Product overview

The ESU program provides updates for Microsoft Security Response Center (MSRC) “important” and “critical” security issues.

The End of Support (EOS) date for Windows 7 Embedded and Windows Server 2008 was January 14, 2020. Windows Embedded Standard 7 (WES7) hit EOS on October 13, 2020.

Benefits of the ESU Program

Don't leave unsupported systems at risk.

Security updates

Up to three years of additional support and security updates for eligible embedded operating systems, including Standard 7, POS Ready 7, 8 Standard, and 8.1 industry.

Extended lifecycle

Extend the lifecycle of your Windows installation with additional time to plan migration to a supported platform.

Compliance requirements

Maintain regulatory and industry compliance by ensuring you're using software that is supported and secure.

We can help

Let the experts at Kontron:

  • Provide in-depth information on the ESU Program
  • Walk you through the enrollment process
  • Offer technical guidance and utilities to streamline the installation processes required for the ESU Program

Components of the ESU Program

The ESU consists of 3 components, listed below. After these components are installed, monthly ESU Security Updates can be applied to devices.

ESU Licensing Update

Expand the key range of the original product key so that the ESU Key can be installed on a device.


A pre-activated key that allows a device to receive ESU Security Updates.

ESU Servicing Stack Update

The Servicing Stack Update (SSU) is a special update that enables a device to receive ESU Security Updates

Frequently Asked Questions

What is the difference between EOS and EOL?

EOS (End of Support) means Microsoft will no longer release regular feature or security updates for the product. EOL (End of Life) means an OEM may no longer purchase or ship devices with this product.

What happens to the operating system and devices in market if I do not buy ESU?

Windows will continue to function. Devices will continue functioning but will be subject to new security risks since Microsoft security updates will not be available to protect the devices.

What are the ESU Program requirements?

OEMs must have the following agreements: Microsoft Business & Services Agreement (MBSA), Customer Licensing Agreement (CLA), Ecosystem Partner Services Offering (EPSO) Service Terms (ST), EPSO Fee Schedule (FS), EPSO-ESU Service Terms Schedule. Kontron will help facilitate the agreement process in conjunction with Microsoft.

What is included in the ESU Program?

Microsoft MSRC “Important” and “critical” security updates and bulletins along with support to resolve issues related to ESU deployment and updates.

How do I purchase or sign up for ESU Program?

Contact Kontron.

Contact Us
How are updates deployed?

After the three ESU components are installed on the device, the monthly ESU Security Updates can be installed with your current update process.

How long is the ESU valid?

The ESU Keys are valid for one year and ESU Program runs for three years post EOS date.

My customer devices are not connected to the Internet. How can I activate the keys?

The ESU activation keys do not require a connection to the internet.

Will a new key need to be installed on every device?

Yes, this is a requirement of the program to support ESU updates.

What is an EPSO and is it required?

The Ecosystem Partner Service Offering (EPSO) is a support agreement with Microsoft that can be applied to updates with this program or other support needs. An EPSO is required to participate into the program.