21/10/2024 16:36 Windows Server 2012/R2: Extended Security Updates | Windows IT Pro Blog
Windows Server 2012/R2: Extended
Security Updates
Editor’s note 12.01.23: We have added a note to clarify prerequisites for different scenarios.
You can now get three additional years of Extended Security Updates (ESUs) if you need more time to
upgrade and modernize your Windows Server 2012, Windows Server R2, or Windows Embedded Server
2012 R2 on Azure. This also applies to Azure Stack HCI, Azure Stack Hub, and other Azure products.
Note: Windows Server 2012, Windows Server 2012 R2, and Windows Embedded Server 2012 R2
reached end of support on October 10th, 2023, per our 10-year lifecycle policy. After this date, no
more security patches will be released for these versions of Windows Server. For ease of
reference, we'll sometimes refer to these versions as Windows Server 2012/R2 version family.
If you've already moved to Azure to protect your Windows Server 2012 and R2 workloads, you might be
enjoying free Extended Security Updates. If your organization is unable to migrate, you can purchase and
seamlessly deploy Windows Server 2012 Extended Security Updates enabled by Azure Arc on premises
and in hosted environments without keys, directly from the Azure portal. As an alternative to Azure Arc,
let's look at the steps to purchase and deploy ESUs—on premises and in hosted environments—using
multiple activation keys (MAK). It takes four easy steps:
1. Purchase and download the ESU key.
2. Prepare to install the ESU key.
3. Install the ESU key.
4. Activate the ESU key.
Purchase and download the ESU key
Extended Security Updates (ESUs) are available through specific Microsoft Volume Licensing programs.
Beginning October 10, 2023, you can purchase ESUs for up to three consecutive 12-month increments.
This means you can be covered beginning on November 14, 2023 and through October 13, 2026. Note:
You cannot buy partial periods (e.g., 6 months of updates).
undefined
[Link] Server 2012_R2_ Extended Security [Link] 1/10
21/10/2024 16:36 Windows Server 2012/R2: Extended Security Updates | Windows IT Pro Blog
Note: People tend to refer to ESU keys interchangeably as multiple activation keys (MAK), ESU
product keys, or ESU license keys.
Download the ESU keys on the Microsoft admin center by doing the following.
1. Go to Microsoft admin center.
2. In the Your products section, select View contracts.
Screenshot of the Your products page in Microsoft admin center.
3. Select the three dots to the right of each license ID for more actions and select View Product
Keys. All the product keys for the agreement will be available there.
undefined
[Link] Server 2012_R2_ Extended Security [Link] 2/10
21/10/2024 16:36 Windows Server 2012/R2: Extended Security Updates | Windows IT Pro Blog
Screenshot of a close-up view of Contracts highlighting the menu option to View product keys.
Prepare to install the ESU key
Let's ensure you're ready for continued security updates after October 10, 2023. Prerequisites vary
depending on the scenario, but double-check that your devices are up to date, you have appropriate
licensing preparation package and keys, as well as firewall readiness.
Update your devices with the latest Servicing Stack Updates
Check that you have the following updates installed for all Windows Server 2012 and Windows Server
2012 R2 scenarios, including for embedded systems. For more information about the latest SSU updates,
see ADV990001 | Latest Servicing Stack Updates.
For Windows Server 2012 R2 or Windows Embedded Server 2012 R2, install the servicing stack
update (SSU) (KB5029368) that is dated August 8, 2023 or a later SSU.
For Windows Server 2012, install the servicing stack update (SSU) (KB5029369) that is dated
August 8, 2023 or a later SSU.
Note: If you use Windows Update, these updates will be offered automatically as needed. You must
restart your device after you install the required updates.
undefined
[Link] Server 2012_R2_ Extended Security [Link] 3/10
21/10/2024 16:36 Windows Server 2012/R2: Extended Security Updates | Windows IT Pro Blog
Download required licensing packages and keys
1. Download and install the Extended Security Updates (ESU) Licensing Preparation Package.
For Windows Server 2012 R2 or Windows Server 2012 R2 Embedded, see the Extended
Security Updates (ESU) Licensing Preparation Package that is dated August 10, 2022
(KB5017220).
For Windows Server 2012, see the Extended Security Updates (ESU) Licensing Preparation
Package that is dated August 10, 2022 (KB5017221).
2. Download the ESU multiple activation keys (MAK) add-on key from the VLSC portal.
3. For Windows Server 2012 and Windows Server 2012 R2 virtual machines on Azure or Azure Stack
HCI, ESU updates are automatically unlocked. That means that you don't need to deploy the ESU
keys, nor do you need the licensing preparation package. For Windows Servers that run on
premises with Azure Arc, follow instructions in Deliver Extended Security Updates for Windows
Server 2012 - Azure Arc.
Note: You don’t need to install the Licensing Preparation Package for Windows Server 2012/R2
machines updated with the 2022.7B Monthly Rollup or later.
Get the Licensing Preparation Package from WSUS or the Microsoft Update Catalog and install it
for Windows Server 2012/R2 machines that:
Are on a released-to-manufacturing (RTM) version (without the latest updates).
OR have updates that are older than the 2022.7B Monthly Rollup.
OR don’t have the 2022.8 out-of-band (OOB) update.
If you use Scan Cab for the 2023.11B update, you’ll also need to download the Licensing
Preparation Package from the Microsoft Update Catalog and install it manually.
Configure firewall allow lists for activation
If you're using a proxy firewall, you may need to allow-list the activation endpoints for ESU key activation
to succeed.
For online activation (i.e., local key deployment), allow-list all the following URLs:
[Link]
[Link]
[Link]
[Link]
undefined
[Link] Server 2012_R2_ Extended Security [Link] 4/10
21/10/2024 16:36 Windows Server 2012/R2: Extended Security Updates | Windows IT Pro Blog
[Link]
[Link]
[Link]
[Link]
For proxy activation using the Volume Activation Management Tool (VAMT), allow-list the following URLs:
[Link]
[Link] (This FWLink redirects to the above URL.)
Note: If you directly click or tap on these links, you'll receive a privacy error message. This is the
expected behavior.
Here are the requirements for applying ESUs to your scenarios:
Licensing Preparation
Scenario SSU update required?
Package required?
VMs running on Azure/Azure Stack HCI Yes No
Azure-Arc enabled physical/virtual machines
Yes No
(VMs)
Azure VMWare/Nutanix Solutions Yes Yes
On premises devices fully or partially
Yes Yes
connected (physical or virtual)
Install the ESU key
Once you have met the prerequisites listed above, you're ready to install and activate the ESU key.
Note: Installing the ESU product key will not replace the existing Windows OS product key on the
device. Do not use the /upk command to uninstall the Windows OS key.
First, install the ESU key using the Windows Software Licensing Management ([Link]) tool. Let's see
how you'd then activate it.
1. Open an elevated command prompt. undefined
[Link] Server 2012_R2_ Extended Security [Link] 5/10
21/10/2024 16:36 Windows Server 2012/R2: Extended Security Updates | Windows IT Pro Blog
2. Type [Link] %windir%\system32\[Link] /ipk <ESU key> and select Enter.
3. If the product key is installed successfully, you'll see a message like the following:
A command prompt popup message confirms successful installation of the ESU product key.
Note: If you see the Error:0xC004F050 while trying to install the ESU product key, your device may
require an additional reboot.
Next, find the ESU Activation ID in the Get your ESU Activation ID table below:
1. In the elevated command prompt, type [Link] %windir%\system32\[Link] /dlv and select
Enter.
2. Note the Activation ID as you will need it in the next step.
undefined
[Link] Server 2012_R2_ Extended Security [Link] 6/10
21/10/2024 16:36 Windows Server 2012/R2: Extended Security Updates | Windows IT Pro Blog
A Windows Script Host dialog box shows the Activation ID number along with other details.
The following table outlines possible values for ESU Activation ID. The activation IDs are the same across
all eligible Windows ESU editions and all devices enrolled for that program.
ESU Program ESU SKU (or Activation) ID
Server – 2012/R2 Year 1 c0a2ea62-12ad-435b-ab4f-c9bfab48dbc4
Server – 2012/R2 Year 2 e3e2690b-931c-4c80-b1ff-dffba8a81988
Server – 2012/R2 Year 3 55b1dd2d-2209-4ea0-a805-06298bad25b3
Embedded Server – 2012/R2 Year 1 5f7d1147-3adc-4b28-8e57-4713ab7623cd
Embedded Server – 2012/R2 Year 2 050b873b-763b-437b-b7c5-9efbeb96ae32
Embedded Server – 2012/R2 Year 3 d44f8a8e-5129-4999-9fe0-5025c2341033
Activate the ESU key undefined
[Link] Server 2012_R2_ Extended Security [Link] 7/10
21/10/2024 16:36 Windows Server 2012/R2: Extended Security Updates | Windows IT Pro Blog
Once you have completed your allow lists, you're ready to activate the ESU product key. To deploy and
activate the ESU MAK add-on key, you'll need [Link] or Volume Activation Management Tool (VAMT).
Note: If you use VAMT, you have to update the VAMT configuration files. If you use online
activation, make sure the device has access to the Microsoft Activation server endpoints. See
Extended Security Updates (ESUs): Online or proxy activation for step-by-step instructions.
1. Open an elevated command prompt.
2. Type [Link] %windir%\system32\[Link] /ato <ESU Activation Id> and select Enter.
You should now see a message stating that you have activated the key successfully:
A Windows Script Host dialog box confirms that the product was activated successfully.
Important: Activation via Control Panel > System and Security > System > Activate Windows
activates the Windows operating system only. You cannot use it to activate ESU keys.
Once you have activated the ESU product key, verify the status at any time by doing the following:
1. Open an elevated command prompt.
2. Type slmgr /dlv and select Enter.
The License Status will show as "Licensed" for the corresponding ESU program, as shown below:
undefined
[Link] Server 2012_R2_ Extended Security [Link] 8/10
21/10/2024 16:36 Windows Server 2012/R2: Extended Security Updates | Windows IT Pro Blog
The Windows Script Host dialog box shows the name and the license status for the year 1 ESU add-on,
along with other details.
Note: We recommend using a management tool, such as System Center Configuration Manager
(also known as Configuration Manager or SCCM), to send the [Link] scripts to your enterprise
devices.
Once the ESU key is activated, continue to use your current update and servicing strategy to deploy ESUs
through Windows Update, WSUS, the Microsoft Update Catalog, or whichever patch management
solution you prefer. Extended Security Updates will have the security-only update classification.
A special case of Azure virtual machines
The good news is that you don't need to deploy an additional ESU key for Azure virtual machines (VMs),
Azure Stack HCI, version 21H2 and later. Like on-premises devices, you'll need to install the appropriate
SSUs as outlined in the "Prepare to install the ESU key" section above. With those SSUs, VMs will be
enabled to download the ESU updates.
undefined
[Link] Server 2012_R2_ Extended Security [Link] 9/10
21/10/2024 16:36 Windows Server 2012/R2: Extended Security Updates | Windows IT Pro Blog
Would you ever need to deploy the ESU key for Azure products? Yes. You'll do this for Azure VMWare,
Azure Nutanix solution, Azure Stack (Hub, Edge), or for bring-your-own images on Azure for Windows
Server 2012 and Windows Server 2012 R2. Just follow the steps to install, activate, and deploy ESUs
described above in the "Activate the ESU product key" section.
A pre-patched Windows Server 2012 R2 image is available from the Azure Marketplace. For answers to
commonly asked questions about ESU for Windows Server 2012/R2 version family, see Extended
Security Updates frequently asked questions.
Our recommendation for the highest compliance and security of your Windows Server estate is Azure. And
while you're planning to migrate, you can purchase and seamlessly deploy Windows Server 2012
Extended Security Updates enabled by Azure Arc on premises and in hosted environments without keys,
directly from the Azure portal.
Resources
Take a look at additional resources to find out more about Extended Security Updates for Windows Server
2012, Windows Server 2012 R2, and Windows Embedded Server 2012 R2.
Windows Server 2012 Extended Security Updates enabled by Azure Arc
KB5031043: Procedure to continue receiving security updates after extended support has ended on
Octo...
Secure Windows Server 2012/R2 workloads with options from Azure
Pricing - Extended Security Updates enabled by Azure Arc
So You're Still Running Windows/SQL 2012. Now What?
Extended Security Updates for SQL Server and Windows Server
[Link] Server 2012_R2_ Extended Security [Link] 10/10