## TL;DR
ESU updates on Server 2012 R2 fail despite activation when one of the prerequisites is missing: the required servicing stack update, the ESU licensing preparation package, the latest SHA-2 support, or the activation was applied with the wrong key type for how the server gets updates. Verify prerequisites in order, confirm activation status with the licensing tools, and confirm the ESU add-on key shows installed and activated. Then scan again - ESU patches are only offered when every prerequisite checks pass.

```text
esu updates not installing on windows server 2012 r2 after license activation
```

## Use this when
- The server shows ESU activated but ESU security updates fail to install or are never offered.
- The server was activated recently and its first ESU patch cycle is failing.
- Installed updates history is missing one of the known ESU prerequisite updates for 2012 R2.

## Not for this skill when
- The organization has no ESU entitlement for this server. Licensing must be resolved first; there is no technical workaround.
- The server is a different release with its own ESU program and different prerequisites. Follow that release program guidance.

## Steps
1. Confirm the licensing state precisely: run the software licensing management script status output and the ESU specific activation checks, and record whether the ESU add-on key is installed, whether it shows licensed, and which key it is - a multiple activation key used directly versus an activation through Azure Arc or a management tool follow different paths. Do not proceed on the word activated from a console note; get the tool output. Verify: the licensing output shows the ESU key installed and licensed, or names the exact activation problem to fix with your licensing team
2. Verify the servicing prerequisites in order against the Microsoft ESU prerequisites for Server 2012 R2: the specified servicing stack update level, the ESU licensing preparation package, and the SHA-2 signing support updates must all be present before ESU patches will offer or install. List installed updates and install any missing prerequisite from the Microsoft Update Catalog, restarting between them if requested. Verify: every named prerequisite update is present in installed updates, confirmed by KB number
3. Check the update path the server uses: if it receives updates through WSUS or Configuration Manager, confirm the ESU product and classification are synchronized and approved, because an activated server scanning a source that never synced ESU content will simply never be offered the patches. If it uses an activation proxy or Azure connected method, confirm that component is healthy and current. Verify: the server update source demonstrably carries ESU content for 2012 R2, or the connected activation component reports healthy
4. Run a fresh scan and attempt the ESU update install, then read the Windows Update log and event entries for the specific result code if it still fails. With prerequisites and licensing in place, a remaining failure is an ordinary servicing problem and its code should be troubleshot with the matching servicing skill rather than more licensing changes. Verify: the ESU update installs, or it fails with a specific servicing code that becomes the next troubleshooting target
5. Document the server ESU state for compliance: activation proof, prerequisite KBs, and the first successfully installed ESU update, filed where your audit records live. ESU environments are audited, and a server that patches but cannot prove entitlement and prerequisites creates a finding later. Verify: the server file contains licensing proof, prerequisite evidence, and a successful ESU install record

## Why it happens
Extended Security Update delivery on an end of support release is gated by design: Microsoft offers ESU patches only to machines that prove ESU activation and carry the servicing prerequisites that let the older stack verify and install separately signed ESU packages. Activation alone opens only the first gate. A missing licensing preparation package, an old servicing stack, or missing SHA-2 support each block the patches in ways that look like licensing failures but are actually readiness failures, and a WSUS source that never synchronized the ESU classification blocks them for a whole fleet at once. Checking the gates in order - license, prerequisites, source - isolates which one is closed.

## Variants and edge cases
### ESU activated through Azure Arc but patches not offered
Arc-managed servers get ESU through the connected machine configuration. Verify the Arc agent health and the ESU assignment in Azure, not just the local activation state.

### ESU worked, then stopped after a rebuild or restore
A rebuild loses the preparation package and sometimes the activation. Reapply the prerequisites and reactivate as part of the rebuild checklist for ESU servers.

### One ESU update fails while others installed
With licensing proven by the successful ones, treat the single failure as an ordinary cumulative servicing problem and use its error code.

Compatibility: Applies to Windows Server 2012 R2 Extended Security Updates through WSUS, Configuration Manager, Windows Update, or Azure Arc, following Microsoft ESU prerequisite guidance for that release.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_vLPWN1XDQPRhozpYMXs5Yw