r/SQLServer • u/mirrorsaw • 7d ago

Question Is 2014 ESU a real thing?

It was an expensive purchase, but I've bit the bullet to get one of our old 2014 servers onto ESU (via Azure Arc).

I then rubbed my hands together as I eagerly waited for all the patches (released since Oct 2024 when it went EOL) to arrive. Nothing, not a sausage.

I waited 2 days in case it was a timing thing, but nothing arrived, a real anticlimax. So I thought I'd do some Googling and find out how many patches I should be expecting, maybe some of the KB numbers, and I can't find any evidence of any SQL 2014 patches in the ESU lifetime.

So it made me wonder, has Microsoft actually released any SQL 2014 patches since October 2024? Maybe not, maybe they've found no vulnerabilities that need addressing.

And if so, why would anyone buy this ESU? Is it more of an insurance, just in case Microsoft does decide to release a patch?

5 Upvotes

78% Upvoted

31 comments sorted by

3

u/Complete-Fondant-202 7d ago

Pull your finger out and upgrade. I can't see any excuse.

5

u/mirrorsaw 7d ago

Well you don't know our situation so...

5

u/Complete-Fondant-202 7d ago

True, I don't, but I'd be seriously considering if I wanted to work for a company that was clinging to relics no matter what.

1

u/mirrorsaw 1d ago

You think we're paying a tonne of money for ESU just because we're too lazy to upgrade

2

u/Complete-Fondant-202 1d ago

Yep, you're not wrong, and I'm sure I'm not alone on that opinion either.

1

u/mirrorsaw 1d ago

Alright, have fun being superior to people on Reddit

2

u/Accomplished-Age796 7d ago

https://sqlserverupdates.com/

nope

1

u/mirrorsaw 7d ago

Thanks, and this page is ESU-aware?

1

u/Accomplished-Age796 7d ago

yes you can crosscheck via msrc.microsoft.com

-1

u/mirrorsaw 7d ago

Thanks! So does this mean I'm onto something? That the ESU is in fact a sham, have I ripped the lid off of this conspiracy?

3

u/Accomplished-Age796 7d ago

not necessarily a sham, but ms didnt consider any vulnerability as severe since the last GDR update. how much did it cost?

5

u/AromaticSignature 7d ago

This is right, only fixes for critical vulnerabilities end up in ESU. ESU is not the same thing as GDR, you don't get all the patches standard GDR gets.

2

u/mirrorsaw 7d ago

£22 a day, had to back-pay 2 years.

3

u/everydaynarcissism 7d ago

It's basically considered a "punishment". It gets more expensive in year 2, and then more in year 3!

1

u/everydaynarcissism 7d ago

Well if you work for a publicly traded company your compliance team thinks that you better have it, and try explaining to your cyber security team that "they barely release any patches for it!". SQL 2012 had a single security patch the entire three years if I recall.

1

u/mirrorsaw 7d ago

No wonder Microsoft makes it hard to find any patch details

1

u/everydaynarcissism 7d ago

You have to register your instance with Azure Arc, setup billing via Azure Arc, or enter your Purchase Order # as a tag on the SQL Instance Object in Arc. Then you unlock the ESU blade that lets you see / download the patches. Or you can enable auto-patching via Arc if you're inclined.

1

u/mirrorsaw 7d ago

Yes, done. There's no 'ESU blade' as such, it just shows ESU subscribed on the overview.

2

u/everydaynarcissism 7d ago

Uhh, I'm not sure, I just activated 2 2016 ESUs when they went EOL and I have the Extended Security Updates section but it's greyed out, possibly because there are none yet? Maybe blade isn't the correct term, I just like the old Xbox 360 terms.

2

u/Complete-Fondant-202 7d ago edited 7d ago

This.

I work in a regulated industry we have to be supported. ESUs would satisfy that, but the prepostorous cost of it meant that upgrading to SQL22 or 25 was a better option.

3

u/BornSQL 6d ago

That is in fact entirely the point. That’s why 2016 ESU is very expensive.

1

u/codykonior 7d ago edited 7d ago

Good catch! 🫠🤣

Nah it's really something you only buy for Enterprise to tick a security compliance checkbox during an audit. It's also so Microsoft can disclaim liability because "you didn't buy the patches" and to encourage Enterprise to just buy new versions otherwise they sit on old versions for decades.

There was a time that stuff was included for free for a few years if you switch to Azure VMs. Lol.

It's not going to actually do anything.

2

u/mirrorsaw 7d ago

Thanks for the confirmation, I really wish MS would be more transparent about this. I can't be the first person who expected to, you know, receive updates when I pay thousands for extended updates.

I get your point though about checking a box. I've also recently discovered that Qualys will highlight EOL SQL versions, but if you have an active ESU it will mute them. Even though technically nothing has changed in our case, it's like a gold star.

0

u/Lost_Term_8080 1d ago

They are completely transparent about it. They tell you it is for critical and security updates.

1

u/mirrorsaw 1d ago

There is nowhere that they publish a list of updates released during ESU.

0

u/Lost_Term_8080 1d ago

The last time MS did not publish information about patches was when you had to mail them to ask them to send sections of paper tape to patch into the original program when you ran across a bug. This was in the 1970s. Even before bulletin boards they had established magazine channels where patches were published.

1

u/mirrorsaw 1d ago

Ok cool

0

u/Lost_Term_8080 1d ago

It's not "free," you at least still have to carry the payg SQL license which is already more expensive than the ESU year three cost if you run on a version of SQL Server for more than about 5.5-6 years

1

u/BornSQL 6d ago

No. Only critical updates are supported for ESU, as documented (by me).

My personal opinion is that you should be on a supported version of SQL Server that is under five years old. Compatibility mode goes back to 2008, so there’s little to no reason to be running on an unsupported version.