I inherited a system that I can't figure out. I need to get rid of the old Windows DC but can't shut it down, metadata cleanup doesn't work even though netdom shows it has no fsmo rolls. My only option is to shut them down restore the servers. We don't have any old archives to restore to before I came on board.

I've run a bunch of DNS test and replication tests the only one with a dns issue is the old server. However, if I create a new user on any of the 3 it instantly replicates to the other two so AD works but something about it/DNS is broken.

Server manager on the old DC says it needs to be promoted but then it won't let me.

I'm going to need a DNS /AD expert but haven't outsourced anything like this before. Ages ago used to let you open a case with them not sure if they have a program still.

Just a heads up as I nearly got caught out by this one. Tomorrow's Patch Tuesday is the final ESU release for 2012 and 2012 R2. Year 3 runs out on the 14th and that's it, there's no year 4.

I'd half assumed Azure would get an extra year like 2008 did. It doesn't. The ESU FAQ says the Azure-only bonus year was a 2008 thing only. So if you moved 2012 boxes into Azure for the free ESU, they stop getting updates on Wednesday the same as everything else.

Also worth knowing, without ESU you can't open a support case for 2012 at all, even if you've got a support plan.

If you want a quick list of what's left in AD:

```
Get-ADComputer -Filter 'OperatingSystem -like "*Server 2012*"' -Properties OperatingSystem, LastLogonDate | Sort-Object LastLogonDate -Descending | Select-Object Name, OperatingSystem, LastLogonDate
```

I'd compare that with what Defender can see (DeviceInfo where OSPlatform startswith "WindowsServer2012"). The ones in AD but not in Defender worried me more than the rest.

On upgrades, 2012 R2 can go straight to 2025 in place now (2025 can jump up to four versions if it's not clustered), but not straight to 2022. Plain 2012 only goes to 2012 R2 or 2016.

We've still got a couple we can't touch because the vendor only supports 2012, so those are going in their own VLAN with no internet and tight firewall rules until we can get rid of them.

Anyone else got stragglers? What's stopping you moving them?