Windows Server 2012 R2 ESU Has Ended: How to Audit Your Legacy Servers Now

The last security update for Windows Server 2012 and 2012 R2 shipped on 13 October 2026. There won’t be another, at any price, on-premises or in Azure.

Most of what’s been written about this is an announcement with a migration sales pitch attached. This post is for the admin who already knows the date and has a more practical problem: there are still some 2012 R2 boxes out there, and someone needs to know exactly which ones, how exposed they are, and what to do about each of them this month.

We’re part way through a programme to move our remaining on-premises servers out of a data centre and into Azure, so I’ve spent a lot of time recently working out which servers can move, which can be rebuilt and which can just be switched off. The approach below is the audit I’d run on any estate now the deadline has passed.

The dates that matter

Microsoft’s Azure Arc ESU documentation is explicit that servers linked to Arc ESU licences aren’t eligible for any security update released after 13 October 2026. Moving a 2012 R2 server into Azure now doesn’t buy more time either. The Azure-hosted ESU track ended on the same day.

Note the last row. Windows Server 2016 is less than three months behind, and the audit below covers it too.

Step 1: Find every legacy server

Start with Active Directory. This lists every computer account running a server operating system, with its version and when it last checked in:

Get-ADComputer -Filter 'OperatingSystem -like "*Server*"' `
    -Properties OperatingSystem, OperatingSystemVersion, LastLogonTimestamp, IPv4Address |
    Select-Object Name, OperatingSystem, OperatingSystemVersion, IPv4Address,
        @{ n = "LastLogon"; e = { [DateTime]::FromFileTime($_.LastLogonTimestamp) } } |
    Sort-Object OperatingSystemVersion |
    Export-Csv "server-inventory.csv" -NoTypeInformation

LastLogonTimestamp only replicates every week or two, so treat it as a rough guide. A server that hasn’t checked in for months might be switched off, or it might be on a network segment that can’t reach a domain controller.

AD isn’t the whole picture. It misses anything that was never domain joined, which is often exactly where the oldest servers hide. Cross-check against:

• Your hypervisors. vCenter or Hyper-V will list every VM, including workgroup machines and appliances.
• Azure. Azure Resource Graph can list Arc-connected machines with their operating system in one query, using microsoft.hybridcompute/machines and its osSku property.
• Your EDR or vulnerability scanner. Defender for Endpoint’s device inventory, or any vulnerability scanner, sees machines by what’s actually running on the network.
• Vendor-managed systems. Building management, security cameras, plant monitoring and some line-of-business appliances run Windows Server under the hood and are often managed by someone outside IT.

Step 2: Tell the versions apart

The OperatingSystem text in AD is usually right but not always, especially on servers that have been upgraded in place. The build number in OperatingSystemVersion is the reliable signal:

Watch out for 2016 here. Windows Server 2016, 2019, 2022 and 2025 all report version 10.0. If someone has filtered a report on “version 10” to find modern servers, every 2016 server is hiding in it.

Step 3: Check what each server actually has installed

For each 2012 or 2012 R2 server, confirm two things: whether it was ever receiving ESUs, and whether it installed the last one.

The most recent updates are a quick check, run locally or with -ComputerName:

Get-HotFix -ComputerName SERVER01 |
    Sort-Object InstalledOn -Descending |
    Select-Object -First 5 HotFixID, Description, InstalledOn

Compare the newest entry with the October 2026 update listed in Microsoft’s update history for that version. A server whose last security update is from 2023 never had ESUs at all, and has been unpatched for three years, not three weeks.

For servers that used a MAK key for ESUs rather than Azure Arc, run slmgr /dlv and check whether an ESU licence shows as licensed. For Arc-enabled servers, the licence status is in the Azure portal. Microsoft also provides a built-in Azure Policy definition, “Extended Security Updates should be installed on Windows Server 2012 Arc machines”, which reports whether Arc-connected 2012 servers have the latest ESU.

This step tells you where each server really stands. “Fully patched until last week” and “unpatched since 2023” need very different levels of urgency.

Step 4: Rank the risk

Not every legacy server is equally dangerous. For each one, answer four questions:

1. Is it reachable from the internet? Any inbound port, including a published web app, RDP or a VPN endpoint.
2. Do privileged accounts sign in to it? If a domain admin, or any account with rights over other servers, ever logs on, compromising this server can compromise your whole domain.
3. What data does it hold? Finance, payroll, HR or customer data raises the stakes.
4. What depends on it? An application nobody can replace is a different problem from a forgotten utility server.

That gives you three buckets:

And a fourth outcome that’s easy to miss: a lot of legacy servers turn out to be doing nothing. When we audited our old print servers for decommissioning, the first job was proving what, if anything, still used them. Check its network connections and file shares for a couple of weeks before you decide it’s needed.

Step 5: Isolate what you can’t move yet

If a server has to keep running for now, shrink what can reach it and what it can reach:

• Restrict inbound traffic at the server and network firewall to only the ports and source addresses the application needs.
• Block outbound internet access unless the application genuinely needs it. Much malware needs to call home.
• Keep privileged accounts off it. Use a Group Policy setting such as “Deny log on through Remote Desktop Services” for domain admin and other high-privilege groups, and use a separate local or delegated account for maintenance.
• Manage the local administrator password with Windows LAPS or a similar tool, so one compromised server doesn’t give up a password reused elsewhere.
• Turn off what isn’t needed, including SMBv1, unused roles and any services left over from past projects.
• Confirm your security agent is still supported. Check with your EDR or antivirus vendor that the agent on 2012 R2 still gets updates and detection content. Monitoring matters more on an unpatched server, not less.

Isolation buys time. It doesn’t make an unpatched server safe, and it shouldn’t become the plan.

Step 6: Choose the way out

For each server still running, pick one of these and give it a date:

• Decommission it if the workload is gone or can be absorbed elsewhere.
• Rebuild on a current Windows Server version and move the application across. For a server that’s been running for a decade, a clean build is usually more reliable than an in-place upgrade.
• Migrate to a platform service. File shares to SharePoint or Azure Files, print servers to a cloud print service, small databases to a managed database service.
• Replace the application if the vendor no longer supports it on a current OS. That’s a business decision, so get it in front of whoever owns the application now.

Don’t let 2016 become the next one

Everything above applies to Windows Server 2016, just with a little more breathing room. It reaches end of extended support on 12 January 2027. Microsoft’s Arc ESU preparation guide confirms ESUs for 2016 Standard and Datacenter are available through Azure Arc, providing Critical and Important updates for up to three years, with billing starting 13 January 2027.

That’s a useful bridge for servers that genuinely can’t move by January. But 2012 R2 is a warning. Plenty of organisations bought three years of ESU and still arrived at the deadline with servers to migrate. Run the same audit on 2016 now, while it’s still a planning exercise.

Daniel Lutton

From my early days on the helpdesk through roles as a service desk manager, systems administrator, and network engineer, I’ve spent more than 25 years in the IT world. As I transition into cyber security, my goal is to make tech a little less confusing by sharing what I’ve learned and helping others wherever I can.