[ARCHIVED] How to get Extended Security Updates for eligible Windows devices
Published Oct 17 2019 09:00 AM 602K Views

Note:  A new version of this blog post was published on February 11, 2020.


Update 11.26.2019: Windows 7 Extended Security Updates (ESUs) will be available via the Cloud Solution Partner (CSP) program beginning Monday, December 2, 2019. To purchase Windows 7 ESUs through a CSP, please contact a CSP partner. If you are a partner and need details on procuring Windows 7 ESUs through the Partner Center, see Purchasing Windows 7 ESUs as a Cloud Solution Provider.


While many of you are well into your journey of deploying and/or servicing Windows 10, we understand that everyone is at a different point in the upgrade process. If your organization is unable to complete the transition from Windows 7 Pro or Enterprise to Windows 10—or from Windows Server 2008 and 2008 R2 Datacenter, Enterprise, or Standard to the latest version of Windows Server—prior to the end of support on January 14, 2020, we want to help you by ensuring that these devices running these select editions and versions continue to receive security updates while you complete your Windows and Windows Server upgrade projects.

In this blog, we’ll explain how volume license customers can purchase, install, and deploy Extended Security Updates today for eligible Windows 7, Windows Server 2008, and Windows Server 2008R2 devices to ensure those devices stay protected after January 14, 2020. Again, if you are a Windows 7 Pro customer looking to take advantage of paid Extended Security Updates via CSP partners, you will be able to do so once they are available on December 1, 2019. More information on this option will be available in the Windows 7 and Office 2010 End of Support FAQ.

Purchasing Windows 7 ESUs through Volume Licensing

Extended Security Updates are available through specific volume licensing programs. Coverage will be available in three consecutive 12-month increments following Windows 7 end of support on January 14, 2020. Extended Security updates are available for purchase in 12-month increments only, starting January 14, 2020. You cannot buy partial periods (e.g. 6 months).

Eligible customers can use the Azure Hybrid Benefit (available to customers with active Software Assurance or Server Subscriptions) to obtain discounts on the license of Azure virtual machines or Azure SQL Database managed instances. ESUs for select Windows Embedded products are available via your embedded device manufacturer.

Now, let’s walk through how and where to purchase Windows 7 ESU, as well as download the appropriate key from the VLSC.

  1. Visit the Volume Licensing Service Center (https://www.microsoft.com/vlsc) and sign in.
  2. Select Licenses > Relationship Summary > Licensing ID > Product Keys.

    01_ESU-in-VLSC.PNG

Purchasing Windows 7 ESUs through a Cloud Solution Provider (CSP)

To purchase Windows 7 ESUs through a CSP, customers should contact a CSP partner. If you are a partner and need details on procuring Windows 7 ESUs through the Partner Center, see Purchasing Windows 7 ESUs as a Cloud Solution Provider.

Installation prerequisites

The following steps must be completed before installing and activating ESU keys:

  1. Install the following SHA-2 code signing support update and servicing stack update (SSU) or a later SSU:

    Windows 7 SP1 and Windows Server 2008 R2 SP1:
    Servicing stack update for Windows 7 SP1 and Windows Server 2008 R2 SP1: March 12, 2019
    and
    SHA-2 code signing support update for Windows Server 2008 R2, Windows 7, and Windows Server 2008: Se...
    Windows Server 2008 SP2:
    Servicing stack update for Windows Server 2008 SP2: April 9, 2019
    and
    SHA-2 code signing support update for Windows Server 2008 R2, Windows 7, and Windows Server 2008: Se...

  2. Install the following SSU and monthly rollup:

    Windows 7 SP1 and Windows Server 2008 R2 SP1:
    Servicing stack update for Windows 7 SP1 and Server 2008 R2 SP1: September 10, 2019 (KB4516655)

    and
    October 8, 2019: Monthly Rollup (KB4519976)

    Windows Server 2008 SP2:
    Servicing stack update for Windows Server 2008 SP2: September 10, 2019 (KB4517134) 
    and
    October 8, 2019: Monthly Rollup (KB4520002)

  3. Once activated,  continue to use your current update and servicing strategy to deploy ESU through Windows Update, Windows Server Update Services (WSUS), Microsoft Update Catalog, or whichever patch management solution you prefer.

Installation and activation

Once you have addressed the prerequisites, you’re ready to install and activate Extended Security Updates for machines connected to the internet.

First, install the ESU product key using the Windows Software Licensing Management Tool (slmgr):

Note: Installing the ESU product key will not replace the current OS activation method being used on the device. This is achieved by using the Activation ID to differentiate between the operating system’s activation and the ESU activation.

  1. Open an elevated Command Prompt.
  2. Type slmgr /ipk <ESU key> and select Enter.
  3. If the product key installed successfully, you will see a message similar to the following:

    02_ESU-product-key-installed.png

Next, find the ESU Activation ID:

  1. In the elevated Command Prompt, type slmgr /dlv and select Enter.
  2. Note the Activation ID as you will need it in the next step.

    03_ESU-activation-ID.png

Now, you’ll activate the ESU product key:

  1. Open an elevated Command Prompt.
  2. Type slmgr /ato <ESU Activation Id> and press Enter.

    04_ESU-activation-confirmed.png

    The following table outlines possible values for the <ESU Activation Id>:

    ESU Program 

    ESU SKU (or Activation) ID 

    Windows 7 SP1 (Client)

     

    Year 1 

    77db037b-95c3-48d7-a3ab-a9c6d41093e0 

    Year 2

    0e00c25d-8795-4fb7-9572-3803d91b6880 

    Year 3;

    4220f546-f522-46df-8202-4d07afd26454 

    Windows Server 2008/R2 (Server)

     

    Year 1 

    553673ed-6ddf-419c-a153-b760283472fd 

    Year 2

    04fa0286-fa74-401e-bbe9-fbfbb158010d 

    Year 3

    16c08c85-0c8b-4009-9b2b-f1f7319e45f9 

Once you have activated the ESU product key, you can verify the status at any time by following these steps:

  1. Open an elevated Command Prompt.
  2. Type slmgr /dlv and select Enter.
  3. Verify Licensed Status shows as Licensed for the corresponding ESU program, as shown below:

    05_checking-ESU-license-status.png

Note: We recommend using a management tool, such as System Center Configuration Manager, to send the slmgr scripts to your enterprise devices.

To install and activate ESU for machines that are not connected to the Internet, you will need to follow these steps:

  1. Download and install the Volume Activation Management Tool (VAMT).
  2. Download the VAMT- ESU configuration file and update your VAMT configuration file.
  3. Configure the client device’s firewall for VAMT.
  4. Add the ESU product key to VAMT.

For systems that will not connect to the internet for activation, you can use the VAMT to perform proxy activation; however, KB4519972 must first be installed.

If you use the VAMT for Activation, the tool has the ability to pick up the activation ID as shown below:

vamt-activation.png

Verifying your deployment on eligible Windows 7 SP1, Windows Server 2008 R2 SP1, and Windows Server 2008 machines for ESU

Windows 7 SP1 and Windows Server 2008 R2 SP1: Install the optional, non-security update outlined in KB4528069. Please note that the KB4528069 update has no actual security content. This update is a test package and we subsequently recommend that you deploy it in your test environment. Install this update on your on-premises devices that are eligible for ESU.

Windows Server 2008: install the optional, non-securing update outlined in KB4528081. Please note that the KB4528081 update has no actual security content. This update is a test package and we subsequently recommend that you deploy it in your test environment. Install this update on your on-premises devices that are eligible for ESU.

Azure virtual machines and Windows Server

You do not need to deploy an additional ESU key for Azure virtual machines (VMs), Windows 7 ESU with Windows Virtual Desktop, or for bring-your-own images on Azure for Windows 7, Windows Server 2008, and Windows Server 2008 R2. Like on-premises devices, these devices will also require the installation of the SSUs and monthly rollups outlined in the prerequisites section above. A pre-patched Windows 7 image and a pre-patched Windows Server 2008 R2 SP1 image are available from the Azure Marketplace. Azure Stack VMs or Azure VMware solutions should follow the same process as on-premises devices.

After installing the SSUs noted above, VMs will be enabled to download the ESU updates. 

For answers to commonly asked questions about ESU for Windows Server 2008 and 2008 R2, see the ESU FAQ.

Next steps

If your organization still has devices running Windows 7, Windows Server 2008, or Windows Server 2008 R2, we recommend that you take the steps outlined above today to take advantage of Extended Security Updates and help ensure that your devices continue to receive necessary security updates after January 14, 2020.

If you are interested in learning more about Extended Security Updates, please see the following resources:

153 Comments
Brass Contributor

.

Copper Contributor

Marssj,

 

The slmgr.vbs / atp <CID> command, is for Machine that are connected to internet.  

 (if you want to activate Machine that are Not Connected to Internet follow bellow commend.

step1: verify 3 KB is install in your Machine.

* from commend prompt:

Script slmgr.vbs /ipk <ESU Key > enter.

this Commend will install the ESU in your machine...

Step2

Activation:

CMD => Start slui 4  :=> brings up the CALL MICROSOFT & MANUALLY ACTIVATE window.

1: call MS and provide all info, then MS Will provide you #. keep adding the # ... if you cant write fast, request start over...

hope this info will help everyone.

Note: just let you all know, this is for win7 and Server 2008 R2 procedure.

thank you,

Brass Contributor

This continues to be a challenge to purchase this license under SPLA or CSP. All the distributors, we primarily work with Insight and CDW are unsure of how to purchase the Windows Server w-08 R2 ESU. Under CSP, there are only Windows 7 patches that do not work on Windows Server, and under any other hosting/SPLA model it is not included in any price lists. In general, we’ve been getting the run around from MS and distributors for months now and were told for the December CSP ESU only to find out that is just Windows 7.

 

If someone can reach out, we are struggling with this and have significant business with MS.  We have a case with ms support as well, but no luck.

Copper Contributor

Poornima -

 

Microsoft has created a giant mess with the Windows 7 ESU program. The communication is so bad, you wonder if it’s intentional. Many struggling MS customers have found your blog and are pleading for answers, but you are not responding, which is not helpful. Please at least confirm that you are monitoring your blog.


Microsoft employees will be enjoying the holidays with their families, while your customers, particularly your small business customers, are working double their normal hours in December, working straight through the holidays, because Microsoft has so badly botched the SMB ESU rollout it announced in October. It’s disrespectful to the hard-working small business community.

 

I wouldn’t give Microsoft an F on the ESU project, because an F implies a grade as high as 60. I give Microsoft a flat zero on the ESU project. 2019 has been a rough year for Seattle-area corporations.

 

Please tell your readers whether the ESU is available for Windows 7 Ultimate and exactly how to purchase it. Please answer immediately, as time is almost up. I have been seeking an answer for three weeks.

Copper Contributor

Hi,

 

I have just noticed that the prerequisites of the Service Stack Updates appear to be superseded by the next available SSU... Much like the Monthly Roll Up's do...

As an example, Pre-Req 1 requires SSU (12 March) KB4490628, but Pre-Req 2 requires SSU (10 Sept) KB4516655 which superseded it.

Notice that in both instances there is a statement near the bottom of the 'How to get this update' section which reads (in the case of SSU KB4516655:(

"This update replaces the previously released update KB 4490628.".

In fact, if you go to each of the SSU updates starting from the one just released (10 Dec 2019) KB4531787 (go to https://support.microsoft.com/help/4531787) then you will see this statement referring to replacing the previously released SSU.

 

In short, @Poornima Priyadarshini or anyone else in a position of knowledge: Will the latest SSU alone be enough to allow this ESU to run?

 

I suspect installing the latest SSU (10 Dec, KB4531787 or KB4531787), the latest Monthly Roll Up (KB4530734), the SHA2 Code Sign patch (KB4474419) as well as SP1, will be enough?

 

For my part I had to update a customers Win 7 SP1 machine that hadn't been patched for a year, doing so saw it only update to the latest SSU and Roll UP as well as the SHA2 patch via the Windows Update path - neither of the Pre-Req SSU's have been installed.

I await the customer purchasing the ESU license before I can test it actually works though!

 

Is anyone able to verify?

Brass Contributor

Agree with BlakeTex. 

 

Microsoft have been utterly hopeless with ESU and have left eveything to the last minute in letting resellers know about the ESU licensing costs etc, affecting small businesses and schools enormously.

 

One of our clients is a school, and they have a Windows 2008R2 Server. Apparently, Microsoft do not provide ESU for the education sector. Therefore the school are in a mad rush to find cash for a new server. It was initially believed they were going to provide ESU for all customers with Win2008. One year of ESU for Win2008 would have helped this customer enormously when they would have had time to get upgraded later next year.

Server extended support is sold via Software Assurance.  Do they have a SA contract?

Brass Contributor

Hi Susan,

 

Yes they have SA, but our CSP reseller keeps telling us that ESU is not available for Education sector ? We have contacted another one who says the same. Where do we stand please ?

 

 

https://www.askwoody.com/2019/patch-lady-yes-the-windows-7-esu-keys-work-on-ultimate/  So to be clear you are asking about Windows 7 education sku?  I would go through Softwareone.com or their vendor that sold them software assurance.

Brass Contributor

Hi Susan, 

 

Sorry, but as per my initial question it states ESU for Windows Server 2008 not Windows 7.  Is this available to the education sector for Windows Server 2008 please ? Windows Extended Security Updates after January 14th 2020 which this whole article refers. Can the Education sector get a ESU license for Windows Server 2008 the same as they can for Windows 7 ?

As a software assurance customer you should be able to purchase Extended support patches but it's not through the same ESU process as Windows 7 ergo why these CSP's are probably scratching their heads.  I would go back to the vendor that sold them the software assurance/volume license as it isn't through the CSP process.  Whom did they buy their server 2008 licenses from?

Brass Contributor

Thank you.

 

it was done initially through a local authority but now they are looked after by a company called Greymatter. I have emailed them what you mentioned.

 

https://www.greymatter.com/

Brass Contributor

Susan, to clarify. If the school have SA in place which I believe they do, a MAK key will be available for Extended Security Updates license within the Volume Licensing Center for Windows 2008;?

 

Its so confusing there is no clarity on this from Microsoft and hundreds of businesses will be in the same situation.

If you scroll all the way up ... see that VLSC image above?  

 

  1. Visit the Volume Licensing Service Center (https://www.microsoft.com/vlsc) and sign in.
  2. Select Licenses > Relationship Summary > Licensing ID > Product Keys.

Once you get the vendors all talking together there will be a MAK key up there listed in the server section.

Add to the confusing this is end of the year and 1/2 of Microsoft is out on vacation and ..well..there you go.

P.S. they still have to purchase these extended support licenses and I can't remember what the fee is for Server.  If you do a Azure purchase/plan the extended support patches are added as a benefit.

Brass Contributor

Susan,

 

You say there will be a MAK key, is this MAK key for Windows Server 2008 Extended Security Updates or just Windows Server 2008 ? Sorry but your replies don't make it clear. I need to obtain a MAK Key for Windows Server 2008 Extended Security Updates ?

 

How do they purchase these extended support licenses for Windows 2008 if they aren't going through the CSP, would it be through Greymatter who they use ? You refer to licenses for Windows Server 2008 Extended Security Updates ?

 

The school don't use Azure.

Copper Contributor

All,

One question that concern me the most is, what if a company buys ESU now and don't install/activated it till Feb/2020 due to workload or whatever reason. would their win7 and servers get regular update for January/2020?

 

Would MS still sale ESU after January/2020 in other can we/MS customer able to purchase ESU after Jan/2020?

 

looking forward to hear from you all  soon,

 

thank you,

Microsoft

@786Nadmin We will sell ESu throughout the year for the next 3 years. You can purchase at any time (though we recommend protecting all of your devices on Day 1). Because of the cumulative nature of updates, if you first install ESU in August (for example) you'll have all of the updates up till then.

Microsoft

@BlakeTex Sorry for the late response. I'll answer the questions and points as best I can:

  • We have been communicating ESU since last May with constant blogs, announcements at events, tweets, etc. The media has been reporting on them as well; I apologize if it seems last minute. The EOL date of Windows 7 was announced long before the ESU announcements, so even without ESU the EOL of Windows 7 has been looming. That said, Microsoft announced ESU in early 2019 and have been making changes to the program as necessary ever since. One change was allowing for CSP which was not in the original plans. This is why this was announced in October - it was an add-on program based on customer request;
  • Most of us at Microsoft, and specifically in the ESU PG, are not at home over the holidays, we are still working to provide ESU for the customers that need it. As I mentioned in the above point, we only announced CSP recently, and have CSP partners ready to help;
  • ESU is available for Windows 7 Ultimate edition, and has been since ESU was first being sold. We may have failed in that communication, and I apologize for that. Most of our enterprise customers aren't using Ultimate edition, so we didn't have Ultimate documented. Once we started selling ESU via CSP channel, the CSP partners were made aware of which versions are eligible for ESU.

I hope this answers your questions. Again, I apologize for the delay...

--Joe.

 

Copper Contributor

I guess MAK keys will work very well with ordinary, persistent desktops. But how about non-persistent desktop that are based on a single golden image? How do we activate those? These desktops will not 'remember' the MAK activation as they are, well eh ….non-persistent. Do we activate the golden image, update the image and will all 'clones' be able to use this updated image (without specific local activation)? As long as the customer has bought enough ESU 'licenses', they should be compliant. When we need to activate non-persistent images, there is a need for activation every time the desktop starts up. That adds up to a lot of activations. What would the proposed solution be, as I believe there are still a lot of VDI and alike environments still based on Windows 7 where the customer wants to buy ESU to extend the support and buy some extra time for upgrading.  

Copper Contributor

Yes, just use same process you do for Win 7 activations- inside the VDI source image.  Apply ESU product key & activate.  Activation ID is generic across all machines (of the same version of Win 7)

Copper Contributor

So you actually activate only one machine (VDI source image) and deploy it to the VDI targets (non-persistent desktops). They will all startup already activated? Does that also work when they get a new Hardware ID during startup (as is the case when using Citrix Provisioning Services for instance)? Would it be possible to have an official KB or something with some more details and or procedure(s)?  

Brass Contributor
Further to my last questions, the reseller has still stated that ESU is not available for Windows 2008 for the Education sector. I am confused now. Susan from Micrsoft as per above posts, says it is if you have SA in place. I have put this to the reseller and they say it isn't !!!
Copper Contributor

Dear DiscoverAnother,

 

These SKU's might help you in the right direction under the Campus \School agreement (US):

 

  • AAD-44060 WinSvrSTDCOREES Alng 2 Year1 per CoreAdditional ProductNon-Specific WinSvrSTDCOREES Alng 2 Year1 per Core On Premise
  • AAD-44061 WinSvrSTDCOREES Alng 16 Year1 per CoreAdditional ProductNon-Specific WinSvrSTDCOREES Alng 16 Year1 per Core On Premise
  • AAD-44062 WinSvr DCCOREES Alng 2 Year1 per CoreAdditional ProductNon-Specific WinSvr DCCOREES Alng 2 Year1 per Core On Premise
  • AAD-44063 WinSvr DCCOREES Alng 16 Year1 per CoreAdditional ProductNon-Specific WinSvr DCCOREES Alng 16 Year1 per Core On Premise
  • AAD-44064 Svr StdCrES Alng 2 Year1 per CoreAdditional ProductNon-Specific SQL Svr StdCrES Alng 2 Year1 per Core On Premise
  • AAD-44066 Svr Std ExS Alng Year1 Per SvrAdditional ProductNon-Specific SQL Svr Std ExS Alng Year1 Per Svr On Premise
  • AAD-44067 Ent Core ES Alng 2 Year1 per CoreAdditional ProductNon-Specific SQL Ent Core ES Alng 2 Year1 per Core On Premise
  • AAD-44069 SQL Svr Ent ExS Alng Year1 Per SvrAdditional ProductNon-Specific SQL Svr Ent ExS Alng Year1 Per Svr On Premise

Now, can some help me find SKU's so I can get Technical support without a credit card (we only use purchase orders)

 

-->Max

 

"I don't know ,man.  I just got here myself"

  •  
Brass Contributor

Dear MadMaxZ1r 

 

Thank you for your reply. We are UK based. Sorry, but i'm not sure how this will help with me finding out if ESU is available for Windows 2008 for the Education sector.

 

I appreciate your response, but not sure what it actually relates to in terms of ESU.

 

Copper Contributor

@Gertjan Jongeneel It should work if you activate in the image. But if it doesn't, i would just create a scheduled task that runs the slmgr at startup. The activation ID will be the same for all vdis and the MAK will already be installed. It's easy enough to check if you even need to do this. Copy your disk, add copy to pvs, create maintenance version, fire it up and install/activate the MAK, close the disk, promote to test or production (whatever your process is) fire up on some vdis, log in and confirm with slmgr /dli. The only thing i don't know if you use the scheduled task route is if it counts as a new activation each time you start up. Our MAK came with 5,000 activations, which would not be enough if each reboot counted as a new activation. I am thinking you won't have to do that though.

Brass Contributor

To quote a conversation I had with Insight yesterday, "Microsoft has not made a clear statement what SPLA companies should do and is making us be the bad guy.  All the cases we've escalated to them with legitimate business cases are getting ignored, and no one is responding."   @Joe Lurie we totally understand you guys have been communicating but we are all clearly still having issues actually acquiring the ESU for Windows Server 2008 R2.  This is major security risk for a lot of customers and if you read the threads above, we are getting NO RESPONSE from Microsoft on Windows Server.  The only responses are around Windows 7.  What are IT pros supposed to do that run more than just Windows 7 desktops?  The CSP program is only selling Windows 7 (and even that is not working for many people, it's even starting to hit tech media https://www.zdnet.com/article/so-you-want-to-keep-running-windows-7-good-luck-with-that-small-busine... how difficult it is actually to acquire the licenses).  Why isn't Windows Server 2008 R2 included in the CSP licensing?  EA requires 500+ users... what are small businesses supposed to do or SPLA hosting companies?

 

We need clear direction on what small businesses that cannot take Windows 2008 R2 servers and just move them to Azure (even though we'd love to and have done that for newer workloads, Microsoft must understand that not all workloads CAN be moved to Azure).  

I'd also like to share some statistics from December 2019.. there are still 32 million web servers on the public internet running Windows Server 2008 R2 (it comes with IIS7.5).   https://trends.builtwith.com/Web-Server/IIS-7 and https://w3techs.com/technologies/details/ws-microsoftiis are both reputable stats that track usage of web servers online.  Some slightly different numbers but still very significant https://secure1.securityspace.com/s_survey/data/201911/servers.html And here is a list of sites using IIS7.5 https://trends.builtwith.com/websitelist/IIS-7

 

This is a MAJOR security issue and your customers are complaining that we can't actually purchase the ESU licensing despite a lot of efforts to work with MULTIPLE major distributors, and Microsoft.  Please consider the ramifications of these decisions and help us protect our customers, and YOUR data because all these websites are small government and small business organizations that will be hurt.  2020 will be a year of MANY MORE hacks as a result of us not being able to purchase the extended security update licenses that you are selling already.  Please help us prevent a disaster.

Brass Contributor

Dear alex335678,

 

Very well put and I totally agree. Microsoft have been so unhelpful it is a disgrace.

Copper Contributor

TO: Discoveranother,

 

The SKU for the ESU windows server Standard Edition is AAD-44061 for the first 16 cores with a minimum of 16 cores that need to be purchase on any server whether it has 12 or 16 cores (for every 2 cores beyond the 16 you must purchase additional "Alng 2 " core packs) .  I also believe the 'ES' in the WinSvrSTDCOREES description delineates the license being an ESU license.   I am in a K-12 school district in the US and was able to purchase that SKU for our institution.

 

I hope this helps...

 

-->Max

 

"I don't know ,man.  I just got here myself"

Copper Contributor

@Joe Lurie , thank you so much for your response about ESUs for Windows 7 Ultimate.  Since you now know about Microsoft's failure to communicate to the small business community and the Cloud Service Provider community that ESUs are available for Windows 7 Ultimate, I hope that Microsoft now has updated its FAQs and issued bulletins to the CSPs so they know how to sell the ESUs.

 

I know that many of the small business representatives on this blog will agree with me that we have been left to fend for ourselves, as the resellers and CSPs do not know how to deliver the ESUs to us. I have been arguing with resellers for three weeks that the white elephant Windows 7 Ultimate ESU did exist.  My reseller uses Tech Data, and Tech Data is lost on this topic.  So is Insight.  So is Dell.  Nothing but bad information for three weeks.

 

If we small businesses don't tell the resellers how to procure the Windows 7 Ultimate ESU, we will never obtain it.  Can you please explain in sufficient technical terms how a reseller, such as a managed service provider, would go about purchasing the Windows 7 Ultimate ESUs for its customers. They may need part numbers.  I will forward your reply to my MSP to forward to Tech Data.

Copper Contributor

@ELH-IT and @reduakm, thanks for your answers. However, is this based on actual facts /proven steps or are they assumptions? If we advice our customers to invest money in ESU, we'd better be 100% sure that it works in their environment(s). I know upgrading to Windows 10 is long-term the best solution, but time to do so is limited and building a new golden image including all applications, testing etc. takes a lot of time and the deadline is looming.

 

It would be very nice if Microsoft would have an official statement and clear procedure to follow to make this work with VDI.    

Brass Contributor

Completely agree with the previous two comments by BlakeTex and Gertjan Jongeneel. Everything they said is how I and many others feel.

Copper Contributor

Good morning all,

The ESU that I install and activate on Machine with no internet connection, License Status => Shows => Unlicensed.

I wondering does anyone installed/ active had the same issue, or it just normal?

 

I don't have any issue with Machine that are connected to internet.

 

looking forward to hear from you all soon.

 

thank you, 

Copper Contributor

Hi all, 

 

Where does ESU's leave us regarding Internet Explorer 11? Will Internet Explorer 11 get patched as part of the Windows 7 ESU's or are Internet Explorer 11 updates completely stopping in January for Windows 7?

 

Thanks

 

Paul 

Copper Contributor
Good afternoon Joe,
for some weird reason my MSG failed to go through, I did used phone Activation for air gaped machines. and I also received a " Activation Was Successful" massage. but when I check the E-S-U Activation status by running below commend. it says
 
slmgr.vbs /dlv All         or            slmgr /dlv
License Status :  Unlicensed
Is this because they are not connected to internet or I have to take a different route?
or if anyone had the some issue what you guys  did to fix it?  
looking forward to hear from you all soon. 
thank you,
Copper Contributor

Going back to the Windows Server 2008 ESU's; we have contacted the Microsoft volume licensing desk directly, various VAR's, and there doesn't appear to be a clear path to purchase the ESU's.  We have a specific situation where a new client of ours is in the process of an ERP migration (currently running on Server 2008) and it isn't likely that we can pump the workload to Azure.  I'm looking for guidance on how we can get to the right resource and understand their purchase options for Server 2008 Standard ESU's.  Has anyone been successful in doing this?

Do you have an Enterprise agreement?  I've been informed that even with software assurance, you need an EA agreement in order to get 2008/2008R2 extended updates.  (bottom line us smaller folks are a no go)

Brass Contributor

So basically, Microsoft have kicked anyone other than big organisations in the gut regarding Windows Server 2008 ESUs.

Move to Azure is the only alternative or upgrade as I can see.

Brass Contributor

FYI on Windows 7 Pro 32-Bit ESU installs

 

I’ve installed ESU MAK keys on about 30 W7 64 bit Pros with no issues. Never exceeded the number of workstations assigned to a MAK key. 100% following the license. 

 

The same MAK key used on a client’s 64 bit workstation also worked on their 32 bit workstation.

 

All I had to do on the 64 bit workstations was to verify and install if needed KB4490628 -> KB4474419 -> reboot -> KB4523206

 

That was not the case on the 32 bit workstation. I had to install every pending update via Windows Updater to get the MAC key to register. I’m not sure which update corrected the issue. This 32 bit workstation was about 3 months behind on updates.

 

 

Brass Contributor

Susan Bradley "Move to Azure is the only alternative or upgrade as I can see."

 

There is no time to move to Azure or Upgrade. We can do this next year but no time before January 14th this year. So why give Enterprises the opportunity to use ESU for Windows 2008 and not smaller organisations. Why provide an ESU for Windows 7 as well for smaller organisations but not Windows 2008. So as I say, Microsoft have kicked schools and smaller companies in the gut with this on purpose. 

Copper Contributor

Our servers are 2008 R2 Enterprise but the SKUs referenced above look like they are for Standard or Data Center editions. Will one of them work for our Enterprise editions?

Thanks.

Brass Contributor

Dear Microsoft - you are completely not answering majority of questions being asked here.  Nothing worse than holding AMAs and asking people to post questions when you are not planning to answer the majority of them.  We continue to struggle to purchase ESU for Windows Server 2008 R2 from ANY distributor.  What is your answer here for small businesses that do NOT have more than 500 users?  

Dear Alex.   Here's where I see the "answers"......  Move your server as a VM in Azure or upgrade to a supported product.  That's your choices.  Down here in the under 500 seat section we can get ESU's for Windows 7 - we cannot - get them for Server 2008 R2.  

 

That's your answer.  It's not the answer you want... but it's the answer.

Copper Contributor

@rmutt 

 

Extended Security Updates for Windows Server Standard will cover your Windows Server Enterprise instances.

Copper Contributor

@BlakeTex 

 

There is only one SKU (plus a discounted option) for Windows 7 Extended Security Updates. This one SKU is valid for Pro, Enterprise and Ultimate.

Copper Contributor

@Kevin O'Brien

 

As mentioned, ESUs for Windows Server and SQL are only available via Enterprise Agreements. Unfortunately if your customer doesn't have an EA or isn't in a position to open one, they can't purchase ESUs for Windows Server or SQL.

Brass Contributor

@Susan Bradley I totally understand you are trying to be helpful, and we all understand how we should interpret the silence from Microsoft employees.  Leaving thousands upon thousands of small businesses with major security risks with ABSOLUTELY NO STATEMENT or clarification from Microsoft is not an answer.  Especially with the current state of affairs in IT and cybersecurity, as a small businesses we are facing warnings from US CERT about security threats due to Iran threats https://www.us-cert.gov/ncas/alerts/aa20-006a and the CISA/DHS https://www.us-cert.gov/ncas/current-activity/2020/01/06/release-new-cisa-insights-increased-geopoli....

 

Microsoft cares deeply about security, I've posted active stats on number of internet facing devices running Windows Server 2008 and leaving ALL small businesses with NO SOLUTION (no moving to Azure is not a solution), and an arbitrary decision to only sell Windows 7 ESUs is absolutely going against Microsoft values and security guidance.  Let us buy Windows Server 2008 ESUs via CSPs or some other program but there has been no official Microsoft stand on this documented anywhere.

 

So dear Microsoft employees, please raise this to the right decision maker and review this decision.  This is one of your CORE values as Microsoft.  "“If we can’t protect people, then we don’t deserve their trust.”   How are you protecting small businesses that need more time to update their servers?  Is competition with AWS enough for you to breach trust with a large chunk of your Windows Server small business customers.  Please, make the right decision - sell the Windows Server 2008 ESU to small business, charge us even more if you want but give us a real option to protect our businesses and our infrastructure.

 

Copper Contributor

hello All,

does anyone know why after installing/activating ESU on air-gapped machines license status shows unlicensed, when you check ESU status by running below commend.  slmgr /dlv

looking forward to hear from you all.

 

thank you,

Copper Contributor
Hello, One setp is to execute slmgr /dlv to retreive the activation ID for the next step (slmgr /ato ). But we can see below a table showing acitavion ID : Windows 7 SP1 (Client) Year 1 77db037b-95c3-48d7-a3ab-a9c6d41093e0 Year 2 0e00c25d-8795-4fb7-9572-3803d91b6880 Year 3; 4220f546-f522-46df-8202-4d07afd26454 Does that mean that activation IDs are the same for everyone and that we don't have to check by using slmgr /dlv after MAK key install ? Thanks
Version history
Last update:
‎Feb 11 2020 11:06 AM
Updated by: