News

Microsoft Explains Windows 7 Extended Security Updates Setup Process

• By Kurt Mackie
• 10/18/2019

Microsoft this week described installation instructions for volume licensing users of Windows 7 Service Pack 1 to get Extended Security Updates (ESU) activated on PCs.

The ESU program provides access to "Critical"- and "Important"-rated security patches for Windows 7 SP1 for three years beyond its coming Jan. 14, 2020 end-of-life date. Participants buy ESU support in 12-month increments. The ability to buy into the insurance-like ESU program actually began on April 1. At that time, it was just for Microsoft's volume licensing Windows users, but Microsoft later relaxed that requirement.

The volume licensing program has been defined previously by Microsoft as just requiring five or more users when purchasing software use rights. Earlier this month, Microsoft had announced that its previous stipulation that volume licensing was a requirement to use the ESU patch option was dropped. With the new policy, ESU use is possible for any size organization, provided that it is using the Professional edition or Pro edition of Windows 7.

Microsoft plans to kick off ESU sales via its Microsoft Cloud Solution Provider (CSP) partner program on Dec. 1, 2019. Presumably, that detail is only of note for users of hosted Windows 7 virtual desk infrastructure solutions.

Two ESU Sales Dates
Microsoft's ESU announcements have been a bit confusing, requiring full attention to scattered blog posts and FAQ documents. However, this "Windows 7 and Office 2010" FAQ document does makes it clear (on page 15) that there are two ESU sales dates, the earlier April date for volume licensing users (and now non-volume licensing users, too) and a coming December date for CSP users:

The Extended Security Updates offer has been available in the Volume Licensing Service Center (VLSC) since April 1, 2019.

Extended Security Updates will be available via Cloud Solution Providers (CSP) beginning on December 1, 2019.

That buried explanation was unearthed by Joshua Trupin, an analyst with Directions on Microsoft, a Kirkland, Wash.-based independent research consultancy. He added via e-mail that Software Assurance isn't a requirement to use the Windows 7 ESU program, although Software Assurance is an ESU program requirement for the Windows Server 2008 and SQL Server 2008 ESU participants.

New ESU Key Needed
Microsoft's ESU installation instructions are for IT pros, and involve adding a new ESU Windows 7 product key.

The ESU key can be downloaded using Microsoft's Volume Licensing Service Center portal. Next, IT pros need to assure that some Servicing Stack Updates are in place. They then use the Windows Software Management Tool, with its command-line interface, to activate ESUs on client machines. Microsoft alternatively recommends using its System Center Configuration Manager solution for the purpose.

This rather manual setup process for Windows 7 ESU users is also the case for organizations using Azure Stack or VMware on Azure to host the Windows 7 operating system.

"Azure Stack VMs or Azure VMware solutions should follow the same [ESU install] process as on-premises devices," Microsoft's announcement explained.

Organization don't face all of these setup pains when getting ESU support by running Windows 7 on Azure virtual machines, or by running hosted Windows 7 via the new Windows Virtual Desktop service. They can get prepatched images from the Azure Marketplace instead, for instance, and they won't have to install new ESU keys. They do have to observe that some Servicing Stack Updates are installed, though.

Microsoft sweetens the deal for hosted Windows 7 users by providing three-year ESU support at no extra cost for those using Windows 7 on Azure virtual machines, although there are virtual machine use and storage costs to pay.

ESU setup on PCs typically requires having an open Internet connection, although Microsoft's Volume Activation Management Tool can be used to send scripts to disconnected devices.