Update to verify that eligible Windows 7 SP1 and Server 2008 R2 SP1 devices can get Extended Security Updates

Applies to: Windows 7 Service Pack 1Windows Server 2008 R2 Service Pack 1


This optional nonsecurity update will help you verify that your eligible Windows 7 Service Pack 1 (SP1) and Server 2008 R2 SP1 devices can continue to get Extended Security Updates (ESUs) after the end of support date of January 14, 2020.


  • This update has no actual security content. This update is a test package we recommend that you deploy in your test environment. Install this update on your on-premise devices that are eligible for ESU.
  • This update can be installed on x64-based architecture for Windows Server 2008 R2 SP1and the Windows editions mentioned in Lifecycle FAQ-Extended Security Updates.
  • This update can be installed on x86 and x64-based architecture for Windows 7 SP1 and the Windows editions mentioned in Lifecycle FAQ-Extended Security Updates.
  • This update is not applicable for Windows 7 Virtual Desktop (WVD) and Windows 7 Embedded OS.
  • Installing this update has no impact on getting security updates between now and January 14, 2020.
  • For technical support, customers must purchase Extended Security Updates and have an active support plan in place to get technical support on a product that has moved beyond the Extended Support date. Please call 1-800-Microsoft (642-7676) to receive support.

How to get this update

Install this update

Release Channel Available Next Step
Windows Update or Microsoft Update No Use one of the other release channels to get this update.
Microsoft Update Catalog Yes To get the standalone package for this update, go to the Microsoft Update Catalog website.
Windows Server Update Services (WSUS) Yes

This update will automatically synchronize with WSUS if you configure Products and Classifications as follows:

Product:  Windows 7 Service Pack 1, Windows Server 2008 R2 Service Pack 1

Classification: Updates

Installation instructions

  1. Install this update from one of the Release Channels such as Microsoft Update Catalog or Windows Server Update Services.
  2. Verify the successful installation of this update by using your regular process such as Update History.


You must have the following installed on your on-premise device before you apply this update:

  1. Install the following SHA-2 code signing support update and servicing stack update (SSU) or a later SSU update:
    • 4474419 SHA-2 code signing support update for Windows Server 2008 R2, Windows 7, and Windows Server 2008: September 23, 2019
    • 4490628 Servicing stack update for Windows 7 SP1 and Windows Server 2008 R2 SP1: March 12, 2019
  2. Install the following servicing stack update (SSU) and monthly rollup:
    • 4516655 Servicing stack update for Windows 7 SP1 and Server 2008 R2 SP1: September 10, 2019
    • 4519976 October 8, 2019—KB4519976 (Monthly Rollup)
  3. Install and activate the ESU key. For information about how to install and activate the ESU key, see the How to get Extended Security Updates for eligible Windows devices blog on the Microsoft Tech Community website.

    Note After activation, you can then continue to use your current update and servicing strategy to deploy ESU through Windows Update, Windows Server Update Services (WSUS), or whichever update management solution that you prefer.

Restart information

You do not have to restart your device after you apply this update.

Update replacement information

This update does not replace any previously released update.


If the installation of this update is unsuccessful, follow these troubleshooting steps:

  1. Make sure that all the prerequisites mentioned in the "Prerequisites" section are installed successfully. To do this, you can use the command Get-hotfix -id KB<number>.  Also, make sure that there is no restart pending on any of the updates.
  2. Make sure that you are installing this update on the ESU eligible edition and supported architecture.
  3. Verify that the ESU key is installed and activated successfully by using your script or the slmgr /dlv that you typically use. Reference the blog article to check the ESU key status.
  4. If you experience issues with any of these steps, call the customer support number 1-800-Microsoft (642-7676) to receive support.