How to get Extended Security Updates (ESU) for Windows Server

  • Article
  • five minutes to read

Extended Security Updates (ESU) for Windows Server include security updates and bulletins rated critical and important. Before using Extended Security Updates, you should read Extended Security Updates for Windows Server Overview to sympathize what Extended Security Updates are, how long they are available for, and what your options are.

How you become Extended Security Updates depends on where your server is hosted. Applicable virtual machines (VMs) hosted in Azure are automatically enabled for Extended Security Updates and these updates are provided free of charge.

For other environments, such as on-premises VMs or physical servers, you need to manually request and configure Extended Security Updates. You tin purchase Extended Security Updates through Volume Licensing Programs such as Enterprise Agreement (EA), Enterprise Understanding Subscription (EAS), Enrollment for Educational activity Solutions (EES), or Server and Deject Enrollment (SCE).

To utilize Extended Security Updates on not-Azure VMs, yous create a Multiple Activation Central (MAK) and apply it to the relevant servers running Windows Server. This MAK central lets the Windows Update servers know that yous tin continue to receive security updates.

Azure virtual machines

Applicable virtual machines (VMs) hosted in Azure are automatically enabled for Extended Security Updates and these updates are provided free of charge. Yous don't need to configure anything, and in that location'southward no additional charge for using Extended Security Updates with Azure VMs. Extended Security Updates are automatically delivered to Azure VMs if they're configured to receive updates.

Note

Azure Classic VMs (Microsoft.ClassicCompute) require additional configuration to receive Extended Security Updates since they don't have admission to the Azure Instance Metadata Service that determines Extended Security Updates eligibility. Please contact Microsoft Back up for more assistance with this.

Register for Extended Security Updates for not-Azure servers and obtain your Multiple Activation Central

In one case you've purchased Extended Security Updates, you lot first need to register your buy in the Azure portal to get your Multiple Activation Key. You register for Extended Security Updates using the Azure portal, even if you lot only employ on-premises computers.

Notation

You don't need to register for Extended Security Updates if you're running Windows Server on Azure VMs as these are provided by default and at no toll. For other environments, such as on-premises VMs or physical servers, purchase Extended Security Updates before you endeavour to annals and use them.

To register your server for Extended Security Updates and create a key, open the Azure portal and follow these steps:

  1. Sign in to the Azure portal.

  2. In the search box at the top of the Azure portal, search for and select Extended Security Updates.

    Search for Extended Security Updates in the Azure Portal

    If you haven't used Extended Security Updates before, select + Create to create an Extended Security Updates resource first. Otherwise, select your resource from the list.

  3. Nether Register for Extended Service Updates, select Get started.

    Get started with Extended Security Updates in the Azure Portal

  4. To create your first key, select Get key.

    Choose to create a key in the Azure Portal

    You lot need an Azure subscription associated with your business relationship to create the Extended Security Update resources and central. If you don't have an Azure subscription associated with your account, sign in with a unlike user account or create an Azure subscription in the Azure portal.

    Your Azure subscription must besides be assigned the Contributor role for the security update to work. To check your role, enter "Subscriptions" into the search box. You lot'll see a tabular array that will show you your role next to your subscription ID and proper noun.

    If you aren't a Correspondent, y'all tin enquire the subscription owner to change your role. To discover out who owns your subscription, go to the part table described in the previous paragraph and select your subscription's name. Adjacent, go to the menu on the left side of the folio and select Access control (IAM) > Part assignments and look for the Owners section in the table.

  5. If you come across a page titled Annals to get a Multiple Activation Key, that means y'all need to request access to the preview before you can use Extended Security Updates. If you don't run into this page, skip alee to step half dozen.

    To request access, select join the preview. An email message window will open. This email is your access asking to the Microsoft team.

    Include the post-obit data in your request:

    • Customer proper noun
    • Azure subscription ID
    • Agreement number (for ESU)
    • Number of ESU servers

    When you're washed, ship the email.

    The team volition review the information you provide in your request email. If everything looks okay, they'll add you to the approved listing.

    If the squad doesn't approve your request, you lot'll run into the following error:

                      The resource type could not be constitute in the namespace 'Microsoft.WindowsESU'

  6. Under Azure details, select your Azure subscription, a resource group, and location for your key.

    Nether Registration details, enter the following information:

    Setting Value
    Key proper noun A display proper noun for your central, such Agreement01.
    Agreement number Your agreement number generated by the book licensing contract management organization, or MSLicense for Enterprise Agreement programs.
    Number of computers Choose the number of computers on which you lot want to install Extended Security Updates with this key.
    Operating system Cull the operating organization to use this key with, such as Windows Server 2008 R2.

    When ready, select Review + register.

    Annotation

    Brand sure y'all've selected the Azure subscription that you joined the preview with in your global filter. Select the Filter button in the Azure Portal ribbon to check your global subscription filter.

    An image of the Azure Portal ribbon with the Filter button selected

  7. Later on successful validation, a summary of your choices for the new registry resource is shown. If needed, correct any validation errors or update your configuration choices. The Azure Terms of Utilise and Privacy Policy are available.

    Check the box to confirm that you lot have eligible computers and the primal is only to be used within your organization:

    Confirm that the key will only be used by your organization

    When prepare, select Create to generate the Multiple Activation Key.

Extended Security Updates registration is now available for employ with your servers. The key created should exist applied to Windows Server 2008 and 2008 R2 servers that you wish to remain eligible for security updates.

Admission your Multiple Activation Central from the Microsoft Volume Licensing Service Center

After you've successfully registered and generated your Multiple Activation Key, you can besides can use the Volume Licensing Service Center to view and download your key.

To get your key from the Volume Licensing Service Centre:

  1. Get to the Book Licensing Service Middle page and sign in with your Azure credentials.

  2. Select Licenses > Human relationship Summary > Licensing ID > Product Keys.

Download and utilise Extended Security Updates

Delivery, download, and application of Extended Security Updates for Windows Server is no different than other Windows Updates. The updates provided through Extended Security Updates are only Security updates.

You lot can install the updates using whatsoever tools and processes you already have in place. The simply difference is that the system must be registered using the fundamental generated in the previous section for the updates to download and install.

For VMs hosted in Azure, the process of enabling the server for Extended Security Updates is automatically completed for y'all. Updates should download and install without additional configuration.

To learn more than about how to go Extended Security Updates for eligible Windows devices, see our Tech Community blog mail Obtaining Extended Security Updates for eligible Windows devices.