Decide per server
| Choose | When |
|---|---|
| Rebuild on a new VM | Stateless or IaC-built servers, web/app tiers, anything you can redeploy |
| In-place upgrade | Hard-to-rebuild servers (old installers, unknown config), a short timeline |
| ESU as a bridge | The app vendor does not support the new OS yet |
| Replatform | The workload can move to PaaS (App Service, Azure SQL) instead |
Rebuild is cleaner and leaves no legacy cruft; in-place is faster per server. Check the supported upgrade paths (you can jump a limited number of versions per upgrade) in current documentation.
1. Inventory
Heartbeat
| where TimeGenerated > ago(1d)
| summarize arg_max(TimeGenerated, OSName, Version) by Computer
| where OSName has "2012" or OSName has "2016"
Or with Azure Resource Graph:
az graph query -q "Resources | where type =~ 'microsoft.compute/virtualmachines' | extend os = tostring(properties.extended.instanceView.osName) | where os has '2012' or os has '2016' | project name, resourceGroup, os"
2. Azure in-place upgrade
Azure supports in-place upgrade of Windows Server VMs using an upgrade media managed disk:
- Back up the VM (or snapshot the OS disk). Non-negotiable.
- Create the upgrade media disk from the
WindowsServerUpgradeimage in the target region (Microsoft publishes a PowerShell script for this in the in-place upgrade documentation) and attach it to the VM. - In the VM, run setup from the attached disk:
D:\setup.exe /auto upgrade /dynamicupdate disable /eula accept
- Use the serial console or boot diagnostics to watch progress; the VM reboots several times.
- Detach and delete the upgrade disk.
Warning
Domain controllers, cluster nodes and servers with roles like ADCS need their own upgrade procedures. Don't in-place upgrade a DC — add a new DC on the new version and demote the old one.
3. Post-upgrade checks
- Azure VM agent and extensions healthy (
az vm get-instance-view). - Application services started; test the app.
- Activation status (
slmgr /dlv) and licensing. - Re-run the vulnerability scan and patch to the latest cumulative update.
4. Rebuild path
Build the new VM from a current image with IaC, reinstall the app with scripted config, migrate data (Robocopy, database backup/restore), switch DNS or load balancer backends, and keep the old VM stopped for rollback.
5. Extended Security Updates
Windows Server 2012/2012 R2 on Azure VMs receive ESUs at no extra cost for the eligible period. For on-premises machines, ESUs can be enabled and billed through Azure Arc. ESU only buys time — schedule the real upgrade.
Checklist
- Every EOS server has a decision: rebuild, upgrade, replatform or bridge
- Backup taken immediately before each upgrade
- App owner sign-off after upgrade
- ESU status verified for any server still on an old OS