Windows 2003 End Of-life Extended Support

[Mohammed Huberty]

TheExtended Security Update (ESU) program is a last resort option for customers who need to run certain legacy Microsoft products past the end of support. They are not intended as a long-term solution, but rather as a temporary bridge to stay secure while one migrates to a newer, supported platform. It includes Critical* and/or Important* security updates up to three years after the product's End of Extended Support date.

* Extended Security Updates for select Embedded products are available via OEMs. All others are available via volume licensing.

** One additional year of ESU is available for Windows Server and SQL Server 2008 and 2008 R2 only on Azure.

General technical support and troubleshooting assistance is not available for products that have reached the end of lifecycle (the end of extended support date shown in the table above). The purchase or usage of ESUs does not change the associated products support lifecycle.

On Azure: Extended Security Updates are free for VMs in Azure. These include destinations such as Azure Virtual Machines (VMs), Dedicated Host, Azure VMware Solution, Nutanix Cloud Clusters on Azure, and the Azure Stack portfolio. Eligible customers can use the Azure Hybrid Benefit (available to customers with active Software Assurance or Server Subscriptions) to obtain discounts on the license of Azure Virtual Machines (IaaS) or Azure SQL Database Managed Instance (PaaS).

On-premises/hybrid environments: Extended Security Updates are available through specific volume licensing programs or through Azure Arc-enabled servers for Windows Server and SQL Server. Contact your Microsoft partner or account team to learn more. ESUs for select Embedded products are available via your embedded device manufacturer. For ESUs available through the Dynamics 365 Cloud Migration offer, customers can purchase via the Cloud Service Provider (CSP) licensing program.

On Azure: Applicable virtual machines (VMs) hosted in Azure are automatically enabled for ESUs if the VM is configured to receive updates, and these updates are provided free of charge.

On-premises/hybrid: Customers can install ESUs by accessing their multiple activation keys through the M365 Admin Center portal or directly installing ESUs through Azure Arc-enabled servers. Learn more about the installation details here for Windows Server and here for SQL Server installation.

You can acquire ESU licenses either directly from Microsoft or from your partner such as an EA Reseller or CSP partner (eligible to sell ESUs as of Oct. 1, 2023 for both types of ESUs mentioned above).

You can apply ESU enabled by Azure Arc and ESU licenses (SKUs) to any properly licensed server or operating system, whether it's deployed on-premises or on non-Azure clouds (including hosters). If you're running your OS in another cloud, make sure to adhere to the respective outsourcing or License Mobility policies for the underlying software.

For ESUs enabled by Azure Arc, you can select either licensing option, irrespective of how the underlying server or operating system is licensed. You can also mix between pCore and vCore licensing for your VMs. Make sure you follow the allowed virtualization entitlements for your underlying software.

For customers who enroll in ESUs enabled by Azure Arc after the end of support dates (July 11, 2023 for SQL Server 2012 Year 2 and October 10, 2023 for Windows Server 2012/R2), they will be billed a one-time upfront charge for the months they missed after the end of support date, with billing coming in at the end of the month. For example, if a customer enrolls in January 2024, they will receive a one-time back-bill for October, November, and December 2023 during their first month.

With ESU enabled by Azure Arc, you can link paid ESU coverage to your eligible Disaster Recovery Benefit servers without incurring additional cost. Make sure you follow the underlying Disaster Recovery Benefit policy for your software.

Extended Security Updates licenses (SKUs) obtained through Commercial Licensing are valid for annual coverage periods, such as Year 1 ESU, Year 2 ESU, and Year 3 ESU. Each ESU license entitles the specific server or operating system to receive security updates for the duration defined by that SKU (not by calendar year). For a comprehensive list of coverage periods, please reference the table at the top of this page.

You may only acquire ESU Year 2 and Year 3 licenses if you've also acquired the ESU license(s) for the prior year(s). For example, before you acquire the ESU Year 2 license, you must also acquire ESU Year 1.

ESU licenses correspond to the number of underlying core licenses of your server or operating system. You can license Windows Server and SQL Server based on either physical cores (pCores) or virtual cores (vCores). With ESUs sold through Commercial Licensing, the licenses must align with how you've licensed the underlying Windows Server or SQL Server.

In summary, when licensing with Commercial Licensing ESUs (SKUs), the number of ESU core licenses must align with how you've licensed the underlying Windows Server or SQL Server. Also, with the Commercial Licensing ESUs, you must ensure that the ESU edition matches the edition of your underlying software. For instance, if you have Windows Server Datacenter on your VM, you should acquire ESU Datacenter edition if you want to license at the vCore level.

The majority of WS 2012 licenses were sold on a per Processor or per Core basis (not on a per VM basis). For purposes of ESU core calculation, assume each 2 Processor license (the minimum per server) is equivalent to 16 pCores.

With ESU (SKUs) through Commercial Licensing, you can also cover your eligible Disaster Recovery Benefit servers without acquiring additional licenses. Make sure you follow the underlying Disaster Recovery Benefit policy for your software.

Customers who migrate workloads to Azure will have access to ESUs for SQL Server 2012, and Windows Server 2012 and 2012 R2 for three years after the End of Support dates for no additional charge above the cost of running the virtual machine. This currently includes Azure destinations such as Azure virtual machines (VMs), Dedicated Host, Azure VMware Solution, Nutanix Cloud Clusters on Azure, and Azure Stack portfolio.

Free ESUs will be available for customers on Azure, which includes workloads running on Azure Virtual Machines, Azure Dedicated Host, Azure VMWare Solutions, Nutanix Cloud Clusters on Azure, and Azure Stack Hub/Edge/HCI.

For Windows Server 2012/2012 R2: ESUs include provision of Security Updates and "Security Update Severity Rating System" rated "critical" and "important," for a maximum of three years after end of support.

ESUs will be distributed if and when available. ESUs do not include new features, customer-requested non-security hotfixes, or design change requests. However, Microsoft may include non-security fixes as deemed necessary.

For end of support events in the past, SQL Server provided only Critical Security Updates, which meets the compliance criteria of our enterprise customers. SQL Server does not ship a general monthly security update. Microsoft only provides on-demand SQL Server security updates (GDRs) for MSRC "Security Update Guide" here SQL Server is identified as an affected product.

If there are situations where new SQL Server important updates will not be provided and it is deemed critical by the customer but not by MSRC, we will work with the customer on a case-to-case basis to suggest appropriate mitigation.

Cloud Solution Provider (CSP) partners will be able to offer ESUs for end of support versions of Windows Server and SQL Server. Customers will then have the right to use licenses covered by ESUs on deployments on-prem or within outsourced environments running on authorized hosts. Customers may also apply ESU licenses to "license-included" workloads acquired from SPLA partners or CSP-Hosts.

No. Customers cannot buy ESUs for SQL Server Express or Developer edition. However, they can move their workloads to Azure and get the ESUs for no additional charges above the cost of using the Azure subscription. Also, customers who have ESUs for SQL Server production workloads are permitted to apply updates to their servers running SQL Server Developer edition solely for development and test purposes.

Yes, customers must have active Software Assurance (or equivalent Subscription Licenses) for CALs and External Connector Licenses permitting access to Servers with active ESU coverage. However, ESU coverage is neither required nor available for CALs or External Connector Licenses.

For customers who do not have Software Assurance, the alternative option to get access to ESUs is to migrate to Azure. For variable workloads, we recommend that customers migrate on Azure via Pay-As-You-Go, which allows for scaling up or down at any time. For predictable workloads, we recommend that customers migrate to Azure via Server Subscription and Reserved Instances.

Customers who need to stay on-premises can purchase ESUs when they have an active Server Subscription via EAS, EES, CSP, or Licenses through an EA or SCE in addition to Software Assurance through those programs. Alternatively, customers can use Software Assurance through Open, Select, or MPSA agreements in addition to product licenses through an EA, EAS, SCE, EES, or Subscription through CSP. Licenses and Software Assurance do not need to be on the same agreement.

There is no deadline for migration of the Windows Server 2012/R2 or SQL Server 2012 workloads to Azure. However, we recommend customers complete migration before the end of support date so that they do not miss any ESUs. If customers miss a year of ESUs coverage, they may buy coverage for previous years at the same time they buy coverage for a current period.

Customers who purchase ESUs for production servers may also apply those security updates to servers licensed under Visual Studio (MSDN) subscriptions at no additional cost. There is no limit to the number of MSDN servers a customer can cover. If they purchase ESUs for a production server, those updates can be applied to any number of MSDN servers.

3a8082e126