News

Microsoft Alters Windows Extended Security Updates Requirements Yet Again

• By Kurt Mackie
• 02/12/2020

Participants in Microsoft's Extended Security Updates (ESU) program for out-of-support Windows 7 and Windows Server 2008 machines faced new installation requirements on Tuesday.

The details are described in Microsoft's Knowledge Base (KB) article 4522133, apparently first published on Tuesday, Feb. 11. Organizations with machines covered by the ESU program likely were caught flat-footed by Microsoft's sudden requirements change, which involves manually downloading and installing some files before ESU security patches can arrive. Microsoft refers to these update files as ESU "Licensing Preparation Package" updates.

Microsoft's big bundle of security updates for February just arrived this Tuesday. However, it's likely that ESU program participants couldn't get to them because of Microsoft's late-breaking ESU requirements change to install the Licensing Preparation Package updates.

The ESU program lets organizations still stuck on the Windows 7 and Windows Server 2008 operating systems continue to get security patches for one year. Organizations can renew the patch support (at double the cost of the preceding year) for up to three years in total. Microsoft characterizes this program as a last-ditch effort for organizations that are having difficulties upgrading their machines.

IT pros in organizations subscribed to use ESUs may have already thought they had gone through the rather oblique setup steps to keep these security patches arriving. However, the requirements have changed since the program was first kicked off (in April for volume licensing customers and in December for other licensees). In late January, Microsoft recapped the ESU requirements, but included apparently new stipulations about having a certain SHA-2 update installed, as well as October monthly rollup patches.

That January recap, though, didn't mention the Licensing Preparation Package updates requirement. What a surprise!

Licensing Preparation Package Updates
ESU participants need to install Licensing Preparation Package files that just got published in the Microsoft Update Catalog, dated Monday, Feb. 10.

There are two different Licensing Preparation Package files to use, depending on which Windows software is getting ESU support. Microsoft lists them by KB article numbers as follows:

• 4538483 Extended Security Updates (ESU) Licensing Preparation Package for Windows 7 SP1 and Windows Server 2008 R2 SP1
• 4538484 Extended Security Updates (ESU) Licensing Preparation Package for Windows Server 2008 SP2

New ESU Activation Guidance
On top of adding the Licensing Preparation Package requirement, Microsoft scrapped its most detailed blog post on how to activate ESUs in Windows environments. Those guidelines have been rewritten and now can be found in this Feb. 11 blog post.

Microsoft's Feb. 11 blog post on activating ESUs includes a "Note" explaining that IT pros can't expect to get the Licensing Preparation Package files via the Windows Update service. Instead, they can only get those files through the Windows Server Update Services console or by downloading them from the Microsoft Update Catalog.

The ESU Licensing Preparation Package updates have to be manually installed, noted Susan Bradley, a Microsoft Most Valuable Professional and patch expert, in this AskWoody blog post. She described the new requirements as "late breaking change to the instructions" that just emerged from Microsoft on Feb. 11.

Bradley noted that she will now have to apologize to the businesses she worked with "to get their machines in a condition to get additional updates," since Microsoft's new requirements entail further delay.

"Bottom line, my apologies to anyone who thought they were all set," Bradley wrote. "You are not. You need KB4538483 to be able to get Windows 7 security updates in February."

For those organizations caught short by Microsoft's late-breaking ESU requirements, there's a specific rundown of the Windows 7 and Windows Server 2008 patches that arrived on Feb. 11 (update Tuesday) in this Born's Tech and Windows World post.