Lifecycle FAQ - Extended Security Updates
Originally published: April 2, 2019
Updated: November 13, 2020
Please go here to search for your product's lifecycle.
What is the Extended Security Update (ESU) program?
The Extended Security Update (ESU) program is a last resort option for customers who need to run certain legacy Microsoft products past the end of support. It includes Critical* and/or Important* security updates for a maximum of three years after the product's End of Extended Support date.
Extended Security Updates will be distributed if and when available. ESUs do not include new features, customer-requested non-security updates, or design change requests.
All Windows 7 and Windows Server 2008/R2 customers received an update on January 14, 2020 as the operating systems were in support until then. Updates for these operating systems after January 14, 2020 are provided for ESU customers only.
To learn more about year 2 of the ESU program for Windows 7 and Windows Server 2008, go here.
* As defined by the Microsoft Security Response Center (MSRC).
What products are included?
ESU Availability and End Dates
|Products||End of Extended Support/ESU Start Date||ESU End Date Year 1||ESU End Date Year 2||ESU End Date Year 3||Type of Security Update|
|SQL Server 2008/R2 (Enterprise, Standard, Datacenter, Web, Workgroup)||July 9, 2019||July 14, 2020||July 13, 2021||July 12, 2022||Critical|
|SQL Server 2008/R2 for Embedded Systems*||July 9, 2019||July 14, 2020||July 13, 2021||July 12, 2022||Critical|
|Windows Server 2008/R2 (Datacenter, Standard, Enterprise)||January 14, 2020||January 12, 2021||January 11, 2022||January 10, 2023||Critical, Important|
|Windows 7 (Professional, Enterprise)||January 14, 2020||January 12, 2021||January 11, 2022||January 10, 2023||Critical, Important|
|Windows 7 Professional for Embedded Systems*||January 14, 2020||January 12, 2021||January 11, 2022||January 10, 2023||Critical, Important|
|Windows Server Embedded 2008/R2*||January 14, 2020||January 12, 2021||January 11, 2022||January 10, 2023||Critical, Important|
|Windows Embedded Standard 7*||October 13, 2020||October 12, 2021||October 11, 2022||October 10, 2023||Critical, Important|
|Windows Embedded POSReady 7*||October 12, 2021||October 11, 2022||October 10, 2023||October 8, 2024||Critical, Important|
* Extended Security Updates for select Embedded products are available via OEMs. All others are available via volume licensing.
Can I get support after the Extended Support date, without purchasing Extended Security Updates?
For technical support, customers must purchase Extended Security Updates and have an active support plan in place to get technical support on a product that has moved beyond the Extended Support date. Please call 1-800-Microsoft to receive support.
For security updates only, customers can receive Extended Security Updates on the following products for free:
SQL and Windows Server 2008/R2: Customers who move workloads to Azure Virtual Machines (IaaS) "as-is" will have free access to Extended Security Updates for both SQL Server and Windows Server 2008 and 2008 R2 for three years after the End of Support.
Windows 7: Microsoft Windows Virtual Desktop provides a Windows 7 device with free Extended Security Updates through January 2023.
How can I purchase ESUs?
Extended Security Updates are available through specific volume licensing programs. Contact your Microsoft partner or account team to learn more. ESUs for select Embedded products are available via your embedded device manufacturer.
Coverage will be available in three consecutive 12-month increments following End of Support. Customers cannot buy partial periods (e.g., only 6 months). Extended Security Updates are transacted per year (12-month period), commencing with the End of Support date.
Eligible customers can use the Azure Hybrid Benefit (available to customers with active Software Assurance or Server Subscriptions) to obtain discounts on the license of Azure Virtual Machines (IaaS) or Azure SQL Database Managed Instance (PaaS).
Does Unified Support include ESUs?
No, customers must purchase ESU support separate from Unified Support. Once ESU support is purchased, customers can get technical support for products covered by the program.
How do I install ESU updates?
SQL Server 2008/R2: Once SQL Server instances have been registered with the SQL Server registry service, customers can download the Extended Security Update packages using the link found in the Azure portal, if and when they are made available. Go here to learn more.
Can I use System Center Configuration Manager (SCCM) to deploy Extended Security Updates?
Customers who have purchased Windows ESUs can use the latest version of System Center Configuration Manager, Current Branch (SCCM) to deploy and install Windows security updates.
SCCM 2012 R2 will not be supported on Windows 7 or Windows Server 2008/R2 operating systems during their respective ESU phases.
For more information, go here.
What versions of .NET are supported on Windows during their respective Extended Security Update (ESU) phases?
.NET 3.5 SP1, .NET 4.5.2 and .NET 4.6 are supported during the Windows Server 2008 ESU.
.NET 3.5. SP1, and .NET 4.5.2 through .NET 4.8 are supported during Windows Server 2008 R2 and Windows 7 ESU phases.
How can I learn more?
To learn more about the Extended Security Update Program, and End of Support and migration options for Window 7 and SQL and Windows Server 2008/R2, see the following articles:
- How to get ESU for Windows devices
- How to get year 2 ESU for Windows
- How to get ESU for Windows Embedded 7 Standard
- IT Pro FAQ about the end of support for Windows 7
- Windows 7 and Office 365 ProPlus support
- SQL Server 2008/R2 and Windows Server 2008/R2 ESU FAQs
- SQL Server 2008/2008 R2 ESU resource site
- Extended Security Updates and System Center Configuration Manager
January 2020 edits
EDITED: URLs for SQL Server 2008/R2 ESU FAQs and Resources
July 2020 edits
EDITED: ESU end date year 2 for Windows Embedded Standard 7
November 2020 edits
ADDED: ESU end date year 2 for Windows 7 and Windows Server 2008
ADDED: Link to getting ESU for Windows Embedded 7 Standard