Just this past week, one of our consultants was calculating ESU costs for a customer after they got sticker shock. Based on reseller guidance, estimated cost for a single VMware cluster was ~$250,000 per year. We landed on <$10,000 for the same coverage.
Microsoft is charging customers (2-core ESU is ~$100 for Standard, ~$600 for Datacenter) to patch their legacy systems for a reason: make it hurt to stay where they are while providing relief in the form of incentives.
Two weeks ago, on October 10, 2023, customers unable or unwilling to move Windows Server 2012 or 2012 R2 (“Win2012”) systems to Azure had to start paying to patch security holes. These security patches, called Extended Security Updates (“ESU”), incur costly fees. To help customers avoid fees to securely run these old systems, Microsoft put incentives in place for customers to migrate to… you guessed it… Azure. Their offerings are:
Move systems to Azure, get ESU “free of charge” for up to 3 years
HOWEVER: We think that “free of charge” should read, “free of additional charges” since systems already incur charges including compute, storage, licensing, and other fees – not to mention migration costs.
Connect to Azure Arc and pay monthly for ESU until you can retire those pesky old systems
HOWEVER: Monthly fees can end up as “set it and forget it,” systems might be unable to be retired, IT security may not approve the Azure Arc connection to Microsoft, and Microsoft has visibility to your systems.
Many companies have been doing great work retiring Win2012 systems. Unfortunately, those efforts may be incomplete. Buying time with ESUs can be more cost effective than buying a new solution, but be aware of misconceptions, including:
Windows Server Software Assurance (“SA”) is required under an Enterprise Agreement (“EA”).
SA is required for the duration of the ESU coverage (monthly this is true but annual it is not!).
Windows Server Datacenter edition licensed hosts require Datacenter ESUs.
Systems hosted by cloud providers (AWS, GCP, OCI, etc.) include ESU.
If you want all Win2012 systems patched, everything requires ESUs.