How to go Extended Security Updates (ESU) for Windows Server

  • Article
  • 6 minutes to read

Extended Security Updates (ESU) for Windows Server include security updates and bulletins rated critical and important. Earlier using Extended Security Updates, yous should read Extended Security Updates for Windows Server Overview to understand what Extended Security Updates are, how long they are bachelor for, and what your options are.

How you get Extended Security Updates depends on where your server is hosted. Applicative virtual machines (VMs) hosted in Azure are automatically enabled for Extended Security Updates and these updates are provided complimentary of accuse.

For other environments, such every bit on-premises VMs or physical servers, you need to manually request and configure Extended Security Updates. You tin buy Extended Security Updates through Volume Licensing Programs such as Enterprise Agreement (EA), Enterprise Agreement Subscription (EAS), Enrollment for Education Solutions (EES), or Server and Cloud Enrollment (SCE).

To apply Extended Security Updates on non-Azure VMs, you create a Multiple Activation Key (MAK) and employ it to the relevant servers running Windows Server. This MAK key lets the Windows Update servers know that you tin go along to receive security updates.

Note

It may have three-five business days for your Multiple Activation Key to go available after purchasing Extended Security Updates for on-premises VMs or concrete servers. Your organisation may too crave time to programme and deploy the new keys. Earlier purchasing Extended Security Updates, you should keep these timelines in listen.

Azure virtual machines

Applicative virtual machines (VMs) hosted in Azure are automatically enabled for Extended Security Updates and these updates are provided gratis of charge. You lot don't demand to configure anything, and there'south no boosted charge for using Extended Security Updates with Azure VMs. Extended Security Updates are automatically delivered to Azure VMs if they're configured to receive updates.

Note

Azure Classic VMs (Microsoft.ClassicCompute) crave boosted configuration to receive Extended Security Updates since they don't have access to the Azure Example Metadata Service that determines Extended Security Updates eligibility. Please contact Microsoft Support for more than help with this.

Annals for Extended Security Updates for non-Azure servers and obtain your Multiple Activation Primal

In one case you've purchased Extended Security Updates, you commencement need to annals your purchase in the Azure portal to get your Multiple Activation Key. You lot register for Extended Security Updates using the Azure portal, even if you only use on-bounds computers.

Note

You don't need to register for Extended Security Updates if you're running Windows Server on Azure VMs as these are provided past default and at no cost. For other environments, such as on-premises VMs or physical servers, buy Extended Security Updates before you lot try to register and employ them.

To register your server for Extended Security Updates and create a key, open the Azure portal and follow these steps:

  1. Sign in to the Azure portal.

  2. In the search box at the tiptop of the Azure portal, search for and select Extended Security Updates.

    Search for Extended Security Updates in the Azure Portal

    If you haven't used Extended Security Updates before, select + Create to create an Extended Security Updates resources first. Otherwise, select your resource from the list.

  3. Under Register for Extended Service Updates, select Go started.

    Get started with Extended Security Updates in the Azure Portal

  4. To create your first key, select Get key.

    Choose to create a key in the Azure Portal

    You demand an Azure subscription associated with your account to create the Extended Security Update resource and key. If you lot don't have an Azure subscription associated with your business relationship, sign in with a unlike user account or create an Azure subscription in the Azure portal.

    Your Azure subscription must also be assigned the Contributor role for the security update to piece of work. To bank check your role, enter "Subscriptions" into the search box. You'll see a table that will bear witness you your role side by side to your subscription ID and name.

    If you aren't a Contributor, you can enquire the subscription possessor to change your office. To observe out who owns your subscription, go to the role tabular array described in the previous paragraph and select your subscription's proper name. Next, get to the menu on the left side of the page and select Access command (IAM) > Role assignments and look for the Owners section in the table.

  5. If you see a page titled Register to get a Multiple Activation Key, that means you need to request access to the preview before you lot can use Extended Security Updates. If you don't run into this page, skip ahead to pace vi.

    To asking admission, select join the preview. An e-mail message window will open up. This email is your access request to the Microsoft team.

    Include the following information in your request:

    • Customer name
    • Azure subscription ID
    • Understanding number (for ESU)
    • Number of ESU servers

    When you're done, ship the electronic mail.

    The team will review the information you provide in your request e-mail. If everything looks okay, they'll add you to the canonical list.

    If the team doesn't approve your asking, you'll see the following error:

                      The resources type could not be found in the namespace 'Microsoft.WindowsESU'

  6. Under Azure details, select your Azure subscription, a resource group, and location for your key.

    Under Registration details, enter the following information:

    Setting Value
    Central name A display name for your key, such Agreement01.
    Agreement number Your understanding number generated by the volume licensing contract management system, or MSLicense for Enterprise Agreement programs.
    Number of computers Choose the number of computers on which you desire to install Extended Security Updates with this primal.
    Operating system Choose the operating arrangement to employ this central with, such as Windows Server 2008 R2.

    When ready, select Review + register.

    Note

    Make sure you've selected the Azure subscription that you joined the preview with in your global filter. Select the Filter push in the Azure Portal ribbon to check your global subscription filter.

    An image of the Azure Portal ribbon with the Filter button selected

  7. Subsequently successful validation, a summary of your choices for the new registry resource is shown. If needed, correct any validation errors or update your configuration choices. The Azure Terms of Use and Privacy Policy are available.

    Check the box to ostend that you take eligible computers and the key is but to exist used inside your organization:

    Confirm that the key will only be used by your organization

    When set, select Create to generate the Multiple Activation Key.

Extended Security Updates registration is now available for use with your servers. The key created should be applied to Windows Server 2008 and 2008 R2 servers that you wish to remain eligible for security updates.

Access your Multiple Activation Primal from the Microsoft Volume Licensing Service Centre

After you've successfully registered and generated your Multiple Activation Key, you lot can also can use the Volume Licensing Service Middle to view and download your central.

To get your key from the Volume Licensing Service Middle:

  1. Get to the Volume Licensing Service Center page and sign in with your Azure credentials.

  2. Select Licenses > Relationship Summary > Licensing ID > Product Keys.

Download and apply Extended Security Updates

Commitment, download, and application of Extended Security Updates for Windows Server is no different than other Windows Updates. The updates provided through Extended Security Updates are merely Security updates.

Y'all tin can install the updates using whatever tools and processes you already have in place. The simply difference is that the system must be registered using the key generated in the previous department for the updates to download and install.

For VMs hosted in Azure, the process of enabling the server for Extended Security Updates is automatically completed for you. Updates should download and install without additional configuration.

To learn more near how to get Extended Security Updates for eligible Windows devices, see our Tech Customs blog post Obtaining Extended Security Updates for eligible Windows devices.