Understand Extended Security Updates
Extended Security Updates (ESUs) for Windows Server include security updates and bulletins rated critical and important for a maximum period of time from the end of extended support, depending on the version of Windows Server. ESUs are available free of charge for servers hosted in Azure, and available to purchase for servers not hosted in Azure. ESUs don't include new features, customer-requested non-security hotfixes, or design change requests.
The Extended Security Update (ESU) program is a last resort option for customers who need to run certain legacy Microsoft products past the end of support. Windows Server Long Term Servicing Channel (LTSC) has a minimum of 10 years of support: five years for mainstream support and five years for extended support, which includes regular security updates.
When you get the Extended Security Updates depends on which version of Windows Server you're using and where it's hosted. The following table lists the Extended Security Update duration for each version of Windows Server that currently provides support for ESUs. Versions of Windows Server that are still within mainstream and extended support, such as Windows Server 2016, do not require ESUs.
| Product version | Hosting location | ESU duration | ESU end date |
|---|---|---|---|
| Windows Server 2008 & Windows Server 2008 R2 | Azure / Azure Stack HCI | Four years | January 9, 2024 |
| Windows Server 2008 & Windows Server 2008 R2 | Outside Azure | Three years | January 10, 2023 |
| Windows Server 2012 & Windows Server 2012 R2 | Azure / Azure Stack HCI | Three years | October 13, 2026 |
| Windows Server 2012 & Windows Server 2012 R2 | Outside Azure | Three years | October 13, 2026 |
After the period of Extended Security Updates ends, Microsoft will stop providing updates. One of the aims of the ESU program is to get customers to migrate workloads to a newer version of Windows Server rather than to stay on older editions in perpetuity.