Lifecycle FAQ - Extended Security Updates

Originally published: April 2, 2019
Updated: July 7, 2020

search Please go here to search for your product's lifecycle.

What is the Extended Security Update (ESU) program?

The Extended Security Update (ESU) program is a last resort option for customers who need to run certain legacy Microsoft products past the end of support. It includes Critical* and/or Important* security updates for a maximum of three years after the product's End of Extended Support date.

Extended Security Updates will be distributed if and when available. ESUs do not include new features, customer-requested non-security updates, or design change requests.

All Windows 7 and Windows Server 2008/R2 customers received an update on January 14, 2020 as the operating systems were in support until then. Updates for these operating systems after January 14, 2020 are provided for ESU customers only.

* As defined by the Microsoft Security Response Center (MSRC).

What products are included?

ESU Availability and End Dates

Products End of Extended Support/ESU Start Date ESU End Date Year 1 ESU End Date Year 2 ESU End Date Year 3 Type of Security Update
SQL Server 2008/R2 (Enterprise, Standard, Datacenter, Web, Workgroup) July 9, 2019 July 14, 2020 July 13, 2021 July 12, 2022 Critical
SQL Server 2008/R2 for Embedded Systems* July 9, 2019 July 14, 2020 July 13, 2021 July 12, 2022 Critical
Windows Server 2008/R2 (Datacenter, Standard, Enterprise) January 14, 2020 January 12, 2021 January 11, 2022 January 10, 2023 Critical, Important
Windows 7 (Professional, Enterprise) January 14, 2020 January 12, 2021 January 11, 2022 January 10, 2023 Critical, Important
Windows 7 Professional for Embedded Systems* January 14, 2020 January 12, 2021 January 11, 2022 January 10, 2023 Critical, Important
Windows Server Embedded 2008/R2* January 14, 2020 January 12, 2021 January 11, 2022 January 10, 2023 Critical, Important
Windows Embedded Standard 7* October 13, 2020 October 12, 2021 October 11, 2022 October 10, 2023 Critical, Important
Windows Embedded POSReady 7* October 12, 2021 October 11, 2022 October 10, 2023 October 14, 2024 Critical, Important

* Extended Security Updates for select Embedded products are available via OEMs. All others are available via volume licensing.

Can I get support after the Extended Support date, without purchasing Extended Security Updates?

For technical support, customers must purchase Extended Security Updates and have an active support plan in place to get technical support on a product that has moved beyond the Extended Support date. Please call 1-800-Microsoft to receive support.

For security updates only, customers can receive Extended Security Updates on the following products for free:

  • SQL and Windows Server 2008/R2: Customers who move workloads to Azure Virtual Machines (IaaS) "as-is" will have free access to Extended Security Updates for both SQL Server and Windows Server 2008 and 2008 R2 for three years after the End of Support.

  • Windows 7: Microsoft Windows Virtual Desktop provides a Windows 7 device with free Extended Security Updates through January 2023.

How can I purchase ESUs?

Extended Security Updates are available through specific volume licensing programs. Contact your Microsoft partner or account team to learn more. ESUs for select Embedded products are available via your embedded device manufacturer.

Coverage will be available in three consecutive 12-month increments following End of Support. Customers cannot buy partial periods (e.g., only 6 months). Extended Security Updates are transacted per year (12-month period), commencing with the End of Support date.

Eligible customers can use the Azure Hybrid Benefit (available to customers with active Software Assurance or Server Subscriptions) to obtain discounts on the license of Azure Virtual Machines (IaaS) or Azure SQL Database Managed Instance (PaaS).

Does Unified Support include ESUs?

No, customers must purchase ESU support separate from Unified Support. Once ESU support is purchased, customers can get technical support for products covered by the program.

How do I install ESU updates?

SQL Server 2008/R2: Once SQL Server instances have been registered with the SQL Server registry service, customers can download the Extended Security Update packages using the link found in the Azure portal, if and when they are made available. Go here to learn more.

Can I use System Center Configuration Manager (SCCM) to deploy Extended Security Updates?

Customers who have purchased Windows ESUs can use the latest version of System Center Configuration Manager, Current Branch (SCCM) to deploy and install Windows security updates.

SCCM 2012 R2 will not be supported on Windows 7 or Windows Server 2008/R2 operating systems during their respective ESU phases.

For more information, go here.

What versions of .NET are supported on Windows during their respective Extended Security Update (ESU) phases?

.NET 3.5 SP1, .NET 4.5.2 and .NET 4.6 are supported during the Windows Server 2008 ESU.

.NET 3.5. SP1, and .NET 4.5.2 through .NET 4.8 are supported during Windows Server 2008 R2 and Windows 7 ESU phases.

How can I learn more?

To learn more about the Extended Security Update Program, and End of Support and migration options for Window 7 and SQL and Windows Server 2008/R2, see the following articles:

Change Log

January 2020 edits
EDITED: URLs for SQL Server 2008/R2 ESU FAQs and Resources

July 2020 edits
EDITED: ESU end date year 2 for Windows Embedded Standard 7