Windows Server 2012 and 2012 R2: the last security update ships tomorrow

Tomorrow, Tuesday 13 October 2026, Microsoft releases the last security updates Windows Server 2012 and 2012 R2 will ever get. Extended Security Updates (ESU) Year 3 ends at 06:59 Pacific time on Wednesday 14 October, which is 14:59 in the UK. After that, there are no more patches for these versions, whatever you pay and wherever the server runs.

That's a bigger deal than the original end of support in October 2023. Then, there was a paid safety net. This time there isn't one.

How we got here

Windows Server 2012 (without R2) follows the same ESU dates.

What actually ends

ESU only ever covered one thing: security updates rated Critical or Important. No new features, no non-security fixes on request, and no general support. From Wednesday, even that stops, for every route people used to get it:

• Azure VMs. ESU was free on Azure, and on Azure Local, Azure VMware Solution, Azure Dedicated Host, Azure Nutanix Solution and Azure Stack Hub and Edge. Free ends too. A 2012 R2 VM in Azure is as unpatched as one under a desk.
• Azure Arc. Servers enrolled through Arc were billed monthly. There's nothing left to enrol in.
• Volume licensing. Organisations with Software Assurance bought each year at 100% of the full licence price and activated a Multiple Activation Key (MAK). There's no Year 4 key to buy.
• Support tickets. Microsoft's FAQ is blunt: without ESU, you can't log a support ticket for 2012 or 2012 R2, even with a support plan.

There's no fourth year. Windows Server 2008 and 2008 R2 got one extra year of ESU on Azure only. Microsoft's ESU FAQ limits that to 2008. For 2012, coverage is "up to three years following the end of support date", and that's now been used up.

What doesn't change on Wednesday

Nothing switches off. The servers keep booting, activation keeps working, and applications keep running. What changes is that every security vulnerability found in these versions from now on stays open for good, and each month's security updates for newer versions become a list of vulnerabilities your 2012 servers will never be fixed for.

It also changes your compliance position. Most frameworks require supported, patched software. Cyber Essentials, for example, expects software on in-scope devices to be supported by the vendor and updated within 14 days of a high or critical fix being released. A 2012 R2 server can't meet that from Wednesday.

Who's still running it, and why

Nobody publishes reliable figures for how many 2012 servers are left. The numbers you'll see quoted mostly come from companies selling migrations or third-party support. I'm also not going to name organisations: there's no trustworthy public list, and calling out specific companies as running unpatched servers would be both guesswork and a gift to attackers.

What's well understood is where they survive and why. It's rarely neglect. It's usually something holding the server in place:

That last row is the most common, and the most fixable. The first three are where the real risk sits, because those servers often support critical services. The US cybersecurity agency CISA lists running unsupported software in critical services as its number one bad practice, saying it "is dangerous and significantly elevates risk", and that it's "especially egregious in technologies accessible from the Internet".

Find every one you have

You can't plan for servers you don't know about. Check from more than one angle, because each source misses something.

Active Directory, including machines that haven't signed in for a while:

1
2
3Get-ADComputer -Filter 'OperatingSystem -like "*Server 2012*"' -Properties OperatingSystem, LastLogonDate |
    Sort-Object LastLogonDate -Descending |
    Select-Object Name, OperatingSystem, LastLogonDate

Microsoft Defender for Endpoint advanced hunting, for anything onboarded:

1
2
3
4
5DeviceInfo
| where Timestamp > ago(7d)
| where OSPlatform startswith "WindowsServer2012"
| summarize arg_max(Timestamp, OSPlatform, OSBuild, PublicIP) by DeviceName
| order by DeviceName asc

Azure Resource Graph, for Azure VMs and Arc-enabled servers. This relies on the OS name Azure reports, so VMs need to be running:

1
2
3
4
5resources
| where type in~ ("microsoft.compute/virtualmachines", "microsoft.hybridcompute/machines")
| extend os = tostring(coalesce(properties.extended.instanceView.osName, properties.osSku, properties.osName))
| where os has "2012"
| project name, type, os, resourceGroup, subscriptionId, location

Compare the three lists. Servers that appear in AD but not in Defender are the ones to worry about first, because nothing is watching them.

Your options

Moving a 2012 server to Azure was a popular option while ESU was free there. After tomorrow that no longer buys you anything. It's worth doing only if you upgrade or migrate as part of the move.

If one can't move yet

The UK's National Cyber Security Centre is clear that "the only fully effective way to mitigate this risk is to stop using the obsolete product". If you have to keep one for a while, its guidance on obsolete products boils down to making the server hard to reach and less damaging if it's compromised:

• Cut its routes in. No internet access, no email, no web browsing, no removable media. Use technical controls, not just policy.
• Put it in its own network zone with only the specific traffic flows it needs, enforced by a network firewall. Don't rely on the server's own firewall, because a compromised server can turn it off.
• Take things off it. Move services that don't need to be there onto supported servers, switch off anything non-essential, and keep sensitive data away from it.
• Treat it as untrusted. No domain admin sign-ins from it, no remote desktop hosting, and constrained access to everything else.
• Watch it closely. Collecting logs isn't enough on its own: someone has to act on them.
• Write the risk down with an owner and a review date, and keep the migration on the plan.

Checklist

• Every 2012 and 2012 R2 server found, from AD, Defender and Azure Resource Graph
• Each one has an owner and a decision: upgrade, migrate, replace, retire or isolate
• Tomorrow's final security updates installed on every one that still has ESU
• Anything left facing the internet taken off it this week
• Domain controllers on 2012 or 2012 R2 replaced by new DCs on a supported version
• Servers you have to keep isolated, monitored and recorded as an accepted risk with a review date