Cybersecurity Blog

10 min read

How Do I Buy Windows 7 Extended Security Updates (ESU)?

Dec 20, 2019 11:27:39 AM

We are getting an unprecedented volume of phone calls and online inquiries from IT Professional who thought they would have updated their PCs to Windows 10 Pro by now, but are now asking - where can I get Windows 7 Extended Security Updates (ESU)? I need it now!!!

This is happening because Microsoft will stop providing mainstream support for Windows 7 effective January 14, 2020. So unless you have signed up for extended support for Windows 7, you will not receive any Windows 7, making you instantly at higher risk of being hacked, makes your business instantly non-compliant, which could but yourself out of a job if you are working in a regulated industry sector where you are expected to prevent avoidable cyber security incidents.

Windows 7 Extended Security Updates (ESU) are only for devices running Windows 7 Pro NOT Windows 7 Home. If you are on Windows 7 Home, your only option is to purchase Windows 10 Pro or purchase a new device.

What are my options?

Since our original blog post published in July 2019, Microsoft is now offering at least 2 new options, one of them being more palatable for SMBs. Here are your options:

  1. Buy a new device with Windows 10 Pro
  2. Upgrade to Windows 10 Pro by purchasing Windows 10 Pro
  3. Upgrade to Windows 10 Pro by purchasing Microsoft 365 Business
  4. Subscribe to Windows Virtual Desktop offering
  5. Purchase Windows 7 ESU through Volume Licensing (Microsoft Enterprise Agreement required)
  6. Purchase Windows 7 ESU through BEMO via the Cloud Solution Provider (CSP) Program 

Option 1 - Buy a new device with Windows 10 Pro

This is likely the most straight forward option, especially if you have aging hardware and hat you are not running legacy line-of-business apps that still requires Windows 7.

If you go that path, you won't have to spend time upgrading your machine and will have a brand new PC or laptop. Make sure you are buying a computer with Windows 10 Pro, not Home or Student. Bottom line, this will cost you the price of a new PC.

Option 2 -Upgrade to Windows 10 Pro by purchasing Windows 10 Pro

This is a viable option if you expect few more years out of your hardware running Windows 7 Pro and assumes that you are not running legacy line-of-business apps that still requires Windows 7. Be ready to fork over about $200 per device.

Option 3 - Upgrade to Windows 10 Pro by purchasing Microsoft 365 Business

If you are on Office 365 or are thinking about moving from an "Office 365 plan" to a Microsoft 365 plan, then subscribing to Microsoft 365 Business might be the answer. Microsoft 365 Business offers great value and includes upgrade rights to Windows 10 Pro from Windows 7/8.1 Pro licenses. For more information, read our other blog posts: What is Microsoft 365? and Microsoft 365 vs Office 365.

 

Option 4 - Subscribe to Windows Virtual Desktop offering

Windows Virtual Desktop (WVD) was officially launched this fall of 2019. In a nutshell, it is something you can call "Remote Desktop as-a-Service" or Virtual Desktop Infrastructure (VDI)-as-a-Service. WVD is a great option if you are running your business on an aging RDH or VDI farm and are thinking about transforming your business with a modern approach to thin-client enabling more security and simplified device management.

 

When you sign up for WVD, you get 3-year worth of Windows 7 ESU at no extra cost. How much will WVD will cost you will all depends on your situation. If you build it on your own, you will have to factor in the cost of your Azure resources and Microsoft 365 licenses along with the time and effort you put to set it up and to maintain it.

With that in mind and based on our experience with WVD, BEMO has pre-packaged 3 WVD multi-session offers. Here is a sneak preview of what it looks like

  BEMO WVD F1 BEMO WVD Business BEMO WVD E5
pricing per seat/month $69 $99 $125
for... first-line workers
w/ web apps only
Business < 300 employees
w/ web and desktop apps
Enterprise grade with the full Microsoft security stack
with Microsoft 365 F1 Microsoft 365 Business Microsoft 365 E5

 

Option 5 - Purchase Windows 7 ESU through Volume Licensing

As announced earlier this year, Windows 7 ESU is available via few specific Volume Licensing programs. That is an option is catered to businesses with a Microsoft Enterprise Agreement and is not available to most SMBs.

Option 6 - Purchase Windows 7 ESU through BEMO via the Cloud Solution Provider Program (CSP)

This is the newest way to get Windows 7 ESU and addresses the needs of customers that are not into any kind of Volume Licensing deal or are not considering any of the options above.

The process to is quite straight forward.  All you need is to purchase Windows 7 ESU directly from BeMo Online Store. It is licensed per device and costs $70 for the first year. Once your order has been received, we will deliver your product key and all you have left to do will be to install and activate the ESU on each of your devices as per these instructions summarized below.

 


How to Install and Activate Windows 7  Extended Security Updates

 

Here is an excerpt from a great blog published originally by Poornima Priyadarshini at Microsoft which provides step-by-step instructions on how to install and activate Windows 7 ESU purchased via the CSP Program. More comprehensive instructions which also cover Windows Server 2008 ESU are available here also.

Installation prerequisites

The following steps must be completed before installing and activating ESU keys:

  1. Install the following SHA-2 code signing support update and servicing stack update (SSU) or a later SSU:

    Windows 7 SP1 :
    Servicing stack update for Windows 7 SP1
    and
    SHA-2 code signing support update for Windows 7

  2. Install the following SSU and monthly rollup:

    Windows 7 SP1 :
    Servicing stack update for Windows 7 SP1: September 10, 2019 (KB4516655)
    and October 8, 2019: Monthly Rollup (KB4519976)
  3. Once activated,  continue to use your current update and servicing strategy to deploy ESU through Windows Update, Windows Server Update Services (WSUS), Microsoft Update Catalog, or whichever patch management solution you prefer.

Installation and activation

Once you have addressed the prerequisites, you’re ready to install and activate Extended Security Updates for machines connected to the internet.

First, install the ESU product key using the Windows Software Licensing Management Tool (slmgr):

Note: Installing the ESU product key will not replace the current OS activation method being used on the device. This is achieved by using the Activation ID to differentiate between the operating system’s activation and the ESU activation.

  1. Open an elevated Command Prompt. 'Elevated' means running as an administrator, for that: press the Windows key, type in "command", right-click and select "Run as administrator".
  2. Type slmgr /ipk <ESU key> and select Enter.
    (Replace "<ESU key>" with the product key that was provided to you. Do not put any bracket, or <>)
  3. If the product key installed successfully, you will see a message like the following:

    02_ESU-product-key-installed.png

Next, find the ESU Activation ID:

  1. In the elevated Command Prompt, type slmgr /dlv and select Enter.
  2. Note the Activation ID as you will need it in the next step.

    03_ESU-activation-ID.png

Now, you’ll activate the ESU product key:

  1. Open an elevated Command Prompt.
  2. Type slmgr /ato <ESU Activation Id> and press Enter.
    (Replace "<ESU Activation ID>" with the ID shown in your PC. Do not put any bracket, or <>)


  3. 04_ESU-activation-confirmed.png

    The following table outlines possible values for the <ESU Activation Id>:

    ESU Program 

    ESU SKU (or Activation) ID 

    Windows 7 SP1 (Client)

     

    Year 1 

    77db037b-95c3-48d7-a3ab-a9c6d41093e0 

    Year 2

    0e00c25d-8795-4fb7-9572-3803d91b6880 

    Year 3;

    4220f546-f522-46df-8202-4d07afd26454 

Once you have activated the ESU product key, you can verify the status at any time by following these steps:

  1. Open an elevated Command Prompt.
  2. Type slmgr /dlv and select Enter.
  3. Verify Licensed Status shows as Licensed for the corresponding ESU program, as shown below:

    05_checking-ESU-license-status.png

Note: We recommend using a management tool, such as System Center Configuration Manager, to send the slmgr scripts to your enterprise devices.

Verifying your deployment on eligible Windows 7 SP1 

Windows 7 SP1: Install the optional, non-security update outlined in KB4528069. Please note that the KB4528069 update has no actual security content. This update is a test package and we subsequently recommend that you deploy it in your test environment. Install this update on your on-premises devices that are eligible for ESU.

If you are interested in learning more about Extended Security Updates, please see the following resources:

FAQ about Extended Security Updates for Windows 7

Read the FAQ

Topics: Windows 7

Joel Lachance
Written by Joel Lachance

VP, Business Development

Post a Comment

Will your business get hacked?

Take our 23-question online quiz to find out your risk

Will your business get hacked?

close