Windows 7 Extended Security Updates (ESU)

[Tobi]

Habt ihr die Möglichkeit für Windows7, in wsusoffline, ESU anzubieten und vor allem wollt ihr es anbieten?
Mir ist bewusst, dass der Support für Windows7 offiziell ausgelaufen ist.
Für Firmen gibt es aber die Möglichkeit im Rahmen einer ESU-Lizenz weiterhin Updates zu beziehen.
Also müsste es doch auch möglich sein diese in wsusoffline zu integrieren?!

[Dalai]

Da diese Updates mit Sicherheit nicht im von WSUS Offline verwendeten Katalog (wsusscn2.cab) enthalten sind (denn dann stünden sie auch allen Nutzer des WSUS (von Microsoft) zur Verfügung), müssten diese alle manuell eingepflegt werden. Wer sich diese Arbeit machen will, kann gern die entsprechenden Listendateien in static\custom und ggf. client\static\custom benutzen. Ich halte es für sehr unwahrscheinlich, dass diese Listen offiziell seitens der WSUS Offline Maintainer gepflegt werden, denn der Witz an WSUS Offline war ja immer, dass niemand manuell Updates einpflegen müssen soll - auch wenn es davon gerade in Bezug auf Prerequisite Updates und Servicing Stack Updates Ausnahmen gab/gibt.

Grüße
Dalai

[boco]

Es ist durchaus möglich, daß diese Updates im Katalog wsusscn2.cab angeboten werden, wie auch auf Windows Update selbst. Nach momentanem Stand erfolgt die ESU-Prüfung nur bei der Updateinstallation.

Genaues weiß man aber erst am Februar-Patchday.

[negg]

Windows 7 broke in the last update and they have had to extend the EOL a few days and send out another patch to fix things is this going to be included in wsus ??????

[boco]

They didn't extend EOL, this is an out-of-band patch. Originally intended for ESU, they had to backtrack and will release it for everyone. In what shape and form, nobody knows, yet.

If they include it in the wsusscn2.cab catalog as a security update, WOU will pick it up. Not likely to happen, it is a pure quality update (however, they might surprise us and make the whole February CU available). It can be included as a static definition, then.

[Dalai]

Procedure to continue receiving security updates after extended support ends on January 14, 2020:

Note: After you successfully complete this procedure, you can continue to download the monthly updates via the usual channels of Windows Update, WSUS and Microsoft Update Catalog. You can continue to deploy the updates using your preferred update management solution.

February 11, 2020—KB4537803 (Security-only update):

IMPORTANT WSUS scan cab files will continue to be available for Windows 7 SP1 and Windows Server 2008 R2 SP1.

Sieht also so aus, als könne man auch mit WSUS Offline die ESU Updates ganz normal beziehen/runterladen. Die Installation der Updates dürfte funktionieren, wenn man das Extended Security Updates (ESU) Licensing Preparation Package (KB4538483 bzw. KB4538484) installiert hat und einen ESU MAK add-on key aktiviert hat.

Grüße
Dalai

[boco]

Kann bestätigen, daß ohne MAK nichts angezeigt wird. Manuell im Katalog herunterladen geht aber.

[boco]

Sorry to switch to English,

As noted by the links posted by @dali, the ESU updates are pushed thru wsusscn2.cab & are available thru the usual channels. Without KB4538483/4 installed & the ESU licence activated, WU will not "see" them for download / installation.

A illegal ESU bypass hack has been developed and can be found using the link below. It does not enable downloading updates thru WU, it only tells the OS that it's OK to install the ESU updates. Updates still have to be manually downloaded. So far the bypass appears to be functioning reasonably well and it does permit the install of the February update release.

As for March? Development appears to be ongoing so only time will tell.

URL removed!

This makes it possible to put them on the offline updater as custom files. But they would likely not install without the ESU bypass hack pre-installed.

[epguy9]

A illegal ESU bypass hack has been developed and can be found using the link below. It does not enable downloading updates thru WU, it only tells the OS that it's OK to install the ESU updates. Updates still have to be manually downloaded. So far the bypass appears to be functioning reasonably well and it does permit the install of the February update release.

As for March? Development appears to be ongoing so only time will tell.

and that "bypass" seems to be working in March

Before the Feb 2020 KB4537803 & KB4537820 ESU-based updates came out, MS did release the KB4539601 & KB4539602 updates on Fri. Feb. 7 (the last out-of-band Win7 updates before the ESU requirements)
I don't know if WSUS offline updater actually offered either KB4539601 or KB4539602 as I didn't test back then

[aker]

As this topic is not meant for discussing this bypass, I‘ll close it now.