All posts
Legacy Modernization

Windows Server 2012 R2's Last Security Updates Ended in October 2026: What to Do This Quarter

By

October 25, 2026

5 min read

The third and final year of Extended Security Updates for Windows Server 2012 and 2012 R2 ended on October 13, 2026. There is nothing left to buy. How to contain the servers still running it, and the fastest ways off: in-place upgrade, rebuild, AWS's End-of-Support Migration Program, or retirement.

Windows Server 2012 R2
End of Support
EC2
Security
Migration

Windows Server 2012 and 2012 R2 left extended support in October 2023. Microsoft then sold three years of Extended Security Updates, and the last of those ended on October 13, 2026. Unlike Windows Server 2016 in January, there is no paid option left. Every vulnerability found from now on stays open.

Want a second opinion on this for your system?

Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.

Contain first

  • Remove any inbound internet access. No public IP addresses, no direct RDP; use Systems Manager Session Manager or Fleet Manager for administration.

  • Restrict security groups to exactly the clients and ports the application needs.

  • Take the servers out of the domain's privileged paths: no domain admin logons, no shared service accounts with rights elsewhere.

  • Monitor them closely (GuardDuty for the account, endpoint protection on the servers), and back them up so a compromise is recoverable.

Then get off it

Option

When it fits

In-place upgrade to Windows Server 2022 or 2025

The application and its dependencies support the newer OS; test on a cloned instance first

Rebuild on a new instance

The install is documented or scriptable; gives you a clean, repeatable server

AWS End-of-Support Migration Program

The application cannot be reinstalled or its vendor is gone; EMP packages it to run on a current Windows Server without code changes

Replace with SaaS or a rewrite

The application is commodity, or already on the modernization list

Retire

Nobody has used it in months. More common than anyone expects

hoolco Monthly Review

Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.

As of October 25, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.