In every second Polish 20-50-person company we walk into, the key server is still running Windows Server 2012 R2. It hosts the Comarch Optima or Subiekt database, file shares, the domain controller, sometimes a network printer and fiscal printing. It works. Nobody wants to touch it, because "why would we, it runs".
The problem is that since October 2023 Microsoft no longer ships security patches for that system, and Windows Server 2016 ends support in January 2027. Every month on the old system is a growing hole your antivirus won't flag in its dashboard. The cyber insurer only notices at claim time — and by then, they deny the payout.
This post is about what to actually do if you happen to be sitting on one of these systems. No scare tactics, no half-million enterprise offer.
What exactly ended and what is ending
Three dates to know:
- Windows Server 2012 R2 — mainstream support ended 9 October 2018, extended support 10 October 2023. Today the system only gets patches through the paid ESU (Extended Security Updates) programme — typically several hundred dollars per year per instance for Standard, rising every year.
- Windows Server 2016 — mainstream ended 11 January 2022, extended ends 12 January 2027. That's under half a year left (as we write this) before you also need to pay for patches or migrate.
- SQL Server 2012 and SQL Server 2014 — if along with Windows Server 2012 R2 you have an old Comarch Optima database on SQL 2012 (and you often do), that one is also unpatched. SQL Server 2016 ends support in July 2026.
"The system runs" is not the same as "the system is secure". New Windows Server 2012 R2 vulnerabilities appear every month — they just aren't patched for you without paid ESU.
Why this can't be waited out
Three things happen at once when you stay on an unsupported system:
The cyber insurer stops paying. In cyber policies for SMEs we've been seeing since 2024, it's now standard to include a clause excluding losses if, after date X, the insured runs "an operating system or database no longer supported by the vendor". Ransomware that walks in through an SMB hole in 2012 R2 is no longer a random event for the insurer — it's the result of a knowing omission. In the last year we've seen three such payout refusals, each in the PLN 200-400k range.
The security audit at your corporate customer doesn't close. An increasingly common scenario: an SME sells to a corporation, the corporation sends a security questionnaire (often driven by DORA, NIS2 or internal policy), one of the first fields asks for OS versions. "Windows Server 2012 R2" in that field effectively means the contract is at risk. We saw a logistics services provider lose a three-year contract worth PLN 1.2M/year because they wouldn't migrate a PLN 30k server.
New versions of business software stop installing. Since 2024 Comarch no longer certifies the latest Optima versions on Windows Server 2012 R2. enova365 the same. Subiekt GT still installs, but new releases increasingly need a newer .NET that no longer exists on 2012 R2. In practice this pulls you backwards on both the OS and the business application you actually run on.
The combination of these three means "let's wait it out" is not a strategy. It's a delay that costs you a rising ESU bill every month (Microsoft raises the price each year), rising risk and a growing list of closed doors.
Concrete case: 25-person packaging manufacturer
One of our clients — a 25-person manufacturer of cardboard packaging — until last year ran its entire IT on a single Windows Server 2012 R2 machine. The server hosted Comarch Optima in a 2019 release, file shares, the Active Directory domain controller and printing. The physical hardware was 8 years old, SATA disks in RAID 1, 32 GB RAM. Backup to a NAS once a day, off-site copy once a week on an external drive that went home with the owner.
"Everything works" — said the owner when we came in to run an audit at the request of a new corporate customer. The customer required filling in a cybersecurity questionnaire. Filling it in honestly meant ticking "operating system without vendor support", which in that corporation was automatic disqualification for a supplier.
We proposed three options:
- Option 1 — new physical server, Windows Server 2022, migration of Optima to the latest release, one-off hardware + labour cost: around PLN 38k, plus the existing running costs.
- Option 2 — move Comarch Optima to Comarch Cloud (SaaS), file shares to SharePoint, retire the physical server: around PLN 12k one-off + PLN 2,100/month subscription (net monthly increase of about PLN 1,200 vs current run cost).
- Option 3 — hybrid: Optima in Comarch cloud, but keep a small on-prem server (Windows Server 2022 Essentials) for file shares, printing and AD, cost: around PLN 22k one-off + PLN 1,600/month.
The client picked option 2. Migration took 6 weeks, including one cutover weekend (Friday evening to Sunday evening). On Monday morning 25 people logged into Optima in the cloud and worked. The physical server was retired after two weeks of observation. The corporate contract was signed a month later.
Importantly: for that firm, "doing nothing" would have meant losing the contract (PLN 600k/year over 3 years) plus elevated risk of an uninsured ransomware loss. Option 2 paid for itself in the first month of the new contract.
Three migration paths SMEs choose between
There is no single right answer. There are three typical paths, and the choice depends on how much on-prem you have, how stable your internet is, and how badly you want to own a server rack.
Path A: New on-prem server (Windows Server 2022 or 2025). You buy a new physical server (or a second VM on an existing Hyper-V/Proxmox host), install current Windows Server, migrate the roles. Hardware for 20-50 users: PLN 20-45k. Windows Server 2022 Standard licence: PLN 5-7k. Migration labour: PLN 15-25k. This path makes sense if you have a decent backup internet link, a proper air-conditioned server room, and genuinely need on-prem (e.g. large CAD files, a heavy Optima database of 50+ GB).
Path B: To the cloud with the application vendor. Comarch, enova, InsERT — they all offer SaaS/cloud versions of their systems. You don't migrate a server, you move the application and data into the vendor's environment. Per-user monthly model, no hardware. Makes sense for firms wanting to get rid of a server room and with good internet. Risk: vendor cloud lock-in, harder custom integrations, higher costs on a 5-year horizon.
Path C: Hybrid — public cloud (Azure/AWS) plus SharePoint. You run the application server (Optima, SQL Server) as a VM in Azure, files on SharePoint/OneDrive, identity in Entra ID (formerly Azure AD). This gives flexibility and full control but requires IT competence (in-house or from a partner). Cost starts at PLN 1,500-3,000/month for just the Azure infrastructure for a 20-person firm.
In practice most SMEs we advise end up on a mix of B and C: the accounting/warehouse application in the vendor's cloud, identity and files in Microsoft 365, no physical server on site. This is usually the simplest to operate and the cheapest over 3 years.
What not to do, even though intuition suggests it
A few choices that look sensible at first and end badly:
- Buy ESU "forever". ESU was meant to be a bridge. The price rises every year (typically 100% in year two, 100% in year three). After two years ESU costs more than migration. It's a bridge, not a destination.
- Migrate "when we have time" with no date. We've seen five firms that had migration "planned" since 2023 and still didn't have it done in 2025. Without a specific calendar date (and a budget assigned to a quarter) it simply doesn't happen.
- Do an in-place upgrade from 2012 R2 to 2019/2022. Microsoft supports this only partially (2012 R2 → 2016 → 2019 → 2022, one step at a time), and each step can break something. A clean install of 2022 on new hardware with role migration is cheaper and more reliable than three in-place upgrades.
- Assume backup is enough as a plan. Backup saves you from data loss. It doesn't save you from OS code vulnerabilities that someone is walking through right now. Backup and active vendor support are two different layers of defence.
- Migrate the server but leave the Windows 10 workstations. Windows 10 ends support in October 2025. If you're already looking at a server migration, plan a second workstation project at the same time — same team, same moment to tidy up hardware.
Where to start this week
If after this post you're thinking "I think we have 2012 R2 or 2016 but I'm not sure", do this in order:
- Check what you have. Log into the server (or ask your IT person), run
winverat the command line — it shows the version and build. Write it down. - Check what runs on it. Comarch Optima in which version? SQL Server in which version? AD domain controller? File shares? Printing? Make a simple list on paper — three lines of text, but key to the next conversation.
- Check the cyber policy. If you have one, read the clauses on "unsupported systems". If there's no clear wording, ask the broker in writing: "Does our policy cover ransomware losses if our Windows Server 2012 R2 has no active ESU?". Keep the answer in writing.
- Put migration into the 2026 budget. Even if you don't know which path you'll pick, reserve PLN 30-60k for the migration project. Without a budget slot nothing happens.
- Ask for a comparative quote for all three paths (A, B, C above). You don't have to decide immediately — comparing headline numbers and 5-year TCO usually points to the answer.
Migrating an old server is a boring project. There's no glory in it, no AI, nothing to brag about on LinkedIn. But it's one of those projects whose absence throws your company out of contracts, out of insurance, and — sooner or later — off the network, because someone accidentally encrypts your files. Do it before someone does it for you at an inconvenient moment.
If you want to discuss which path fits your situation — hardware, applications, connectivity, people — the first conversation is 30 minutes and free.
A server that "runs" but no longer gets patches is a server that runs right up to the moment someone walks in.