WSUS scan cab files will continue to be available for Windows 7 SP1 and Windows Server 2008 R2 SP1. If you have a subset of devices running these operating systems without ESU, they might show as non-compliant in your patch management and compliance toolsets.
Customers who have purchased the Extended Security Update (ESU) for on-premises versions of this OS and trying to deploy ESU on new machines must follow the procedures in KB4522133 to continue receiving security updates after extended support ends on January 14, 2020. For more information on ESU and which editions are supported, see KB4497181.
This update provides an additional set of licensing changes to enable installation of the ESU add-on key. This is one of the steps to prepare for installation of Extended Security Updates. For the full set of steps, please see KB4522133.
If you previously successfully installed and activated your ESU key on your Windows 7 SP1 device, you do not have to re-install or reactivate it after applying this update.
A restart is required after you apply this update and before you install any other updates.
For more information about the ESU program, see the following resources:
Important Before you apply this update, see the Prerequisites section.
Known issues in this update
Microsoft is currently not aware of any issues with this update.
How to get this update
Method 1: Microsoft Update Catalog
To get the standalone package for this update, go to the Microsoft Update Catalog website.
Method 2: Windows Server Update Services
This update is available through Windows Server Update Services (WSUS).
You must have the following updates installed before you apply this update. If you use Windows Update, these updates will be offered automatically as needed.
- You must have the SHA-2 update (KB4474419) that is dated September 23, 2019 or a later SHA-2 update installed and then restart your device before you apply this update. If you use Windows Update, the latest SHA-2 update will be offered to you automatically. For more information about SHA-2 updates, see 2019 SHA-2 Code Signing Support requirement for Windows and WSUS.
- You must have the servicing stack update (SSU) (KB4490628) that is dated March 12, 2019 installed. For more information about the latest SSU updates, see ADV990001 | Latest Servicing Stack Updates.
Important You must restart your device after you install these required updates and before you apply any Monthly Rollup, Security-Only Update, Preview of Monthly Rollup, or standalone update.
You must restart your device after you apply this update.
For information on SSUs, see the following articles:
- Servicing stack updates
- Servicing Stack Updates (SSU): Frequently Asked Questions
- ADV990001 | Latest Servicing Stack Updates
Learn about the terminology that Microsoft uses to describe software updates.