Introduction

Announced in the blog post by Microsoft on March 12, on January 14th, 2020, Windows 7 and Windows Server 2008/2008 R2 will go out of support, and soon thereafter Office 2010.

Out of support means that there will no longer be any further development or security patches released for your workstations or servers.

If you still want security patches, you will need to sign up for these through the Extended Security Updates (ESU) program.

In this blog post, I cover what the extended security updates for Windows 7 are, the cost, how you can purchase them and how to deploy the licenses.

For more information about the topic, refer to my other blog post about why you need to move to Windows 10 in 2019.

When do I need to purchase extended security updates?

You have three options as of this writing to receive further security updates for your Windows 7 machines:

  • Purchase Extended Security Updates for Windows 7
  • Purchase E5 licenses, as mentioned below
  • Use Windows Virtual Desktop

Microsoft is running a promotion, running between June 1, 2019, to December 31, 2019, including “free” Windows 7 security updates.

This offer applies for the following licenses:

  • Microsoft 365 E5
  • Microsoft 365 E5 Security
  • Windows 10 E5

Refer to Microsoft’s website for comparing the different Microsoft 365 Enterprise plans.

How do I purchase the Windows 7 ESUs?

windows 7 extended security updates
https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/How-to-get-Extended-Security-Updates-for-eligible-Windows/ba-p/917807

The Windows 7 and Windows Server 2008/2008 R2 extended security updates are purchased through the Extended Security Update (ESU) program and are available through volume licensing programs.

Previously, the extended security updates were only available to enterprise customers in Volume Licensing.

It will be possible to purchase the Extended Security Updates for Windows 7 starting on December 1, 2019, through the Cloud Solution Provider (CSP) program.

You purchase Extended Security Updates for full 12-month periods. According to Microsoft, it will not be possible to purchase partial periods, such as for 6 months.

There will only be one MAK license key that you will need to apply to all your machines.

Windows 7 Extended Security (ESU) Cost

The cost is per device and per year, with the cost doubling for every year until 2023.

Here is a pricing list from my other blog post

Year 1–January 2020–January 2021
$25 per device/year for Windows 7 Enterprise, $50 for Windows 7 Professional
Year 2–January 2021–January 2022

$50 per device/year for Windows 7 Enterprise, $100 for Windows 7 Professional
Year 3–January 2022–January 2023

$100 per device/year for Windows 7 Enterprise, $200 for Windows 7 Professional

Cloud Solution Providers (CSPs) can go to the Partner Center to learn more.

How to prepare for the Windows 7 Extended Security Updates

Before purchasing the Windows 7 ESUs, you can apply the following patch:

https://support.microsoft.com/en-us/help/4528069/update-for-eligible-windows-7-and-server-2008-r2-devices-can-get-esu

The Windows 7 ESU MAK key

Once you have purchased licenses for extended security updates for Windows 7, you will receive a Windows 7 MAK key, which you will need to apply to your devices.

When you have deployed the Windows 7 MAK key, the Windows 7 device will look for updates.

All devices missing this registry value will not receive any further security updates, following January 14th, 2020.

The Windows 7 ESU Activation ID

The Activation IDs are provided by Microsoft on: https://techcommunity.microsoft.com/t5/windows-it-pro-blog/how-to-get-extended-security-updates-for-eligible-windows/ba-p/917807

Year 1 77db037b-95c3-48d7-a3ab-a9c6d41093e0 
Year 20e00c25d-8795-4fb7-9572-3803d91b6880 
Year 34220f546-f522-46df-8202-4d07afd26454 

How to activate the Windows 7 Extended Security Updates

After you have purchased the Windows 7 Extended Security Updates, you will receive a MAK key.

This MAK is unique to your organization, but not unique for each device, meaning you will use the same MAK key to activate all your devices.

This MAK key is activated by running the following command:

cscript c:\windows\system32\slmgr.vbs /ipk <key>

Once the MAK key has been activated, also activate the Activation Key using:

cscript c:\windows\system32\slmgr.vbs /ato <activation ID>

How to deploy the Windows 7 Extended Security Updates using MEMCM (SCCM)

If you want to deploy the Windows 7 ESU MAK key, a good way of doing this is through Microsoft Endpoint Configuration Manager (SCCM).

Prerequisites for deploying the Windows 7 ESUs

To deploy the Windows 7 ESU you will need the following prerequisites on your clients:

  1. Install the Servicing Stack Update (KB4490628), released on March 12, 2019
  2. Install the latest SHA-2 update, released on September 23, 2019 (KB4474419)
  3. Install the latest Servicing Stack Update, released on September 10, 2019 (KB4516655)
  4. Monthly rollup, released on October 8, 2019 (KB4519976)

How to deploy the Windows 7 ESUs using MEMCM (SCCM)

When you have met the prerequisites:

  1. Create a script for activating the MAK & Activation Key
  2. Create a package
  3. Deploy

Once the prerequisites are met, create a package and a script that activates the MAK and Activation key in sequence.

I will soon update this blog post with a Powershell script for accomplishing this.

For more information about applying the license to devices, refer to Microsoft’s blog post.

Conclusion

With the end of support for Windows 7, it’s important that your organization has a strategy for Windows 7.

How will you handle Windows 7? Will you purchase Windows 7 Extended Security Updates, E5 licenses or try Windows Virtual Desktop for the remaining Windows 7 machines?

Please leave a comment below!

References

Related posts

Sign up for my monthly newsletter!

Receive the latest updates from me and the community within Microsoft Endpoint Manager, Windows 10, and Powershell!

16 COMMENTS

  1. Regarding using SCCM to deploy the MAK, how are you capturing the application license and then activating it?

  2. Thank you for your article, but what about Activation ID ?

    Is this article : https://techcommunity.microsoft.com/t5/windows-it-pro-blog/how-to-get-extended-security-updates-for-eligible-windows/ba-p/917807

    We have to activate the key ith the activation ID.

    Any idea if the activation IDs will be the same for everyone ? (like

    77db037b-95c3-48d7-a3ab-a9c6d41093e0 for the first year for W7) ? It’s hard to understand, if you have the answer, it’s welcome 🙂 Thanks

    • Hi,
      Sorry for the late reply! The activation ID will be the same for everyone but will differ depending on which year it is. I have updated the blog post to incorporate this information.

      Thanks for the feedback!

      /Daniel

  3. Hi,
    If the activation ID is always the same, the script to deploy the ESU licences just need to contain two lines, am I right ?
    The first one is :
    cscript c:\windows\system32\slmgr.vbs /ipk
    Where must be replaced with my MAK licence
    And the second one is :
    cscript c:\windows\system32\slmgr.vbs /ato
    Where equals to this specific value “77db037b-95c3-48d7-a3ab-a9c6d41093e0” which seems to be the same value for everyone, every computer, every company.
    I had the feeling that it would be more difficult, but not really, am I right ?
    Why everybody here is waiting for your script if this is all it needs to be done ?

    Thank you for your answer !
    Ben

    • It seems that some words have been deleted from my previous message.
      I am trying again..

      Hi,
      If the activation ID is always the same, the script to deploy the ESU licences just need to contain two lines, am I right ?
      The first one is :
      cscript c:\windows\system32\slmgr.vbs /ipk “Your_Licence_KEY”
      Where “Your_Licence_KEY” must be replaced with your MAK licence
      And the second one is :
      cscript c:\windows\system32\slmgr.vbs /ato “Activation_ID”
      Where “Activation_ID” equals to this specific value “77db037b-95c3-48d7-a3ab-a9c6d41093e0” which seems to be the same value for everyone, every computer, every company, everyone.
      I had the feeling that it would be more difficult, but not really, am I right ?
      Why everybody here is waiting for your script if this is all it needs to be done ?

      Thank you for your answer !
      Ben

        • And ho, I forgot, thank you for your great post !
          Just a thing.
          You talked about making a powershell script to deploy the MAK licence and activate it on the computers. But maybe the script should, in addition, check if the commands have successfully been executed or not (I do not know how because I s*ck with powershell scripting, but it should be possible)

  4. Great Blog post!

    just a heads up. In your instructions it says to activate via
    cscript c:\windows\system32\slmgr.vbs /ato (activation key)

    but i could only get it to work by doing:

    cscript c:\windows\system32\slmgr.vbs /ato (activation id)

    doing so with the activation key resulted in “product not found”

LEAVE A REPLY

Please enter your comment!
Please enter your name here