Answer This: How to control costs when licensing Windows Server 2012 ESUs for VMs

Mary Jo Foley is the Editor in Chief at Directions on Microsoft. Before joining Directions, Mary Jo has worked as... more

We’re kicking off a new feature on our blog that we’re calling “Answer This.” We’ll be posting some of the many customer questions about Microsoft enterprise technology and licensing that we receive here at Directions on Microsoft, along with our analysts’ answers. If you want a chance to have one of your enterprise questions answered, fill out this form and we might tackle your query next.

Our first installment is timely, as it focuses on the Extended Security Updates (ESUs) that Microsoft is making available to Windows Server 2012 and 2012 R2 customers that will provide them with important security updates even after the October 10, 2023, end-of-support date for those products.

Customer Question

Can legacy virtual machines (VMs) running in on-premises Windows Server version 2012/R2 — regardless of the underlying Windows Server licensing — be licensed individually with extended security updates (ESUs)?

Back Story

Windows Server 2012/R2 leaves extended support on October 10. For on-premises scenarios, customers must purchase security patches in the form of ESU core licenses. The open question is “how many ESU core licenses do I need?” The answer: It depends… based on which Microsoft source you consult and how you interpret it.

In October 2022, Microsoft changed Windows Server licensing rules. Prior to that date customers needed to cover all the physical cores in a server (typically via Windows Server Datacenter core licenses). Starting October 2022, customers could instead use an alternative “license-by-VM” option (typically using Standard edition core licenses). That means customers have two options for allocating Windows Server core licenses.

Up until October 2022, Microsoft’s official ESU licensing rule was that if a customer ran ESU-patched workloads on a server, they had to purchase the same number (and edition) of ESU core licenses as they did for Windows Server core licenses for that physical server. At that time, Microsoft didn’t bother to amend its policy to clarify whether changes to the underlying Windows Server licensing had any effect on ESU licensing (since the then-active ESUs for Windows Server 2008/2008 R2 were on their way out and were already prepaid by customers).

It wasn’t until recently that ESU licensing rules resurfaced as an issue. On Oct. 10, 2023, Windows Server 2012 and 2012 R2 are exiting support and ESUs become available for purchase. Many organizations are curious if — since they can choose between two Windows Server core license allocation options — can they also choose between parallel ESU options? Or is it the case that they must only use the option chosen for Windows Server as the one they use for ESUs?

Why is this question material? In certain cases, an inability to mix options makes a monumental difference in ESU licensing costs. Customer datacenters commonly comprise Windows Servers clustered together allowing the VMs to move across servers for load balancing. Each physical core in the cluster is licensed with Windows Server Datacenter. Having to purchase an ESU Datacenter license for each physical core in the cluster can be 50 or more times as expensive as licensing the small set of Windows Server 2012/2012 R2-based VMs requiring ESUs using the license-by-VM option.

There’s another problem: Microsoft’s own documentation around this is ambiguous. In some places, the company indicates that customers can mix and match when licensing ESUs (although possibly only when registering their servers with Azure Arc and paying a monthly fee, rather than the traditional ESU annual fee).

From a September 2023 Microsoft blog post marking general availability of the Windows Server 2012/R2 ESUs: “Customers can mix and match Standard and Datacenter licensing, and virtual core and physical core models, eliminating the need to match SKUs with their underlying host.”

Don’t Forget

Whether mixing options or not, ESUs are extremely expensive — basically the equivalent of buying the full Windows Server license all over again for each of the three years of ESU coverage. Further, ESUs are cumulative, meaning you must buy all preceding years (if you buy in year 2 you must also buy year 1, if you buy in year 3, you must buy years 1 and 2).

Customers could try to reconfigure their IT setups on-premises and reallocate licenses to try to save money when matching their physical licensing with ESUs. But that process is going to take significant IT resources, exactly what customers running legacy workloads want to avoid.

Customers who agree to migrate their VMs to Azure can get ESUs at no cost. However, moving from on-prem to Azure also soaks up IT resources and may be impractical for various reasons. And with the end-of-support timebomb looming, the Azure option may not be feasible in a timely manner.

Customers who connect their VMs to Azure Arc and subscribe to monthly ESUs do have flexibility. When purchasing and provisioning a set of ESU core licenses, the Azure Arc interface requires the IT administrator to specify either the license-by-physical-host or license-by-VM options. However, the interface has no way to know whether the underlying Windows Server core licensing matches.

Microsoft Says

We asked Microsoft for clarification on the ambiguity of its documentation. We also asked whether there are specific cases where customers can mix their licensing options when it comes to ESUs for Windows Server 2012/2012 R2 and for SQL Server 2012. We received a response we didn’t find to be overly enlightening.

What was far more helpful is the seemingly freshly updated FAQ to which Microsoft pointed us:

Directions’ takeaways from the FAQ

Monthly (Azure Arc) and annual ESUs are available via EA and CSP

For Windows Server

With Monthly (Azure Arc), customers can choose licensing option (physical or virtual; whatever is the most optimal and cost effective), and the ESU selection doesn’t have to match underlying OS licensing option use (Implication: Only the WS2012 VMs that require ESUs are licensed).
With Annual (via EA/CSP), ESU licensing must match (“align with”) underlying Windows Server licensing (Implication: same physical/virtual choice, same license edition, same license quantity)

For SQL Server

With Monthly (Azure Arc), ESU licensing is always done by virtual (virtual cores), and the ESU selection doesn’t have to match underlying OS licensing option use (Implication: Only the SQL2012 VMs that require ESUs are licensed).
With Annual (via EA/CSP), ESU licensing must match (“align with”) underlying SQL licensing (Implication: same physical/virtual choice, same license edition, same license quantity)

Our Recommendations

We still hope that Microsoft may, at some point, modify its licensing rule by allowing the individual VMs that require ESUs to be licensed regardless of how the underlying Windows Server is licensed.

If that doesn’t happen, customers will need to decide if they are willing to go the Azure Arc route for their ESUs for VMs. If they are not, organizations must evaluate whether they’ve got the funds and time to try to migrate VMs running Windows Server 2012/R2 to Azure or to reallocate their on-premises workloads to make purchasing ESUs for VMs more affordable.

The good news is that VMs eligible for disaster recovery, Visual Studio and dev/test benefits can receive ESUs at no additional cost.