This article is intended for use by IT professionals. If you're looking for information for home users, see Windows 7 support will end on January 14, 2020.
General information
Windows 7 ESU include security updates for critical and important issues as defined by Microsoft Security Response Center (MSRC) for a maximum of three years after January 14, 2020. After January 14, 2020, if your PC is running Windows 7 and you have not purchased Extended Security Updates, the computer will no longer receive security updates.
Note
There will not be an ESU offering or an extension of support for Office 2010.
ESU are available for Windows 7 Professional and Windows 7 Enterprise.
The ESU offer has been available in the Volume Licensing Service Center (VLSC) since April 1, 2019.
Extended Security Updates will be available from Cloud Solution Providers (CSPs) beginning on Monday, December 2, 2019.
ESU purchasing
Although end of support for Windows 7 is January 14, 2020, organizations can purchase ESU at any time during the three years that the offer is available. If an organization waits and purchases ESU for the first time in year two or year three, they will have to pay for the preceding years also. This is because the security updates that are offered under the ESU program are cumulative.
As stated, organizations can purchase ESU at any point. However, these organizations should be aware that after support has ended in January 2020, organizations will no longer receive regular bug fixes and updates. Additionally, Microsoft Support will not be able to provide support.
CSP Partners can find Windows 7 ESU offers in the Partner Center purchase experience, on the subscription software pricelist and under Software. For specific instructions about how to purchase ESU through Partner Center, see Purchasing Windows 7 ESU through a Cloud Solution Provider.
Customers who own Windows 7 for Education (EDU) can purchase the commercial ESU offering from CSPs starting on Monday, December 2, 2019.
VL customers: Please contact your Account Team CE for pricing and ordering information that is tailored to specific customer scenarios.
Customers who are interested in purchasing Windows 7 ESU in CSP should reach out to a CSP partner. You can find a qualified partner at this site.
The "Windows 7 Extended Security Updates 2020" SKU will become available on the CSP pricelist on Monday, December 2, 2019. The SKU is currently available for preview on Partner Center.
No. Windows 7 ESU will be made available as a separate SKU for each of the years that it is offered (2020, 2021, and 2022). To continue ESU coverage, customers have to separately purchase the SKU for each year.
No. Because we don’t require ESU on any device, we have no minimum purchase requirements.
No. However, organizations that have subscription licenses for Windows Enterprise SA or Windows Enterprise E3 receive advantageous pricing.
No. ESU will be available to purchase only through VL and CSP.
No. ESU is out-of-scope for MPSA.
ESU coverage
Windows XP and Windows Vista support has already ended, and no further support is available. Customers are encouraged to move to Windows 10 to take advantage of Microsoft 365.
Yes, updates will include support for the .NET Framework 4.5.2–4.8 release (as of January 2020) and .NET Framework 3.5 Service Pack 1 (SP1).
Customers can use an Ecosystem Partner Servicing Offering (EPSO) support contract to obtain ESU for embedded products.
Yes, customers who have devices that have Windows 7 Pro OEM licenses can purchase ESU through CSP when the Windows 7 ESU CSP offering becomes available on December 2, 2019.
ESU for Windows 7 VMs on Azure are delivered by using the same methods as for on-premises clients. For more information, see the ESU deployment section in this article.
No, your Windows 7 computer is not protected by MSE after January 14, 2020. MSE is unique to Windows 7 and follows the same lifecycle dates for support. Learn more about MSE.
SCEP definition and engine updates will continue for Windows 7 regardless of ESU status, according to the respective lifecycle policy for the listed SCEP versions.
- All in-support versions of SCEP offer anti-spyware and anti-virus updates on version 4.10.209.
- SCEP Current Branch will be the only EndPoint Protection product that will offer AV updates (until Jan 2023) after the 2012 version reaches its end of support in July, 2022.
No. Customers that purchase directly from Microsoft (for example, VL customers or CSP direct Partners) can use an active support contract such as Software Assurance or Premier/Unified Support to request assistance with Windows 7. Partners can also use their Partner Support Plans to request assistance with Windows 7.
No. If customers have Windows 7 but do not purchase ESU, those customers cannot log support tickets even if they have support plans.
Yes. Organizations that use VL to purchase ESU can submit support incidents by using any Microsoft Support offering, including Unified and Premier Support. A Microsoft Partner can submit tickets on behalf of a customer as long as the customer has purchased ESU, and the Partner has a support agreement in place.
No, CSP customers should use their partners for technical support or purchase a pay-per-incident plan through Microsoft Professional support.
Yes. CSP direct Partners may use their existing Partner Support plans to request assistance with Windows 7 ESU. Resellers should work with their CSP indirect Partners to request assistance with Windows 7 questions regarding devices that are covered by ESU.
Premier/Unified customers can use Service Hub to submit support tickets online, if they have already purchased ESU. When asked for their ESU ID, customers should enter their VL Enrollment IDs for ESU. Customers who do not have Premier or Unified contracts must call Microsoft Support to request technical support on a pay-per-use basis.
Partners who have Partner Support plans can use Service Hub to submit support tickets online on behalf of their customers, if those customers have already purchased ESU. When asked for their ESU ID, Partners should enter their CSP Tenant IDs to validate that their customers have purchased ESU.
We continue to work to fully automate the validation process. Currently, the tech routers validate whether customers have purchased ESU. To validate, customers should provide their Enterprise Agreement numbers or full customer names. After customers have been validated, the tech routers create cases and route them to the appropriate queues for technical support.
No new product enhancements will be made for Windows 7. If an investigation into a customer issue determines that a product enhancement that is available in a recent release (such as Windows 10) resolves the issue, then Microsoft Support will recommend that the customer upgrade to the recent release.
Microsoft is committed to helping customers upgrade or migrate to the cloud, and will provide best-effort support to troubleshoot issues for customers who have purchased Windows 7 ESU after January 14, 2020.
For VL customers and CSP direct partners who have Premier Support plans, the expectations are as follows.
ESU deployment
An organization that uses volume licensing (VL) to manage on-premises deployments can use VL to deploy ESU to the covered devices. When an organization purchases Windows 7 ESU, Microsoft provides a Multiple Activation Key (MAK) key in the VLSC. This MAK key is independent of the Windows 7 activation key and can work in parallel together with a KMS activation deployment.
To access the key within VLSC, the organization’s administrator can select Licenses > Relationship Summary > [Licensing ID] > Product Keys.
Note
In this command, [Licensing ID] refers to the licensing ID of the organization.
The product key list will include the ESU key, which is named Windows 7 Ext Security Year 1 MAK.
Organizations can deploy the new MAK key and any prerequisite servicing stack updates to the applicable devices, then continue their typical update and servicing strategy to deploy ESU by using Windows Update, Windows Server Update Services (WSUS), or whatever update management solution the organization prefers. This is also the process that organizations have to follow to update Azure Stack.
Note
We will provide additional information about MAK key acquisition for organizations that are CSP customers at a later date.
To install and activate Windows 7 ESU, download KB 4516033 (September 10, 2019) and KB 4516048 (September 24, 2019). For instructions to install and activate Windows 7 ESU, and more information about purchasing, see How to get Extended Security Updates for eligible Windows devices.
Note
Installing MAK keys adds the ability to receive Extended Security Updates. It does not replace the current product activation key (for example, OEM, KMS), nor does it re-activate the system. Organizations will have to install a new MAK key for every year that they have Extended Security Updates deployed.
Yes.
The ESU MAK key will be installed side-by-side with another activation key and will not affect that other activation key. It will follow the same rules and have the same limitations as a standard MAK key.
Organizations should follow whatever support process they typically use to request additional activations for MAK.
The updates will be delivered through all the usual update delivery processes, including SCCM Current Branch, WU, WUfB, and WSUS. The update will be programmed to look for the MAK activation on the endpoint, and it will install on only those systems together with the MAK key. Learn more about Extended Security Updates and Configuration Manager.