Windows 7: Preparing for ESU and license activation – Part 2

[German]In Part 1 of this series of articles, I outlined how customers can purchase and manage a Windows 7 SP1 Extended Security Updates (ESU) license. In part 2 I'll show you how to prepare Windows 7 SP1 to activate the Extended Security Updates (ESU) license. Only if these steps are completed successfully will there be security updates beyond the announced support end date of January 14, 2010.

Preparations for ESU activation

Once you've booked an ESU package and received the required license key, you'll need to update your Windows 7 SP1 system to the required level (see the blog post Windows 7 Extended Security Updates (ESU) requirements). To do this, make sure that the following updates are installed on the machine.

• KB4490628: Servicing Stack Update (SSU) for Windows 7 SP1 and Windows Server 2008 R2 SP1: March 12, 2019
• KB4474419: Update for SHA-2 code signing support for Windows Server 2008 R2, Windows 7 and Windows Server 2008: September 23, 2019
• KB4516655: Servicing Stack Update (SSU) for Windows 7 SP1 and Windows Server 2008 R2 SP1: September 10, 2019
• KB4519976: (monthly rollup) from October 8, 2019

The first three updates should be available on every machine that is fully patched. The Monthly Rollup Update KB4519976 from October 2019 might be more difficult. Some administrators have only installed the security-only updates to keep telemetry out of their machines. Here you will have to bite the bullet and install the rollup updates.

Before installing the Monthly Rollup Update KB4519976, it is recommended to create a backup to be able to read it back if problems occur.

Check if the updates are installed

If you want to verify that the above updates are installed on your Windows 7 SP1 machine, check the update history in control panel. You can try also these steps:

1. Type cmd into the Start menu's search box, and then launch the command cmd.exe shown as a hit by using the Run as administrator context menu command.

2. Confirm the User Account Control prompt, and then enter the following command in the administrative command prompt window.

wmic qfe list full /format:htable >C:\updates.htm

Then you can navigate within an explorer windows to drive C:\, where you should find the file updates.htm. A double click opens the HML file in the browser (see the following figure) and you can easily search the table for the above KB numbers for the required updates.

(Installed Windows 7 Updates)

Attention: A German blog reader send me a feedback, that when installing the update rollups only the last installed package appears in the above list. The update KB4519976 would not appear if the rollups from later months were installed. In addition, the installation of update KB4519976 would then be rejected with the crude error that the package is not suitable. Then check the update history in the control panel, if update KB4519976 is installed.

Installation and activation of the Windows 7 ESU license

Once the above steps are complete, you will need to install and activate the ESU license. Microsoft has described the required steps in the Techcommunity article How to get Extended Security Updates for eligible Windows devices. First, you will need the ESU key assigned to you by the CSP partner.

1. If necessary, type cmd in the search box on the Start menu and use the Run as administrator context menu command to start the cmd.exe command prompt and confirm the user account control prompt.

2. Enter the following instructions into the administrative command prompt window.

To enter the ESU key in Windows 7 SP1, use the following command, where <ESU key> is the placeholder for the ESU license that you received from the CSP partner.

slmgr /ipk <ESU key>

If the ESU license key is successfully installed, this should be displayed in a dialog box. The following figure shows the command prompt window and the confirmation message.

This step worked here on a Windows 7 SP1 Ultimate without any problems. The key was successfully installed. In a further step the ESU license key need to be activated. To do this, enter the following instruction in the still open window of the administrative command prompt.

slmgr /dlv

The command then uses the Windows Software Licensing Service to request the Activation ID (see the following figure). The Windows Script Host window specifies the year and versions of Windows for which the ESU license can be used.

You need the Activation ID that appears in the dialog box, as this is now to be entered within the following command instead of the placeholder <ESU Activation ID> in the command prompt.

slmgr /ato <ESU Activation ID>

If everything goes smoothly and no error occurred while entering the ID, a corresponding message should appear (see following picture).

Windows 7 SP1 is now ready to receive the enhanced security updates in the appropriate SKU.

Note: In the screenshots above I have partially pixelated the <ESU Activation ID> in question, also because the whole thing here in the article is an example and the ID changes every year.

Tip: Typing in the corresponding <ESU Activation ID> from the dialog box is error-prone. But there are two approaches to save typing.

One is to press the key combination Ctrl+C while the dialog box is open and selected. Then open the Windows editor Notpad and insert the contents of the dialog box from the Windows clipboard into the editor window using key combination Ctrl+v. Then the <ESU Activation ID> can be selected in the editor window and copied with Ctrl+C  to the Windows clipboard.

But there is a second approach. Microsoft has specified the Activation IDs directly for Windows clients:

Year 1: 77db037b-95c3-48d7-a3ab-a9c6d41093e0
Year 2: 0e00c25d-8795-4fb7-9572-3803d91b6880
Year 3: 4220f546-f522-46df-8202-4d07afd26454

So you can select the activation ID from the above text with the mouse and then copy it to the Windows clipboard with Ctrl + C.

Switch to the command prompt window, type slmgr /ato followed by a space. Then select Edit – Paste from the system menu of the Command Prompt window. Once the complete command is on the line, press Enter – and then you are done.

If you have a Windows 7 machine that does not have Internet access, Microsoft provides instructions in this article for activating the ESU key. Part 3 presents one way of automating MAK-ESU activation in corporate environments. In part 4 I will deal with further questions and follow-up work on the subject of ESU.

Addendum: People who need to activate many machines can use the batch program from here for activation. The ActivationID is always the same (see above).as Batch-Programm von hier zur Aktivierung verwenden. Die ActivationID ist immer gleich (siehe oben).

Article series
Windows 7: Buy and manage ESU licenses – Part 1
Windows 7: Preparing for ESU and license activation – Part 2
Windows 7: ESU Activation inEnterprise Environment – Part 3
Windows 7: ESU questions and more answers – Part 4

Similar articles
Wow! Windows 7 get extended support until January 2023
Windows 7 Extended Security Updates buyable from April 2019
Microsoft offers Windows 7 Extended Update Support to SMBs
Prices for Windows 7 Extended Security Updates till 2023
Windows 7: Free Extended Update Support and usage
Windows 7: Office 365 ProPlus Updates till 2023
Windows 7 Extended Security Updates (ESU) requirements
Windows 7 Extended Security Update (ESU) program available
Windows 7 Extended Security Updates (ESU) program, price and source for SMEs