Citrix Provisioning Services and Microsoft Extended Security Update programs
Article ID: CTX695382
Updated On:
Description
The Microsoft Extended Security Update (ESU) program is for Microsoft customers who need to run certain Microsoft Operating Systems past the end of support.
The ESU program includes security updates up to three years after the product's End of Extended Support date.
To use Extended Security Updates outside of Azure, customers obtain a Multiple Activation Key (MAK) from Microsoft and apply it to the relevant machines running Operating Systems past end of support.
This MAK key when activated lets the Windows Update servers know that these machines can continue to receive security updates.
Environment
Citrix is not responsible for and does not endorse or accept any responsibility for the contents or your use of these third party Web sites. Citrix is providing these links to you only as a convenience, and the inclusion of any link does not imply endorsement by Citrix of the linked Web site. It is your responsibility to take precautions to ensure that whatever Web site you use is free of viruses or other harmful items.
Cause
There is no inbuilt functionality in Citrix Provisioning Services for handling Microsoft ESU MAK activation in PVS target devices.
Resolution
Customers should engage Microsoft for guidance on using and activating Microsoft MAK ESU with non-persistent windows machines.
Issue/Introduction
There is no inbuilt functionality in Citrix Provisioning Services for handling Microsoft ESU MAK activation in PVS target devices.
Additional Information
Administrators should note when deploying non persistent windows machines with a MAK ESU installed, as each boot of each machine may use up one of the allocated ESU MAK activations.
Blocking automatic activation of MAK ESU and using VAMT proxy offline activation may be one approach:
https://learn.microsoft.com/en-us/windows/deployment/volume-activation/scenario-proxy-activation-vamt
Confirmation IDs may need to be stored and reapplied to each non persistent VM after each boot.
Microsoft VAMT PowerShell commands documentation:
https://learn.microsoft.com/en-us/powershell/module/vamt/?view=windowsserver2025-ps
