly%20Rollup)%3C%2FLI%3E%0A%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F4534312%2Fwindows-server-2008-update-kb4534312%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E4534312%3C%2FA%3E%20January%2014%2C%202020%E2%80%94KB4534312%20(Security-only%20update)%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CUL%3E%0A%3CLI%3EInstall%20and%20activate%20the%20ESU%20key.%3CUL%3E%0A%3CLI%3EFor%20information%20about%20how%20to%20install%20and%20activate%20the%20ESU%20key%2C%20see%20the%20%E2%80%9CHow%20to%20get%20Extended%20Security%20Updates%20for%20eligible%20Windows%20devices%E2%80%9D%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2FWindows-IT-Pro-Blog%2FHow-to-get-Extended-Security-Updates-for-eligible-Windows%2Fba-p%2F917807%22%20target%3D%22_blank%22%20rel%3D%22noopener%22%3Eblog%3C%2FA%3E%20on%20the%20Microsoft%20Tech%20Community%20website.%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EOnce%20you%20have%20the%20prerequisites%20in%20place%2C%20the%20following%20update%20will%20help%20you%20verify%20that%20your%20eligible%20Windows%207%20SP1%20devices%20can%20continue%20to%20get%20the%20ESUs%20after%20the%20end%20of%20support%20date%20of%20January%2014%2C%202020.%20(Installing%20this%20update%20has%20no%20impact%20on%20getting%20security%20updates%26nbsp%3Bbetween%20now%20and%26nbsp%3BJanuary%2014%2C%202020)%20%3CA%20href%3D%22https%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F4528069%2Fupdate-for-eligible-windows-7-and-server-2008-r2-devices-can-get-esu%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F4528069%2Fupdate-for-eligible-windows-7-and-server-2008-r2-devices-can-get-esu%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ENote%3A%20After%20activation%2C%20you%20can%20then%20continue%20to%20use%20your%20current%20update%20and%20servicing%20strategy%20to%20deploy%20ESU%20through%20Windows%20Update%2C%20Windows%20Server%20Update%20Services%20(WSUS)%20or%20other%20update%20management%20solutions%20that%20you%20prefer.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ENow%20that%20all%20of%20that%20is%20covered%2C%20you%20are%20faced%20with%20deploying%20the%20new%20keys%20to%20all%20the%20systems%20that%20you%20purchased%20support%20for.%20The%20key%20for%20ESU%20are%20Multiple%20Activation%20Keys%20(MAK)%20and%20you%20cannot%20use%20KMS%20auto%20activate%20them.%20The%26nbsp%3B%3CSPAN%3EVolume%20Activation%20Management%20Tool%20(VAMT)%20is%20supported%20for%20online%20and%20proxy%20activations.%3C%2FSPAN%3E%26nbsp%3BIf%20your%20systems%20have%20internet%20access%2C%20then%20you%20can%20leverage%20ConfigMgr%20to%20ensure%20that%20the%20prerequisites%20and%20the%20appropriate%20ESU%20keys%20are%20in%20place%20and%20activated%20without%20VAMT.%3C%2FP%3E%0A%3CP%3EYou%20can%20leverage%20PowerShell%20to%20quickly%20check%20if%20the%20required%20patches%20are%20installed.%20For%20example%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%20class%3D%22lia-code-sample%20language-csharp%22%3E%3CCODE%3E%20get-hotfix%20-Id%20kb4474419%3C%2FCODE%3E%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWill%20quickly%20determine%20if%20the%20SHA2%20code%20signing%20patch%20has%20been%20installed.%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F168082i20545A776689E498%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22clipboard_image_0.png%22%20title%3D%22clipboard_image_0.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAnd%20quickly%20error%20out%20if%20it%20is%20not%20installed.%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F168083i857EF781051DE11D%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22clipboard_image_1.png%22%20title%3D%22clipboard_image_1.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EYou%20can%20use%20that%20to%20create%20a%20compliance%20item%20to%20check%20all%20your%20systems%20to%20determine%20which%20have%20the%20required%20patches%20and%20which%20need%20to%20have%20them%20installed.%20An%20example%20of%20a%20compliance%20item%20script%20to%20check%20would%20be%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%20class%3D%22lia-code-sample%20language-csharp%22%3E%3CCODE%3EFunction%20lookuphotfix%20(%24Hotfixid)%0A%20%7B%0A%20%24hotfixResult%20%3D%20Get-HotFix%20%20-ComputerName%20%24env%3AComputername%20%7C%20Where-Object%20%7B%24_.HotfixID%20-eq%20%24HotfixID%7D%20%20%20%0A%20%20%20%20%20%20%20%20if(%24hotfixResult)%20%7Breturn%20%24true%7D%0A%7D%0A%0A%24strCompliant%20%3D%20%22Non-Compliant%22%0AIf%20(lookuphotfix%20kb4474419%20-eq%20%24true)%7B%24StrCompliant%20%3D%20%22Compliant%22%7D%20%20%23SHA-2%20Update%20-%20REQUIRED%0Awrite-host%20%24strCompliant%0A%3C%2FCODE%3E%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EOnce%20all%20the%20required%20prerequisites%20are%20in%20place%20you%20can%20then%20use%20a%20compliance%20item%20to%20deploy%20the%20keys.%20Here%20links%20to%20example%20of%20PowerShell%20scripts%20to%20do%20that%2C%20simply%20add%20your%20ESU%20key%20to%20the%20appropriate%20%24ESUKEY%26nbsp%3B%3D%26nbsp%3B%22%3CINSERT-ESU-KEY-HERE%3E%22%20line(s).%3C%2FINSERT-ESU-KEY-HERE%3E%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fgithub.com%2Fmrbodean%2FAskPFE%2Fblob%2Fmaster%2FPreparing%2520to%2520deploy%2520Extended%2520Security%2520Updates%2FESU_CustFacing_Baselines%2FESU_KEY_DETECTION_SCRIPT_Baseline2_v3.ps1%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EDetection%20Script%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fgithub.com%2Fmrbodean%2FAskPFE%2Fblob%2Fmaster%2FPreparing%2520to%2520deploy%2520Extended%2520Security%2520Updates%2FESU_CustFacing_Baselines%2FESU_KEY_REMEDIATION_SCRIPT_Baseline2_v3.ps1%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3ERemediation%20Script%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIn%20addition%20to%20the%20sample%20scripts%20you%20can%20also%20utilize%20a%20set%20of%20sample%20configuration%20items%20and%20baselines%20available%20on%20via%20my%20GitHub%20repository%20%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThey%20are%20available%20individually%20or%20as%20a%20zip%20file%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fgithub.com%2Fmrbodean%2FAskPFE%2Fraw%2Fmaster%2FPreparing%2520to%2520deploy%2520Extended%2520Security%2520Updates%2FESU_CustFacing_Baselines.zip%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EZip%20file%20with%20all%20Baselines%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fgithub.com%2Fmrbodean%2FAskPFE%2Ftree%2Fmaster%2FPreparing%2520to%2520deploy%2520Extended%2520Security%2520Updates%2FESU_CustFacing_Baselines%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EIndividual%20Baselines%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EDownload%20the%20zip%20file%20and%20extract%20the%20contents%20so%20that%20you%20can%20import%20the%20baselines.%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F168084i7B4AF2FE61807082%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22clipboard_image_2.png%22%20title%3D%22clipboard_image_2.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EYou%20will%20be%20prompted%20to%20for%20each%20of%20the%20baselines%20that%20the%20publisher%20could%20not%20be%20verified%20and%20to%20confirm%20that%20you%20want%20to%20import%20the%20files.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F168085i338A67BAE0E8ABC6%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22clipboard_image_3.png%22%20title%3D%22clipboard_image_3.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAfter%20confirming%20the%20selection%20for%20each%20of%20the%20files%20you%20will%20see%204%20cab%20files%20to%20be%20imported%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F168086i23D633170505FDAE%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22clipboard_image_4.png%22%20title%3D%22clipboard_image_4.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWhen%20you%20select%20next%2C%20you%20see%20the%20detailed%20list%20of%20the%20configuration%20baselines%20and%20configuration%20items%20that%20will%20be%20added.%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F168087i839B7340C3EFCB46%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22clipboard_image_5.png%22%20title%3D%22clipboard_image_5.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ESelect%20next%20and%20then%20close%20to%20complete%20the%20import.%3C%2FP%3E%0A%3CP%3EThe%20following%20baselines%20are%20intended%20for%20use%20on%20clients%20that%20have%20Internet%20access%3A%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3EBaseline%201A%3A%26nbsp%3B%20This%20baseline%20is%20intended%20for%20Server%202008%2F2008R2%20clients%2C%20and%20checks%20for%20OS-specific%20pre-requisite%20KBs.%26nbsp%3B%20You%20can%20deploy%20the%20remediation%20baseline%20(Baseline%202%2C%20below)%20to%20systems%20that%20are%20compliant%20with%20this%20KB%20check.%3C%2FLI%3E%0A%3CLI%3EBaseline%201B%3A%26nbsp%3B%20This%20baseline%20is%20intended%20for%20Windows%207%20clients%2C%20and%20checks%20for%20Windows%207%20pre-requisite%20KBs.%26nbsp%3B%20You%20can%20deploy%20the%20remediation%20baseline%20(Baseline%202%2C%20below)%20to%20systems%20that%20are%20compliant%20with%20this%20KB%20check.%3C%2FLI%3E%0A%3CLI%3EBaseline%202%3A%26nbsp%3B%20This%20baseline%20will%20detect%20the%20state%20of%20the%20ESU%20key%20and%20remediate%20(Detect%20%26amp%3B%20Install%20ESU%20Key)%20if%20needed.%26nbsp%3B%20It%20should%20be%20deployed%20to%20clients%20that%20meet%20the%20KB%20pre-requisites%20(see%20baselines%201A%20and%201B)%20and%20it%20needs%20to%20be%20updated%20with%20the%20your%20ESU%20keys%20before%20deployment.%26nbsp%3B%3C%2FLI%3E%0A%3CLI%3EBaseline%203%3A%26nbsp%3B%20This%20checks%20for%20an%20optional%20KB%20we%20released%2C%20that%20is%20a%20non-security%20update.%26nbsp%3B%20If%20this%20update%20installs%20successfully%2C%20it%20indicates%20the%20client%20has%20an%20installed%2Factivated%20ESU%20license.%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EUpdate%20the%20scripts%20to%20include%20your%20ESU%20key(s)%20and%20deploy%20to%20your%20systems.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EOne%20other%20item%20to%20note%20is%20that%20there%20are%20Asset%20Intelligence%20reports%20available%20that%20interact%20with%20the%20Software%20Licensing%20Service%2C%20allowing%20you%20to%20report%20on%20ESU%20keys%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F168088i29C5EB486AE9902E%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22clipboard_image_6.png%22%20title%3D%22clipboard_image_6.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F168089i6B7B205062FA42FE%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22clipboard_image_7.png%22%20title%3D%22clipboard_image_7.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EHopefully%20you%20will%20find%20this%20helpful%20and%20check%20back%20in%20next%20time%20when%20we%20talk%20about%20options%20for%20systems%20without%20internet%20connectivity.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EResources%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3EITPro%20FAQ%20end%20of%20support%20Win%207%3A%20%3CA%20href%3D%22https%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F4527873%2Fitpro-faq-about-end-of-support-for-windows-7%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F4527873%2Fitpro-faq-about-end-of-support-for-windows-7%3C%2FA%3E%3C%2FLI%3E%0A%3CLI%3EESU%20Lifecycle%20FAQ%3A%20%3CA%20href%3D%22https%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F4497181%2Flifecycle-faq-extended-security-updates%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F4497181%2Flifecycle-faq-extended-security-updates%3C%2FA%3E%3C%2FLI%3E%0A%3CLI%3EUpdate%20to%20verify%20eligible%20Win%207%20SP1%20devices%20can%20get%20ESUs%3A%20%3CA%20href%3D%22https%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F4528069%2Fupdate-for-eligible-windows-7-and-server-2008-r2-devices-can-get-esu%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F4528069%2Fupdate-for-eligible-windows-7-and-server-2008-r2-devices-can-get-esu%3C%2FA%3E%3C%2FLI%3E%0A%3CLI%3EBlog%3A%20%E2%80%9CHow%20to%20get%20ESUs%20for%20eligible%20Windows%20devices%E2%80%9D%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2FWindows-IT-Pro-Blog%2FHow-to-get-Extended-Security-Updates-for-eligible-Windows%2Fba-p%2F917807%22%20target%3D%22_blank%22%20rel%3D%22noopener%22%3Ehttps%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2FWindows-IT-Pro-Blog%2FHow-to-get-Extended-Security-Updates-for-eligible-Windows%2Fba-p%2F917807%3C%2FA%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ECommon%20Questions%3C%2FP%3E%0A%3CP%3E%3CEM%3EAnswers%20sourced%20from%20reference%20materials%20as%20well%20as%20confirmed%20with%20the%20Microsoft%20Product%20Group%20where%20applicable%2C%20unless%20noted%20as%20otherwise.%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3EQ%3A%20Is%20there%20a%20work%20around%20for%20Quality%20Update%20requirement%3F%3C%2FLI%3E%0A%3CLI%3EA%3A%20%3CSTRIKE%3E%E2%80%9CThere%20is%20no%20work%20around.%26nbsp%3BThis%20(October%20or%20newer%20monthly%20rollup)%20is%20required%20%E2%80%93%20as%20it%20was%20written%20in%20the%20article.%20%E2%80%9C%3C%2FSTRIKE%3E%20The%20November%202019%20or%20a%20later%20security-only%20update%20package%20can%20be%20used%20as%20a%20substitute%20for%20the%20monthly%20rollup%20in%20the%20Installation%20prerequisites.%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CHR%20%2F%3E%0A%3CUL%3E%0A%3CLI%3EQ%3A%20Do%20we%20have%20to%20apply%20the%20Quality%20Update%20moving%20forward%20or%20could%20be%20apply%20security%20only%3F%3C%2FLI%3E%0A%3CLI%3EA%3A%20%E2%80%9CYou%20can%20go%20back%20to%20Security%20Only%20(for%20the%20remaining%20updates%20through%2014-Jan-2020)%20after%20applying%20the%20October%20or%20newer%20monthly%20roll%20up%20(in%20preparation%20for%20the%20ESU)%20%E2%80%9D%20(Of%20course%2C%20ESUs%20will%20contain%20only%20Critical%20or%20Important%20Security%20updates)%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CHR%20%2F%3E%0A%3CUL%3E%0A%3CLI%3EQ%3A%20If%20we%20have%20never%20installed%20the%20Quality%20Update%2C%20do%20we%20know%20how%20much%20drive%20space%20that%20will%20take%3F%3C%2FLI%3E%0A%3CLI%3EA%3A%20The%20October%20Security%20Monthly%20Quality%20Rollup%20(KB4519976)%20is%20308%20MB%20to%20download.%26nbsp%3B%20Applying%20the%20update%20will%20take%20a%20similar%20amount%20of%20space.%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CHR%20%2F%3E%0A%3CUL%3E%0A%3CLI%3EQ%3A%26nbsp%3B%20Why%20isn%E2%80%99t%20KMS%20available%20as%20a%20deployment%20option%20for%20ESU%3F%3C%2FLI%3E%0A%3CLI%3EA%3A%20%E2%80%9CKMS%20is%20not%20supported%20for%20the%20ESU%20MAK%20process.%26nbsp%3B%20KMS%20would%20have%20required%20re-architecting%20to%20support%20ESU.%26nbsp%3B%20This%20was%20determined%20to%20be%20too%20high%20of%20a%20risk%20for%20our%20enterprise%20customers%20and%20for%20our%20Windows%20development%20teams.%26nbsp%3B%20Any%20work%20to%20re-architect%20KMS%20would%20have%20resulted%20in%20considerable%20instability%20of%20Windows%20Server%202008%20R2%20at%20a%20time%20when%20customers%20need%20it%20to%20be%20absolutely%20stable.%E2%80%9D%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-1139851%22%20slang%3D%22en-US%22%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20476px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F168080i07E8E2BB5E875A33%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22suc_activation.png%22%20title%3D%22suc_activation.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3EWith%20the%20end%20of%20support%20for%20Windows%207%2C%20Windows%20Server%202008%2C%20and%20Windows%20Server%202008%20R2%20on%20January%2014%2C%202020%2C%20many%20of%20our%20customers%20are%20asking%20for%20help%20on%20how%20to%20get%20ready%20to%20deploy%20Extended%20Security%20Updates%20(ESU).%3C%2FP%3E%3C%2FLINGO-TEASER%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1139851%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EJonathanWarnken%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1147336%22%20slang%3D%22en-US%22%3ERe%3A%20Preparing%20to%20Deploy%20Extended%20Security%20Updates%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1147336%22%20slang%3D%22en-US%22%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F306569%22%20target%3D%22_blank%22%3E%40abbodi1406%3C%2FA%3E%20I%20have%20confirmation%20that%20the%20November%202019%20or%20a%20later%20security-only%20update%20package%20can%20be%20used%20as%20a%20substitute%20for%20the%20monthly%20rollup%20in%20the%20Installation%20prerequisites.%20The%20post%20has%20been%20update%20to%20reflect%20all%20of%20the%20possible%20prerequisite%20patches.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1160653%22%20slang%3D%22en-US%22%3ERe%3A%20Preparing%20to%20Deploy%20Extended%20Security%20Updates%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1160653%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20completed%20above%20steps%20without%20valid%20MAK%20keys.%26nbsp%3B%20As%20a%20result%20the%20configuration%20on%20the%20client%20side%20is%20Non%20Compliant%20in%20Control%20Panel%20-%20Configuration%20Manager.%26nbsp%3B%20It%20looks%20like%20a%20valid%20MAK%20key%20is%20required%20to%20get%20the%20compliance%20working.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EFor%20test%20purpose%2C%20I%20used%20this%20as%20MAK%20key%20-%2011111-22222-333333-444444-555555%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ERam%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1161078%22%20slang%3D%22en-US%22%3ERe%3A%20Preparing%20to%20Deploy%20Extended%20Security%20Updates%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1161078%22%20slang%3D%22en-US%22%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F340224%22%20target%3D%22_blank%22%3E%40RamLan%3C%2FA%3E%20You%20are%20correct%20the%20detection%20script%20verifies%20that%20the%20key%20is%20installed%20and%20activated.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1174444%22%20slang%3D%22en-US%22%3ERe%3A%20Preparing%20to%20Deploy%20Extended%20Security%20Updates%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1174444%22%20slang%3D%22en-US%22%3E%3CP%3EThis%20is%20very%20descriptive%20and%20informative.%20Thanks%20for%20putting%20this%20together!%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1220263%22%20slang%3D%22en-US%22%3ERe%3A%20Preparing%20to%20Deploy%20Extended%20Security%20Updates%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1220263%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F179584%22%20target%3D%22_blank%22%3E%40Jon%20Warnken%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIn%20the%20detection%20script%2C%20there%20is%20a%20part%20looking%20for%20product%20type%3A%3C%2FP%3E%3CPRE%3E%20%24OS%20%3D%20Get-WmiObject%20Win32_OperatingSystem%0A%20%20%20%20foreach%20(%24ObjItem%20in%20%24OS)%7B%0A%20%20%20%20%20%20%20%20%24SystemRole%20%3D%20%24SystemRole%20%3D%20%24ObjItem.ProductType%0A%20%20%20%20%20%20%20%20Switch%20(%24SystemRole)%7B%20%0A%20%20%20%20%20%20%20%20%20%20%20%201%7B%24Type%20%3D%20%22Desktop%22%7D%0A%20%20%20%20%20%20%20%20%20%20%20%202%7B%24Type%20%3D%20%22UNSUPPORTED%22%7D%0A%20%20%20%20%20%20%20%20%20%20%20%203%7B%24Type%20%3D%20%22Server%22%7D%0A%20%20%20%20%20%20%20%20%7D%20%23End%20Switch%20Statement%0A%20%20%20%20%20%7D%20%23End%20foreach%20loop%3C%2FPRE%3E%3CP%3EDomain%20Controller%20(in%20my%20case%20Windows%20server%202008%20R2%20domain%20controller)%20will%20return%20type%202%20which%20is%20ok.%20(See%20the%20following%20chart)%3C%2FP%3E%3CPRE%3EWMI%20Win32_OperatingSystem%20ProductType%20Tips%3A%0AProductType%201%20%3D%20Desktop%20OS%0AProductType%202%20%3D%20Server%20OS%20%E2%80%93%20Domain%20Controller%0AProductType%203%20%3D%20Server%20OS%20%E2%80%93%20Not%20a%20Domain%20Controller%3C%2FPRE%3E%3CP%3EDoes%20it%20mean%20Windows%202008%20R2%20Domain%20Controller%20does%20not%20support%20installing%20ESU%20key%20or%20it's%20just%20a%20bug%20to%20fix%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1251240%22%20slang%3D%22en-US%22%3ERe%3A%20Preparing%20to%20Deploy%20Extended%20Security%20Updates%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1251240%22%20slang%3D%22en-US%22%3E%3CP%3ENice%20work%20%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F179584%22%20target%3D%22_blank%22%3E%40Jon%20Warnken%3C%2FA%3E!%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIt%20seems%20that%20a%20change%20in%20PowerShell%20execution%20policy%20under%20client%20settings%20is%20required%20to%20avoid%20running%20into%20%3CFONT%20style%3D%22background-color%3A%20%23ffffff%3B%22%3E%3CEM%3EError%20ID%200x87D00327%3B%20Script%20is%20not%20signed%3C%2FEM%3E%20when%20running%20the%20scripts%20related%20to%20the%20ESU%20baselines%2Fcompliance%20items%3A%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CFONT%20style%3D%22background-color%3A%20%23ffffff%3B%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22screenshot1.jpg%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F179303i8C1356CF9710518F%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22screenshot1.jpg%22%20alt%3D%22screenshot1.jpg%22%20%2F%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22screenshot2.jpg%22%20style%3D%22width%3A%20630px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F179304i43C5DFF375C23E83%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22screenshot2.jpg%22%20alt%3D%22screenshot2.jpg%22%20%2F%3E%3C%2FSPAN%3E%3C%2FFONT%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1322762%22%20slang%3D%22en-US%22%3ERe%3A%20Preparing%20to%20Deploy%20Extended%20Security%20Updates%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1322762%22%20slang%3D%22en-US%22%3E%3CP%3EIf%20I%20was%20to%20purchase%20the%20ESU%20key%20for%2010%20devices%2C%20how%20does%20Microsoft%20determine%20that%20I%20have%20installed%20the%20key%20on%2010%20devices%3F%20In%20other%20words%2C%20what's%20stopping%20me%20from%20installing%20the%20key%20on%2020%2B%20machines%20at%20once%3F%20The%20reason%20this%20question%20needs%20to%20be%20asked%20is%20simple%20-%20will%20I%20be%20able%20to%20re%20recycle%20the%20purchased%20key%20i.e.%20if%20I%20purchase%20and%20install%20the%20key%20on%2010%20devices%20and%20those%20devices%20die%20and%20need%20to%20be%20replaced.%20Will%20I%20be%20able%20to%20use%20the%20key%20again%20on%20the%20replacement%20devices%20or%20do%20I%20need%20to%20purchase%20it%20again%3F%20Is%20there%20some%20sort%20of%20activation%20mechanism%20happening%20in%20the%20background%20that%20will%20only%20allow%2010%20in%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1322784%22%20slang%3D%22en-US%22%3ERe%3A%20Preparing%20to%20Deploy%20Extended%20Security%20Updates%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1322784%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F136933%22%20target%3D%22_blank%22%3E%40Adrian%20Kielbowicz%3C%2FA%3E%26nbsp%3Bthe%20key%20used%20for%20ESU%20is%20a%20MAK%20key.%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fwindows%2Fdeployment%2Fvolume-activation%2Fplan-for-volume-activation-client%23multiple-activation-key%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fwindows%2Fdeployment%2Fvolume-activation%2Fplan-for-volume-activation-client%23multiple-activation-key%3C%2FA%3E%26nbsp%3BTracking%20for%20the%20key%20usage%20is%20just%20like%20any%20other%20product%20using%20those%20keys.%20If%20you%20replace%20systems%20and%20need%20to%20add%20additional%20activations%20there%20is%20a%20process%20to%20request%20more.%20Please%20see%20the%20FAQ%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F4527878%2Ffaq-about-extended-security-updates-for-windows-7%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F4527878%2Ffaq-about-extended-security-updates-for-windows-7%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%26nbsp%3B%3CA%20class%3D%22link-expand%20bold%22%20role%3D%22button%22%20href%3D%22https%3A%2F%2Fsupport.microsoft.com%2F%22%20data-bi-id%3D%22faq-panel-content%22%20aria-expanded%3D%22true%22%20aria-label%3D%22If%20an%20organization%20needs%20additional%20activations%20of%20ESU%20(for%20example%2C%20if%20they%20have%20to%20reinstall%20Windows%207%20or%20reimage%20a%20device)%2C%20how%20will%20those%20additional%20activations%20be%20managed%3F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%3CSPAN%20class%3D%22link-expand-text%20ng-binding%20faq-panel-show%22%3EIf%20an%20organization%20needs%20additional%20activations%20of%20ESU%20(for%20example%2C%20if%20they%20have%20to%20reinstall%20Windows%207%20or%20reimage%20a%20device)%2C%20how%20will%20those%20additional%20activations%20be%20managed%3F%3C%2FSPAN%3E%3C%2FA%3E%3C%2FP%3E%0A%3CDIV%20class%3D%22faq-panel-body%20ng-scope%20ng-isolate-scope%22%3E%0A%3CP%20class%3D%22ng-scope%22%3EOrganizations%20that%20purchase%26nbsp%3BESU%20through%20volume%20licensing%20should%20request%20additional%20activations%20through%20the%20VLSC%3A%3C%2FP%3E%0A%3COL%20class%3D%22ng-scope%22%3E%0A%3CLI%3EOn%20the%20VLSC%20home%20page%2C%20select%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CSTRONG%3EContact%20Us%3C%2FSTRONG%3E.%3C%2FLI%3E%0A%3CLI%3ESelect%20your%20region%2C%20and%20then%20select%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CSTRONG%3ESupport%20Web%20Form%3C%2FSTRONG%3E%26nbsp%3Bin%20the%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CSTRONG%3EContact%20Info%3C%2FSTRONG%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3Esection.%3C%2FLI%3E%0A%3CLI%20class%3D%22%22%3EIn%20the%20form%2C%20complete%20the%20required%20information.%3C%2FLI%3E%0A%3C%2FOL%3E%0A%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1322788%22%20slang%3D%22en-US%22%3ERe%3A%20Preparing%20to%20Deploy%20Extended%20Security%20Updates%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1322788%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F179584%22%20target%3D%22_blank%22%3E%40Jon%20Warnken%3C%2FA%3E%26nbsp%3BThanks%20a%20lot%20-%20that%20fully%20answers%20my%20question%20%3A)%3C%2Fimg%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1484771%22%20slang%3D%22en-US%22%3ERe%3A%20Preparing%20to%20Deploy%20Extended%20Security%20Updates%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1484771%22%20slang%3D%22en-US%22%3E%3CP%3EDoes%20the%20Asset%20Intelligence%20Syncronization%20point%20role%20need%20to%20be%20present%20for%20the%20software%20licensing%20reporting%20to%20work%20for%20the%20ESU%20key%20activation%20data%3F%3CBR%20%2F%3E%3CBR%20%2F%3EI'm%20somewhat%20of%20a%20noob%20so%20trying%20to%20lay%20down%20the%20prerequisites%20to%20get%20these%20baseline%20configurations%20deployed%20successfully.%20I%20have%20a%20lot%20of%202008%2F2008%20R2%20servers%20that%20need%20ESU%20activation%20and%20patching%20so%20any%20advice%20on%20what%20exactly%20is%20needed%20for%20SCCM%20components%2C%20roles%2C%20etc%2C%20to%20especially%20obtain%20accurate%20ESU%20key%20activation%20data%20would%20be%20greatly%20appreciated!%3C%2FP%3E%3C%2FLINGO-BODY%3E
Microsoft

 

Update 02.03.2020: Updated post to confirm that Security Only Quality Updates from November 2019 and onward satisfy the pre-requisites for the ESU key. 

 

With the end of support for these Operating Systems on January 14, 2020, many of our customers are asking for help on how to get ready to deploy Extended Security Updates (ESU). To that end, I would like to share the work of Curtis Ricard a Senior Premier Field Engineer on how to use Microsoft Endpoint Configuration Manager (ConfigMgr) to ensure that your clients are ready to receive the ESU updates.

 

Curtis and I both engage with customers that have chosen to utilize the Extended Security Update program. If you would like to know more about the program please review https://support.microsoft.com/en-us/help/4497181/lifecycle-faq-extended-security-updates

 

There are a few key points to consider with this program:

  • The Extended Security Update (ESU) program is a last resort option for customers who need to run certain legacy Microsoft products past the end of support. It includes Critical* and/or Important* security updates for a maximum of three years after the product’s End of Extended Support date. Extended Security Updates will be distributed if and when available.
  • ESUs do not include new features, customer-requested non-security updates, or design change requests.
  • All Windows 7 customers will get an update on January 14, 2020 as the operating system is in support until then. Updates for these operating systems after January 14, 2020 will be for ESU customers only. ESU is available for Win 7 Professional & Win 7 Enterprise.
  • Customers use the support plan they have; ESU offering does not include technical support*

*If any root cause investigation determines that resolution requires product enhancement(s) available in a more recent release, then customer may be required to upgrade

 

Also see the “How to get Extended Security Updates for eligible Windows devices” blog

*For licensing purchase questions, please contact your Microsoft Account Team.

 

If you have chosen to purchase ESU support then there are some prerequisites for your on-premise device(s) that must be met to ensure that your systems will be able to install the ESU updates:

  • Install the following SHA-2 code signing support update and servicing stack update (SSU) or a later SSU update:
    • 4474419 SHA-2 code signing support update for Windows Server 2008 R2, Windows 7, and Windows Server 2008: September 23, 2019
    • 4490628 Servicing stack update for Windows 7 SP1 and Windows Server 2008 R2 SP1: March 12, 2019
  • For Windows 7 and Windows Server 2008 R2, install at least one of the following servicing stack updates (SSU):
    • 4516655 Servicing stack update for Windows 7 SP1 and Server 2008 R2 SP1: September 10, 2019
    • 4523206 Servicing stack update for Windows 7 SP1 and Server 2008 R2 SP1: November 12, 2019
    • 4531786 Servicing stack update for Windows 7 SP1 and Server 2008 R2 SP1: December 10, 2019
    • 4536952 Servicing stack update for Windows 7 SP1 and Server 2008 R2 SP1: January 14, 2020
  • For Windows Server 2008, install at least one of the following servicing stack updates (SSU):
    • 4517134 Servicing stack update for Windows Server 2008 SP2: September 10, 2019
    • 4526478 Servicing stack update for Windows Server 2008 SP2: November 12, 2019
    • 4531787 Servicing stack update for Windows Server 2008 SP2: December 10, 2019
    • 4536953 Servicing stack update for Windows Server 2008 SP2: January 14, 2020
  • For Windows 7 and Windows Server 2008 R2, install at least one of the following security updates:
    • 4519976 October 8, 2019—KB4519976 (Monthly Rollup)
    • 4525235 November 12, 2019—KB4525235 (Monthly Rollup)
    • 4525233 November 12, 2019—KB4525233 (Security-only update)
    • 4530734 December 10, 2019—KB4530734 (Monthly Rollup)
    • 4530692 December 10, 2019—KB4530692 (Security-only update)
    • 4534310 January 14, 2020—KB4534310 (Monthly Rollup)
    • 4534314 January 14, 2020—KB4534314 (Security-only update)
  • For Windows Server 2008, install at least one of the following security updates:
    • 4520002 October 8, 2019—KB4520002 (Monthly Rollup)
    • 4525234 November 12, 2019—KB4525234 (Monthly Rollup)
    • 4525239 November 12, 2019—KB4525239 (Security-only update)
    • 4530695 December 10, 2019—KB4530695 (Monthly Rollup)
    • 4530719 December 10, 2019—KB4530719 (Security-only update)
    • 4534303 January 14, 2020—KB4534303 (Monthly Rollup)
    • 4534312 January 14, 2020—KB4534312 (Security-only update)
  • Install and activate the ESU key.
    • For information about how to install and activate the ESU key, see the “How to get Extended Security Updates for eligible Windows devices” blog on the Microsoft Tech Community website.

 

Once you have the prerequisites in place, the following update will help you verify that your eligible Windows 7 SP1 devices can continue to get the ESUs after the end of support date of January 14, 2020. (Installing this update has no impact on getting security updates between now and January 14, 2020) https://support.microsoft.com/en-us/help/4528069/update-for-eligible-windows-7-and-server-2008-r2-de...

 

Note: After activation, you can then continue to use your current update and servicing strategy to deploy ESU through Windows Update, Windows Server Update Services (WSUS) or other update management solutions that you prefer.

 

Now that all of that is covered, you are faced with deploying the new keys to all the systems that you purchased support for. The key for ESU are Multiple Activation Keys (MAK) and you cannot use KMS auto activate them. The Volume Activation Management Tool (VAMT) is supported for online and proxy activations. If your systems have internet access, then you can leverage ConfigMgr to ensure that the prerequisites and the appropriate ESU keys are in place and activated without VAMT.

You can leverage PowerShell to quickly check if the required patches are installed. For example:

 

 

 get-hotfix -Id kb4474419

 

 

Will quickly determine if the SHA2 code signing patch has been installed.

clipboard_image_0.png

 

And quickly error out if it is not installed.

clipboard_image_1.png

 

You can use that to create a compliance item to check all your systems to determine which have the required patches and which need to have them installed. An example of a compliance item script to check would be

 

 

Function lookuphotfix ($Hotfixid)
 {
 $hotfixResult = Get-HotFix  -ComputerName $env:Computername | Where-Object {$_.HotfixID -eq $HotfixID}   
        if($hotfixResult) {return $true}
}

$strCompliant = "Non-Compliant"
If (lookuphotfix kb4474419 -eq $true){$StrCompliant = "Compliant"}  #SHA-2 Update - REQUIRED
write-host $strCompliant

 

 

Once all the required prerequisites are in place you can then use a compliance item to deploy the keys. Here links to example of PowerShell scripts to do that, simply add your ESU key to the appropriate $ESUKEY = "<INSERT-ESU-KEY-HERE>" line(s).

Detection Script

Remediation Script

 

In addition to the sample scripts you can also utilize a set of sample configuration items and baselines available on via my GitHub repository  

They are available individually or as a zip file

Zip file with all Baselines

Individual Baselines

 

Download the zip file and extract the contents so that you can import the baselines.

clipboard_image_2.png

 

You will be prompted to for each of the baselines that the publisher could not be verified and to confirm that you want to import the files.

 

clipboard_image_3.png

 

After confirming the selection for each of the files you will see 4 cab files to be imported

clipboard_image_4.png

 

When you select next, you see the detailed list of the configuration baselines and configuration items that will be added.

clipboard_image_5.png

 

Select next and then close to complete the import.

The following baselines are intended for use on clients that have Internet access:

  • Baseline 1A:  This baseline is intended for Server 2008/2008R2 clients, and checks for OS-specific pre-requisite KBs.  You can deploy the remediation baseline (Baseline 2, below) to systems that are compliant with this KB check.
  • Baseline 1B:  This baseline is intended for Windows 7 clients, and checks for Windows 7 pre-requisite KBs.  You can deploy the remediation baseline (Baseline 2, below) to systems that are compliant with this KB check.
  • Baseline 2:  This baseline will detect the state of the ESU key and remediate (Detect & Install ESU Key) if needed.  It should be deployed to clients that meet the KB pre-requisites (see baselines 1A and 1B) and it needs to be updated with the your ESU keys before deployment. 
  • Baseline 3:  This checks for an optional KB we released, that is a non-security update.  If this update installs successfully, it indicates the client has an installed/activated ESU license.

 

Update the scripts to include your ESU key(s) and deploy to your systems.

 

One other item to note is that there are Asset Intelligence reports available that interact with the Software Licensing Service, allowing you to report on ESU keys

clipboard_image_6.png

 

clipboard_image_7.png

 

Hopefully you will find this helpful and check back in next time when we talk about options for systems without internet connectivity.

 

 

Resources

 

Common Questions

Answers sourced from reference materials as well as confirmed with the Microsoft Product Group where applicable, unless noted as otherwise.

 

  • Q: Is there a work around for Quality Update requirement?
  • A: “There is no work around. This (October or newer monthly rollup) is required – as it was written in the article. “ The November 2019 or a later security-only update package can be used as a substitute for the monthly rollup in the Installation prerequisites.

  • Q: Do we have to apply the Quality Update moving forward or could be apply security only?
  • A: “You can go back to Security Only (for the remaining updates through 14-Jan-2020) after applying the October or newer monthly roll up (in preparation for the ESU) ” (Of course, ESUs will contain only Critical or Important Security updates)

  • Q: If we have never installed the Quality Update, do we know how much drive space that will take?
  • A: The October Security Monthly Quality Rollup (KB4519976) is 308 MB to download.  Applying the update will take a similar amount of space.

  • Q:  Why isn’t KMS available as a deployment option for ESU?
  • A: “KMS is not supported for the ESU MAK process.  KMS would have required re-architecting to support ESU.  This was determined to be too high of a risk for our enterprise customers and for our Windows development teams.  Any work to re-architect KMS would have resulted in considerable instability of Windows Server 2008 R2 at a time when customers need it to be absolutely stable.”

 

 

 

 

14 Comments
Contributor
Security Only update for January 2020 (KB4534314) or December 2019 (KB4530692), both contain the needed prerequisite to install ESU keys, quality monthly rollup is not needed
Occasional Visitor

Jon, I'm sorry but this statement is not true, or at least badly worded:

"The key for ESU are Multiple Activation Keys (MAK) and you cannot use KMS to activate them."

While you can't use the KMS to auto-activate the MAK key for the ESU updates the manual activation of the key using you KMS (VAMT to be precise) is 100% supported and also intended. We opened a support case a few weeks ago about the specifics of the ESU activation and it was specifically confirmed to be the only supported ESU activation method for systems unable to reach th MS cloud activation servers.

Microsoft
@spucktier Thanks for pointing out the confusing statement. I am updating the post to clarify the use of VAMT. It is correct that VMAT is 100% supported and the intended method when systems are not internet connected. I do have a follow up post that will cover the use of VAMT.
Microsoft
@abbodi1406 I have confirmation that the November 2019 or a later security-only update package can be used as a substitute for the monthly rollup in the Installation prerequisites. The post has been update to reflect all of the possible prerequisite patches.
Senior Member

Hi,

 

I completed above steps without valid MAK keys.  As a result the configuration on the client side is Non Compliant in Control Panel - Configuration Manager.  It looks like a valid MAK key is required to get the compliance working.

 

For test purpose, I used this as MAK key - 11111-22222-333333-444444-555555

 

Ram

Microsoft
@RamLan You are correct the detection script verifies that the key is installed and activated.
Microsoft

This is very descriptive and informative. Thanks for putting this together! 

Senior Member

@Jon Warnken 

 

In the detection script, there is a part looking for product type:

 $OS = Get-WmiObject Win32_OperatingSystem
    foreach ($ObjItem in $OS){
        $SystemRole = $SystemRole = $ObjItem.ProductType
        Switch ($SystemRole){ 
            1{$Type = "Desktop"}
            2{$Type = "UNSUPPORTED"}
            3{$Type = "Server"}
        } #End Switch Statement
     } #End foreach loop

Domain Controller (in my case Windows server 2008 R2 domain controller) will return type 2 which is ok. (See the following chart)

WMI Win32_OperatingSystem ProductType Tips:
ProductType 1 = Desktop OS
ProductType 2 = Server OS – Domain Controller
ProductType 3 = Server OS – Not a Domain Controller

Does it mean Windows 2008 R2 Domain Controller does not support installing ESU key or it's just a bug to fix?

 

Thanks

Microsoft

Nice work  @Jon Warnken!

 

It seems that a change in PowerShell execution policy under client settings is required to avoid running into Error ID 0x87D00327; Script is not signed when running the scripts related to the ESU baselines/compliance items:

 

screenshot1.jpgscreenshot2.jpg

Senior Member

If I was to purchase the ESU key for 10 devices, how does Microsoft determine that I have installed the key on 10 devices? In other words, what's stopping me from installing the key on 20+ machines at once? The reason this question needs to be asked is simple - will I be able to re recycle the purchased key i.e. if I purchase and install the key on 10 devices and those devices die and need to be replaced. Will I be able to use the key again on the replacement devices or do I need to purchase it again? Is there some sort of activation mechanism happening in the background that will only allow 10 in?

Microsoft

@Adrian Kielbowicz the key used for ESU is a MAK key. https://docs.microsoft.com/en-us/windows/deployment/volume-activation/plan-for-volume-activation-cli... Tracking for the key usage is just like any other product using those keys. If you replace systems and need to add additional activations there is a process to request more. Please see the FAQ https://support.microsoft.com/en-us/help/4527878/faq-about-extended-security-updates-for-windows-7 

  If an organization needs additional activations of ESU (for example, if they have to reinstall Windo...

Organizations that purchase ESU through volume licensing should request additional activations through the VLSC:

  1. On the VLSC home page, select Contact Us.
  2. Select your region, and then select Support Web Form in the Contact Info section.
  3. In the form, complete the required information.
Senior Member

@Jon Warnken Thanks a lot - that fully answers my question :)

Occasional Visitor

Does the Asset Intelligence Syncronization point role need to be present for the software licensing reporting to work for the ESU key activation data?

I'm somewhat of a noob so trying to lay down the prerequisites to get these baseline configurations deployed successfully. I have a lot of 2008/2008 R2 servers that need ESU activation and patching so any advice on what exactly is needed for SCCM components, roles, etc, to especially obtain accurate ESU key activation data would be greatly appreciated!

Occasional Contributor

Attempting to import the baselines results in an error stating an invalid reference to a CI. 

Are these files version specific to a release of configMgr?