Windows 7 is no longer officially supported. While ongoing private patches are still available here, the OS itself is now over a decade old, and is far behind on security and performance improvements, especially for modern hardware. Now that even minimal support has ended for most people, software and driver compatibility should drop off sharply. It's worth considering a switch to newer versions of Windows or Linux if possible.
= Downloading Windows 7 =
If you don't need a specific edition, go with Enterprise:
SHA-1 checksum: a491f985dccfb5863f31b728dddbedb2ff4df8d1
All versions available at: https://the-eye.eu/public/MSDN/Windows%207/
Other Sources: https://www.raymond.cc/blog/links-for-windows-7-sp1-iso-from-microsofts-official-distributer/2/
Be sure to check verify the file's checksum to make sure the ISO you get is intact and has not been tampered with:
http://www.7-zip.org/ (via the Windows context menu)
= Installing on Newer Hardware =
Modern PCs (anything since 2015) usually need additional drivers to install Windows 7. Otherwise you'll get stuck on an error message, your mouse/keyboard won't work, or the installer just won't boot. The MSI Smart Tool is updated with drivers that work on many AMD and Intel systems, so making a Windows 7 flashdrive with it is often the easiest way to go:
Many other motherboard makers also provide tools to let you easily create patched installers from a regular Windows 7 ISO. You can find them on the download page for your board's brand/model, or try a different brand's tool if that doesn't work. There are some differences between boards (especially AMD vs Intel), and most tools try to cover a range of hardware. After setting up your flashdrive, install Windows as usual.
Alternate Method 1:
Some boards also have a BIOS option to help get you up and running. This may go by several names, like 'Windows 7 USB Support', 'Legacy USB', 'Disable xHCI' etc. If it works, complete your Windows install, make sure USB 3 drivers are installed through Windows Update or your motherboard's website, then switch the option back off in BIOS.
Alternate Method 2:
If you have an oldschool PS2 style mouse/keyboard, you can try using that to get through the setup menus instead, or try connecting through USB 2.0 ports on a Ryzen board. Intel boards may also require you to boot from a Windows 7 DVD instead of a flash drive.
Other Patching tools:
Windows USB Installation Tool (Intel)
Windows Image Tool (AMD)
Win 7 USB Patcher
= Activating Windows 7 =
There are 2 choices for activating Windows 7:
KMS_VL_ALL activates Windows 7 Pro and Enterprise editions only, by installing an ongoing KMS program to run periodically and re-register the OS, which must be excluded from any antiviruses to continue working.
Disable your AV, extract with password (2020) and archiver from 7-zip.org, then run "KMS_VL_ALL_AIO.cmd" and select:  Install Activation AutoRenewal
Daz's Windows Loader:
Daz's Windows Loader works on all versions of Windows 7, and requires no running software for permanent activation, but does require you to set your BIOS to Legacy Mode before installing Windows.
SHA-1 checksum (for exe): 0efc35935957c25193bbe9a83ab6caa25a487ada
= Fixing Updates =
Most people will want to use Windows Update, which still gives you everything up through January 2020 automatically. Installing these first will get the updater working quickly, and is necessary to get the new Extended Support Updates (ESU) still being released:
Latest Windows 7 Servicing Stack Update: https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV990001
> https://www.catalog.update.microsoft.com/Search.aspx?q=KB4490628 Mar 2019 Servicing Stack Update
> https://www.catalog.update.microsoft.com/Search.aspx?q=KB4474419+7+09 SHA-2 Support
> https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV990001 Current ESU Rollup will require latest SSU
> https://www.catalog.update.microsoft.com/Search.aspx?q=KB3125574 Convenience Rollup (years of updates in one) - Optional
> https://www.catalog.update.microsoft.com/Search.aspx?q=KB4534310 Jan 2020 Monthly Rollup
If your motherboard is newer than about 2015, you may also get an "Unsupported Hardware" message at startup, informing you that microsoft has blocked updates and wants you to upgrade to Windows 10. While that popup can only be removed by disabling Windows Update in Services, you can easily unblock updates with this tool: https://github.com/zeffy/wufuc/releases/latest
Finally, most publicly available updates were discontinued as of January 2020. Microsoft is providing 3 years of private updates to organizations through its Extended Support program. Before you can install them, you will need to run the required updates above, then use this Bypass tool:
Extract with password (2020), run "LiveOS-Setup.cmd" as administrator and select " Full Installation"
If you want to get updates automatically through Windows Update, you should then install this:
That should enable updates until 2023, although microsoft may tweak the system again before then.
= Avoiding Telemetry =
Windows Update has stopped providing most patches individually, instead releasing them as one big monthly pack called a "Rollup". Each one includes the updates from all previous months, including back-ported Windows 10 telemetry that cannot be detached from legit updates. To easily disable this new telemetry, just finish installing your updates, then save this script as a ".cmd" file and run it as administrator:
Manual Guide: https://www.askwoody.com/forums/topic/2000012-neutralize-telemetry-sustain-win-7-8-1-monthly-rollup-model/
More info: https://www.askwoody.com/forums/topic/2000011-group-a-group-b-and-group-w-whats-the-difference/
You may also want to run the Ancile Script, which disables a range of telemetry and unwanted updates that were already in Windows 7 before the Rollups:
Security Only updates (Advanced):
"Security Only" updates are a set of minimal monthly packs with just security patches and a few bug fixes in them. They are an alternative to the Rollup system, but they can only be downloaded manually, so most users will want to stick with the Windows Update method above instead. As they are not available through Windows Update, the easiest way get started is with the 3rd party tool WSUS Offline:
ESR version for Windows 7: https://download.wsusoffline.net/wsusoffline1191.zip
Run UpdateGenerator.exe, check your OS version (under "Legacy Windows"), and check "Use security only updates instead of quality rollups". Then click start. It will make a folder of these minimalist updates, replacing the Rollups with security patches from the microsoft catalog. When it's done, go to the Client folder, run UpdateInstaller.exe, and follow the instructions till it's complete. Be sure to DISABLE automatic updates in Windows, and UNCHECK all "Security Monthly Quality Rollups" if you ever use Windows Update.
WSUS Offline will get you as far as January 2020. After you run it you can use the Bypass tool above. Starting with February 2020 you will need to download and install a Security Only update manually for EACH month, as they are not cumulative like the Rollups. It is also recommended that you take the latest Internet Explorer update, which are cumulative. You can find a maintained list of both here:
Note that the 09/2019 and 03/2020 updates contain the same telemetry that was back-ported from Windows 10 into the Rollups, so you should still consider using both telemetry tools above if you want those month's security patches. If for any reason you're using the Security Only updates and NOT starting with WSUS Offline, you will need to run the first three updates above and the January 2020 Security Only update KB4534314, then use the Bypass Tool before newer updates can be installed.