I would recommend standing up a test environment, possibly two, before upgrading any component that is in production.
So, it sound like you have a two tier or single tier environment running on a VM. Just a note, Symantec and Oracle does not recommend Oracle DB on a VM.
-Provision a new physical server/VM (Win2008)
-Take a backup of the DB and move/restore it to the new server
-Backup the cryptomasterkey on Enforce
-Install Enforce 11.6.2 (Do not initialize the DB) will ask for the Crypto key
-Upgrade the Enforce to 12, then to 12.5
Then repeat the process for Win2012
Note, only Oracle 11.2.0.4 is supported on Win2012 so you may have to upgrade the DB before moving it to Win2012.
Another alternative is to set up a new environment (Win2012) in parallel. And move your settings and policies etc. over, and then do a cut-over.