Windows Server 2012 and Exchange 2016/2019 end of support: what to do when ESU ends

On Tuesday 13 October 2026, Microsoft releases the last paid security updates (ESU) for Windows Server 2012 and 2012 R2. ESU is the programme through which Microsoft keeps patching retired products, and for these versions there will be no fourth year. Exchange Server 2016 and 2019 receive fixes until the end of October, when their second and final ESU period closes, again with no extension.

From then on, every server still running those versions in production is an identified risk that a member of senior management must accept or reject, with a review date. NIS2, DORA and Spain's National Security Framework (ENS) all require that decision to be recorded.

When do Windows Server 2012 and Exchange 2016/2019 stop getting security updates?

ESU for Windows Server 2012 and 2012 R2 ends on 13 October 2026 and ESU for Exchange 2016 and 2019 at the end of October 2026, according to Microsoft's documentation. The table lists the Microsoft products that lose a phase of support this month.

Microsoft Learn's page on Windows Server ESU sets 13 October 2026 as the end of year three, for servers both in and outside Azure, and states that Microsoft stops providing updates once the period ends. Azure virtual machines, which received ESU at no extra cost, lose their fixes on the same day. BleepingComputer set out in 2023 the three annual periods, the last running from 15 October 2025 to 13 October 2026.

Exchange gained a second six-month ESU period in April, running from May to October 2026, according to ITdaily. It requires a new contract and covers Exchange 2016 CU23 and Exchange 2019 CU14 and CU15. In July the Exchange team stated on its blog that there will be no further extension and that, once October ends, Exchange 2016 and 2019 will get no more updates even for customers holding a Period 2 ESU.

The latest update for those versions is an out-of-band release on 2 October (KB5129956) covering nine vulnerabilities, including CVE-2026-96940, which gives access to other users' mailboxes according to Help Net Security. The supported alternatives are Exchange Server Subscription Edition (SE) and Exchange Online.

The certificates Windows Update relies on expire on 17 May and 19 June 2027, according to the Windows IT Pro blog. Devices without a recent update will lose access to Windows Update, and for unsupported versions Microsoft's only advice is to upgrade. The change does not affect devices updated through WSUS, so it will mainly hit servers that connect to Windows Update directly.

What do NIS2, DORA and the ENS require for unsupported servers?

NIS2, DORA and the ENS do not explicitly ban an unsupported server. All three require the risk to be identified, treated and accepted by management.

Article 21(2)(e) of the NIS2 Directive lists security in the acquisition, development and maintenance of systems, including vulnerability handling, among the minimum measures. Article 20 makes management bodies responsible for approving those measures and overseeing their implementation, and liable for breaches. A server without patches leaves vulnerabilities unfixed, and management must have approved that situation.

Spain has not yet transposed NIS2, and the European Commission referred the delay to the Court of Justice of the EU in July, as we explain in NIS2 without a national law. The obligations will arrive with the Spanish law, but auditors and clients already use the directive as a benchmark.

Article 3, point 3, of DORA defines a "legacy ICT system". It is one that has reached the end of its lifecycle, is not suitable for upgrades or fixes for technological or commercial reasons, or has lost the support of its supplier or of an ICT third-party service provider. In each case the system is still in use and supports the financial entity's functions.

Article 8(7) requires financial entities other than microenterprises to carry out a specific ICT risk assessment of all such systems at least once a year, and in any case before and after connecting technologies, applications or systems. A Windows Server 2012 machine running a business application at a bank or an insurer fits that definition.

Spain's ENS deals with the issue in Article 21 and in measure op.exp.4. Article 21.2 provides that continuous assessment and monitoring will adjust the security state of systems to the vulnerabilities identified and the updates that affect them. Measure op.exp.4, on maintenance and security updates, is the one auditors examine closely, as our page on vulnerability management under the ENS explains. Without vendor patches, the control can only be sustained through justified compensating measures and a formal risk acceptance.

Is an isolated Windows Server 2012 machine safe to keep?

An isolated Windows Server 2012 machine can carry an acceptable residual risk if someone has checked that it has no route to the corporate network, uses no domain accounts and performs a narrow function. The reasons for keeping one are often legitimate. The server hosts an application from a vendor that has disappeared, or an industrial control system certified for that exact version, and migrating it needs testing, a downtime window and budget that was not in this year's plan.

The infrastructure team will often add that the machine sits "on a separate network". Frequently nobody has verified that description, and the "isolated" label comes from a network diagram drawn years ago.

Why is an unpatched Exchange server a bigger risk?

An on-premises Exchange server receives internet traffic by design, and many stay unpatched even when a fix exists. In August 2026 Microsoft fixed CVE-2026-62911, an authentication bypass by capture-replay that allows privilege escalation. At the end of August the Shadowserver Foundation's scans counted almost 22,000 exposed servers without the fix, 6,200 in the United States and 5,100 in Germany, according to Help Net Security.

Help Net Security also cites Germany's BSI, which estimated that around 85% of on-premises Exchange servers in the country were vulnerable, using a different measurement. The Dutch NCSC-NL warned on 28 August that public exploit code was circulating. Microsoft has not confirmed attacks exploiting it.

Another Exchange flaw, CVE-2026-42897 in OWA, was exploited as a zero-day in May and fixed by Microsoft in June. A server that will receive no patches stays exposed to every new flaw that affects its code. When Microsoft fixes a vulnerability in Exchange SE that shares code with the retired versions, the published patch can point attackers towards the older ones.

The US agency CISA lists the use of unsupported software in critical infrastructure in its catalogue of bad practices, describing it as dangerous and especially egregious for systems reachable from the internet. A regulator or an insurer may take that warning into account when judging the decision after an incident.

What should you do with servers you cannot migrate this quarter?

Windows Server 2012 and Exchange 2016/2019 machines with no retirement date need an inventory, verified isolation and a signed risk acceptance.

How do you find unsupported servers with Microsoft Defender?

Microsoft Defender for Endpoint can find Windows Server 2012 R2 machines through advanced hunting queries. Plain Windows Server 2012 is not supported by the agent and has to be found in Active Directory or the network inventory. The DeviceTvmSoftwareInventory table includes an end-of-support column. To count devices running unsupported software:

• DeviceTvmSoftwareInventory | where isnotempty(EndOfSupportStatus) | summarize Devices = dcount(DeviceId) by SoftwareName, SoftwareVersion, EndOfSupportStatus, EndOfSupportDate | order by Devices desc

To list Windows Server 2012 R2 machines and see whether the agent flags them as internet-facing:

• DeviceInfo | where Timestamp > ago(7d) | summarize arg_max(Timestamp, *) by DeviceId | where OSPlatform == 'WindowsServer2012R2' | project DeviceName, OSPlatform, OSVersion, IsInternetFacing

For Exchange, the HealthChecker script that Microsoft maintains in its CSS-Exchange repository reports the version and update level of each server. Every machine needs a business owner as well as a technical one, and the company's patch management records should show which ones fall outside it.

How do you isolate an unsupported domain-joined server?

An unsupported domain-joined server lets an attacker who compromises it reach the rest of the directory through lateral movement. These measures reduce its exposure:

• Internet access cut off or, if it publishes a service, a reverse proxy with pre-authentication.
• A dedicated segment with explicit inbound and outbound rules, following network segmentation by function.
• Domain admin accounts blocked from signing in, in line with the Active Directory tiering model.
• Unused roles and services removed.
• Closer monitoring than the rest of the estate.

If the team says the machine is isolated, a hardening review or an assessment of the external attack surface can confirm or disprove it quickly.

Some companies offer unofficial patches for retired systems. 0patch, for example, announced in September fixes for Windows Server 2012 and 2012 R2 until at least October 2029. Such services are a valid compensating measure if they are assessed as rigorously as a critical supplier, because they do not come from Microsoft and only fix selected flaws.

What should a formal risk acceptance include?

Every system that stays in production needs a record of the reason, the compensating controls, the estimated residual risk, the member of senior management who accepts it and a review date no more than twelve months away. For entities under DORA, that record is the basis of the annual assessment in Article 8(7). Under the ENS, it is the evidence the auditor will ask for when reviewing op.exp.4.

How do you upgrade Exchange 2019 or 2016 to Exchange SE?

Exchange 2019 on CU14 or CU15 can be upgraded to Exchange SE in place, in a process similar to installing a cumulative update. From Exchange 2016, the organisation has to deploy SE servers, or Exchange 2019 as an intermediate step, and move the mailboxes.

If the organisation already uses Microsoft 365, check whether the on-premises server is still needed or is left over from a hybrid migration that was never finished. It is one of the first checks in a Microsoft 365 security review.

Which penalties apply to companies that keep unsupported servers?

Article 34 of NIS2 requires member states to set maximum fines for essential entities of at least EUR 10 million or 2% of worldwide turnover, whichever is higher. For important entities the minimum is EUR 7 million or 1.4%. The amounts applicable in Spain will depend on the transposition law, and management liability under Article 20 comes on top.

In financial services, DORA's annual assessment is easy to check in an inspection. In the public sector and among its suppliers, a non-conformity on op.exp.4 can delay ENS certification or make it conditional.

The most likely cost, however, is an incident whose investigation ends at a server the organisation knew was unsupported. A vulnerability management programme that already has those systems inventoried, and NIS2 or DORA compliance work that includes them in the risk analysis, document the decision before the auditor arrives.

Who should sign off the decision before 1 November?

Before 1 November, the management committee should approve the list of Windows Server 2012 and Exchange 2016/2019 machines that will stay in production. Each server should have either a retirement date or a signed risk acceptance with its compensating controls, together with the name of the executive who signed it.

This article reflects lifecycle dates, figures and regulatory requirements published by third parties as of 13 October 2026. Microsoft's dates may change and should be confirmed on its lifecycle pages.

The KQL queries are illustrative, and table names and values should be validated in each environment before use. The references to NIS2, DORA and the ENS are for general information and do not replace a legal analysis of each case.