Procedure to continue receiving security updates after extended support ends on January 14, 2020

The article applies to all customers who have purchased the Extended Security Update (ESU) for on-premises versions of the following:

• Windows 7 Service Pack 1 (SP1)
• Windows Server 2008 R2 with Service Pack 1 (SP1)
• Windows Server 2008 Service Pack 2 (SP2)
• All Azure Stack and VMWare on Azure Virtual Machines (VMs) running on these operating systems.

On January 14, 2020, extended support ends. Customers who have purchased Extended Security Update (ESU) can continue to receive updates.

To continue receiving security updates after January 14, 2020, follow these steps:

1. You must have the following updates installed. If you use Windows Update, these updates will be offered automatically as needed.
   1. You must have the SHA-2 update (KB4474419) that is dated September 23, 2019 or a later SHA-2 update installed and then restart your device before you apply this update. If you use Windows Update, the latest SHA-2 update will be offered to you automatically. For more information about SHA-2 updates, see 2019 SHA-2 Code Signing Support requirement for Windows and WSUS.
   2. For Windows 7 SP1 and Windows Server 2008 R2 SP1, you must have the servicing stack update (SSU) (KB4490628) that is dated March 12, 2019. After installing KB4490628, you must install the January 14, 2020 SSU (KB4536952) or later. For more information about the latest SSU updates, see ADV990001 | Latest Servicing Stack Updates.
   3. For Windows Server 2008 SP2, you must have the servicing stack update (SSU) (KB4493730) that is dated April 9, 2019 SSU update installed. After installing KB4493730, you must install the January 14, 2020 SSU (KB4536953) or later.  For more information about the latest SSU updates, see ADV990001 | Latest Servicing Stack Updates.

Important You must restart your device after you install these required updates.

2. Download and install the Extended Security Updates (ESU) Licensing Preparation Package. For more information, see the following articles in the Microsoft Knowledge Base:
   • 4538483 Extended Security Updates (ESU) Licensing Preparation Package for Windows 7 SP1 and Windows Server 2008 R2 SP1
   • 4538484 Extended Security Updates (ESU) Licensing Preparation Package for Windows Server 2008 SP2
3. Download the ESU MAK add-on key from the VLSC portal and deploy and activate the ESU MAK add-on key. If you use the Volume Activation Management Tool (VAMT) to deploy and activate keys, follow the instructions here.

Note After you successfully complete this procedure, you can continue to download the monthly updates via the usual channels of Windows Update, WSUS and Microsoft Update Catalog. You can continue to deploy the updates using your preferred update management solution.

You do not need an additional key for deployment of the following:

• All Azure VMs
• Windows 7 SP1 with Windows Virtual Desktop
• Bring your own images on Azure for Windows 7 SP1, Windows Server 2008 R2 SP1, and Windows Server 2008 SP2