Yesterday was the day. Office 2021, Windows 11 Home and Pro version 24H2, and the last paid year of Windows Server 2012 updates all reached the end of their support on 13 October US time, which was 14 October here. If you did last week’s check, you have a list of machines.
Here’s what to do with it.
What changed, and what didn’t
What changed: those products stopped receiving security updates. Microsoft’s 2026 end of support page lists them, and says there are no new security or non-security updates after that date.
What didn’t change: everything still works this morning. Office 2021 still opens. A 24H2 laptop still boots. The old server still shares its files. Nothing switched off.
That’s exactly why this date is easy to ignore. The risk doesn’t show up on a screen. It shows up months later, when a security problem is found that the next update would have fixed, and that update never arrives.
Give every line on the list one of three decisions
1. Update it
For a Windows 11 Home or Pro PC on 24H2, this is usually straightforward. The version to move to is 25H2, supported until 12 October 2027 US time, according to Microsoft’s Windows 11 release information. Run Windows Update, install the feature update and let it restart. If it won’t install, that PC moves to the next column.
For Office 2021, updating means moving that person to a Microsoft 365 plan that includes the desktop apps. Check any add-ins and templates first.
2. Replace it
This is for hardware that can’t take the update, or a Server 2012 machine with nothing left to buy. Microsoft’s lifecycle FAQ says paid Extended Security Updates are available for up to three years after end of support, and for Server 2012 the third year is the one that just finished.
Replacement needs a plan rather than a panic. For a server, start with what runs on it and who supports that software, then talk about hardware.
3. Accept the risk, in writing, with a date
Sometimes a machine can’t change yet. The PC that runs one piece of lab equipment. The server holding an app the vendor is still rebuilding for a newer platform.
That’s a legitimate decision, as long as it’s made on purpose and written down. Record:
- Which machine it is, and what it does
- Why it can’t be updated or replaced yet
- What you’re doing to reduce the risk in the meantime, such as keeping it off email and web browsing, limiting who can sign in, or separating it on the network
- Who made the decision
- The date you’ll look at it again
One caution, from Microsoft’s own FAQ: “Third party application control solutions are not a replacement for product security fixes.” Extra protections reduce the risk around an unsupported machine. They don’t patch it.
Why a written decision helps later
At some point someone will ask what software you run. It might be a client’s supplier security questionnaire, a cyber insurance renewal, or a certification such as SMB1001, which Bastion holds at Gold level. Whatever the exact question, a list showing each unsupported machine, the decision made and the date it’ll be reviewed is a much better answer than finding out on the day.
It also stops the same machine being rediscovered every year. Once there’s a date against it, it comes back up when it should.
Put an owner beside every line
The list isn’t finished until each line has three things: a decision, a person responsible and a date. Aim to have that done by the end of October, while the details are fresh.
If you’d like help deciding which column a machine belongs in, get in touch.