Microsoft Ends Security Updates for Windows Server 2012 and 2012 R2

Microsoft has officially ended Extended Security Updates (ESU) for Windows Server 2012 and Windows Server 2012 R2, leaving organizations that still use these operating systems without further security patches.

Both server versions originally reached end of support on October 10, 2023. Microsoft then offered three additional years of paid security updates, allowing businesses more time to migrate their infrastructure. That program has now expired in October 2026.

According to Microsoft, organizations should move their remaining workloads to supported platforms to avoid growing security risks, compliance issues, and maintenance challenges.

Microsoft recommends migrating to supported Windows Server versions

Microsoft advises IT administrators to identify servers still running Windows Server 2012 or 2012 R2, assess their dependencies, and determine which applications and services need migration.

Organizations can upgrade to a supported Windows Server version, move workloads to Microsoft Azure, modernize applications using Azure services, or combine these approaches depending on their infrastructure.

Microsoft also recommends prioritizing business-critical workloads and working with its support teams or trusted partners to simplify the migration process.

Upgrading provides access to regular security patches, improved performance, stronger protection against emerging threats, and newer capabilities, including AI-powered features. It can also help businesses reduce technical debt and maintenance costs.

Organizations that cannot migrate immediately can explore third-party security solutions such as 0patch, which recently released a fix for a critical Windows Server DNS vulnerability affecting older systems. However, these solutions do not provide the same comprehensive coverage as Microsoft’s official security updates and should not replace a long-term migration plan.

The Windows Server deadline follows Microsoft’s recent decision to end extended security updates for Exchange Server and Skype for Business Server, adding pressure on organizations that continue to rely on older Microsoft infrastructure.

Businesses still running Windows Server 2012 or 2012 R2 can continue operating these systems, but they will have to manage newly discovered vulnerabilities without official Microsoft security patches. Migrating to a supported platform remains the safest long-term option.