Microsoft no longer offers Windows 7 drivers via Windows Update

Microsoft says it no longer offers drivers for Windows 7 and Windows Server 2008 systems through Windows Update starting today.

The move comes after the expiration of the SHA-1 Trusted Root Certificate Authority for Windows 7 and Windows Server 2008 on May 9, 2021.

Despite SHA-1 certificates' discontinuation, partners using Microsoft's Trusted Root Program could still publish incompatible SHA-2 signed drivers to unpatched Windows 7 and Windows Server systems causing degraded functionality or preventing devices from booting.

Systems experience these issues because of code integrity failures triggered by incompatible SHA-2 signed drivers.

The change was made to minimize the impact of these issues and the disruptions customers using these Windows versions are experiencing.

"On June 17, 2021, Microsoft will discontinue the publication of drivers to Windows Update for Windows 7 SP1, Windows Server 2008, and Windows Server 2008 R2," said Naim Mohammad, Technical Program Manager at Microsoft.

Signed drivers still available for ESU customers

However, signed drivers will still be provided for Volume Licensing customers in an Extended Security Update (ESU) program to ensure optimal driver reliability.

"If your organization utilizes the Extended Security Updates (ESU) program, you will continue to have the ability to deploy drivers to your managed devices using Windows Server Update Services (WSUS_ and other supported methods," Mohammad added.

Submissions for Windows 7 and Windows Server drivers for the Windows Hardware Compatibility Program (WHCP) will still be available until January 2023.

Starting today, Microsoft partners are required to go through the following steps the process below to sign drivers for Windows 7, Windows Server 2008, and Windows Server 2008 R2 through the Partner Center for Windows Hardware:

1. Remove existing signatures from driver binaries.
2. Generate new catalog files using INF2CAT.
3. Sign the security catalog files using the IHV/OEM certificate registered with the Partner Center for Windows Hardware.
4. Add the driver to your HCK file.
5. Sign the HCK file using the IHV/OEM certificate registered with the Partner Center for Windows Hardware.
6. Submit the driver package to the Partner Center for Windows Hardware for signing.
7. Download the signed driver bundle from the Partner Center for Windows Hardware.

"To test and certify hardware devices for Windows, we recommend that you utilize the Windows Hardware Certification Kit (Windows HCK) and follow the updated driver signing process for Windows 7, Windows Server 2008 and Windows Server 2008 R2 when submitting a driver package for signing via the Partner Center for Windows Hardware," Mohammad said.

Microsoft removed all Windows downloads signed with SHA-1 certificates from the Microsoft Download Center on August 3rd, 2020.

Because of SHA-1 certificate issues, Microsoft required customers running legacy OS versions to add SHA-2 code signing support to their devices to install Windows updates released on or after July 2019.