On 13 October 2026, Windows Server 2012 R2 got its last security update from Microsoft, ever. Regular support ended on 10 October 2023, and the three paid years of Extended Security Updates have now run out. For a 5 to 20 person NZ firm the choice is: upgrade the box, move it into Azure, or, most often, stop having a server and move what it does into the Microsoft 365 you already pay for. Which one is right depends on the one application the server runs.
The application migration in option 1, per source system, is on the Power Platform migration hub.
The dates, exactly
| Milestone | Date | What it means |
|---|---|---|
| End of mainstream support | 9 October 2018 | No new features or non-security fixes |
| End of extended support | 10 October 2023 | No free security updates; ESU became the only patch source |
| ESU year 1 ends | 8 October 2024 | Paid updates, 100% of the licence price per year on-premises |
| ESU year 2 ends | 14 October 2025 | Same again |
| ESU year 3 ended | 13 October 2026 | Final update. Nothing after this, on-premises or in Azure |
Source: Microsoft's lifecycle pages for Windows Server 2012 R2 and the Extended Security Updates FAQ. Microsoft 365 Apps (Word, Excel, Outlook) have not been supported on this server since January 2020, so if you are running Office on it as a terminal server, that has been unsupported for six years already.
On a 2016 server instead? The dates and the paid-update option differ: Windows Server 2016 loses free updates on 12 January 2027.
Why a small firm still has one
Because it works. The server in the cupboard was set up by an IT company in 2014, it holds the shared drive, it runs the job-tracking database that came with the business, and nobody has touched it since the last person who understood it left. The Windows Server 2012 R2 sticker is on the front and the backup is a USB drive someone swaps on Fridays. I see this shape of setup in Canterbury trades firms and small professional practices more often than any other. There is nothing embarrassing about it; the only mistake is doing nothing this month.
What actually happens after 13 October
The server keeps running. Nothing switches off. What changes is that every vulnerability found in Windows Server from then on stays open on that machine for good. In 2017 the WannaCry ransomware went through unpatched Windows servers worldwide within hours; the patch had existed for two months. Your insurer's cyber questionnaire almost certainly asks whether all systems receive security updates, and from 14 October the answer is no. If a client or an auditor asks the same question, same answer.
The four options, priced for a 5 to 20 person firm
| Option | Good when | Rough cost, NZ | What you still own |
|---|---|---|---|
| 1. Retire the server, move its jobs into Microsoft 365 | It does files, printing, logins and one small application; you already pay for Microsoft 365 Business Standard or Premium | Files and identity: a migration weekend, often under $3,000. Plus the application migration if there is one: $8,000 to $18,000 via SQL Server to Microsoft 365 or Access to SharePoint or Dataverse | No server, no patching, no backup job |
| 2. Upgrade in place to Windows Server 2025 | The hardware is under five years old and the application genuinely needs Windows Server (some industry software does) | Licence plus CALs plus a day of IT time; typically $3,000 to $6,000 before the hardware question | A server to patch monthly and back up, supported to November 2034 |
| 3. New server hardware with Windows Server 2025 | The application must stay on-premises and the hardware is old | $8,000 to $15,000 all-in for a small business box, licences and setup | Same as option 2, plus the hardware warranty cycle starts again |
| 4. Move the whole machine into an Azure virtual machine | The application cannot be rebuilt yet, and you want the server off the premises fast | Roughly $150 to $400 a month for a small VM plus the migration; ESU ended in October, so the OS must be upgraded there | A server in the cloud you still patch and pay for monthly |
For most firms under 20 staff, option 1 wins on both cost and ongoing effort, and the reason is simple: the first three jobs the server does are already included in the Microsoft 365 subscription. SharePoint replaces the shared drive, OneDrive replaces the home folders, Entra ID replaces the domain logins, and the printer talks to the network directly. The only thing left on the server is the application, and that is a migration decision worth making carefully rather than a reason to keep the box.
The one question that decides it
What runs on the server other than files? Walk over and look at the installed programs. If the answer is a SQL Server instance with a database behind an Access front end, a bespoke .NET app or a discontinued industry product, the decision tree in moving a SQL Server database into Microsoft 365 tells you whether it lands in SharePoint (no extra licence) or Dataverse (NZ$32.40 per user per month). If it is an Access database on the shared drive, that is a simpler job again. If it is nothing, retire the server this month and do not overthink it.
A realistic timeline from today
- This week: inventory what the server does. Programs, shares, printers, scheduled tasks, anything that backs up to it. One hour.
- Now: take a full, tested backup you can restore somewhere else. Not the Friday USB drive. This is the one non-negotiable.
- Next two weeks: move files to SharePoint and OneDrive, point PCs at Microsoft 365 logins. A weekend for most small firms.
- Within three months: migrate or replace the application. Three to eight weeks depending on the data, see the cost table above.
- Then: switch the server off, leave it intact for 60 days, then wipe and dispose of it.
13 October has passed, so the server is already running unpatched; the order above does not change. Isolate it from the internet until the application has moved, and do not let anyone browse the web from it.
Common questions
Is Windows Server 2012 R2 still safe to run after 13 October 2026?
No. Regular support ended on 10 October 2023 and the paid Extended Security Updates ended on 13 October 2026. Since then, no security patches at all. If the server is reachable from the internet, or a laptop that is, every new vulnerability stays open for good. Cyber insurers and auditors treat an unpatched server as a known risk.
What does it cost to get off Windows Server 2012 R2 for a small NZ business?
It depends on what the server does. If it only holds files and a printer, Microsoft 365 you already pay for replaces it with SharePoint and OneDrive for the cost of a migration weekend. If it runs a SQL Server or Access application, the realistic band is $8,000 to $18,000 to move that application into SharePoint or Dataverse. A like-for-like new server with Windows Server 2025 usually costs more than that once licences, setup and five more years of patching are counted.
Can I just buy Extended Security Updates for another year?
No. Year 3, which ended on 13 October 2026, was the last year Microsoft offered for Windows Server 2012 R2, on-premises or in Azure. The only remaining paid path is to move the machine into an Azure virtual machine and upgrade it there, or upgrade in place.
Does the old server have to be replaced with another server?
Usually not for a firm under 20 staff. Most 2012-era small business servers do four jobs: files, printing, user logins, and one line-of-business application. Microsoft 365 covers the first three. The application is the only real decision, and that is a migration question, not a hardware question.
Not sure what the server actually does?
Send me a photo of the installed-programs list and I will tell you in one free 30-minute call which of the four options you are in and what it costs. If the answer is "retire it and move the files", you do not need me for that and I will say so.