Fifteen days of Server 2012

October 13. That is when the third and final year of extended security updates for Windows Server 2012 and 2012 R2 runs out. You have already used every extension Microsoft sells. There is no year four. Whatever is still running on those boxes on October 14 is running unpatched, forever.

We are not going to pretend you can migrate in fifteen days. You can't, and the estates we walk still average a handful of 2012 boxes each, usually carrying the application nobody wants to name an owner for. What fits in fifteen days is triage, and triage is worth doing precisely because the migration won't happen by the deadline.

1. Count them. Today, from the directory and the network scan both, because the two lists never match and the difference is the interesting part. Write the number on the wall next to the date.
2. Sort into three piles: dies, moves, stays. "Dies" is the happiest pile and bigger than you think; a 2012 box that nobody can explain is a decommissioning candidate, not a migration candidate. Give each "moves" a quarter and an owner. Be suspicious of any pile labeled "moves later"; that pile is where "stays" hides.
3. For "stays", the unpatchable survivors, isolate: pull them off the internet entirely, segment them from the flat network, allow only the named ports to the named systems, and log everything they say. An unpatched box with a two-system conversation is a risk. An unpatched box on the open estate is a foothold.

The part that matters more than this deadline: put the next one on the wall now. This playbook gets rerun for every OS in the estate, and the only variable is whether you start with two years or two weeks. We keep the dates posted for exactly this reason. Fifteen days is enough for triage. It was never going to be enough for the plan, and the next deadline already has a date printed on it.