Windows Server 2016 end of support arrives on January 12, 2027. After that date, Microsoft stops shipping security updates, bug fixes, and technical support for every edition of Windows Server 2016, including Windows Server 2016 Standard and Datacenter. The servers keep running, but every vulnerability found after that day stays open.
For most organizations in the United States and elsewhere, that leaves three realistic paths: upgrade to a supported Windows Server version, buy Extended Security Updates (ESU) as a short bridge, or move the workload to Microsoft Azure or a SaaS replacement. This guide walks through each option, the migration planning steps that come before it, and the workload-specific traps that turn a simple upgrade into a weekend of rollback.
If you only have a few minutes: inventory your servers this month, pilot your first upgrade before the holiday freeze window, and treat ESU as a paid option for the servers you genuinely cannot move in time.
What Windows Server 2016 End of Support Actually Means
Windows Server 2016 follows Microsoft’s Fixed Lifecycle Policy: five years of mainstream support, then five years of extended support. Mainstream support ended on January 11, 2022. Since then, the product has received no new features, only security updates and limited product fixes.
The end of extended support on January 12, 2027
January 12, 2027 is a Patch Tuesday, and it brings the last normal security updates Windows Server 2016 will receive. From January 13 onward, the normal security-update stream stops. Critical and important security updates, bug fixes, broader servicing, and Microsoft technical support all end on the same day.
Two related dates are easy to confuse:
System Center 2016 ends one day earlier, on January 11, 2027, so ConfigMgr-era tooling and Operations Manager agents may need attention first.
Workloads on top of the OS have their own clocks. Exchange Server 2016 already left support in October 2025, and SQL Server 2016 followed in July 2026.
WME’s Microsoft migration deadline tracker lists the full calendar of related dates.
The Real Risks of Running an Unsupported Server
An unsupported server does not fail on January 13. It becomes easier to attack every month after, and harder to defend to auditors, insurers, and vendors.
Security vulnerabilities stay open. Attackers study patches for newer Windows Server versions to find the same flaws in older ones. Exposed services such as RDP, SMB, the Print Spooler, and the TCP/IP stack are common targets for cyberattacks, ransomware attacks, and malware infections.
Compliance risks and audit pressure grow. Frameworks such as the CIS Controls expect supported software. Auditors will ask for compensating controls, and those cost time and money.
Cyber insurance gets harder. Cyber insurance questionnaires routinely ask about end-of-life systems, and some cyber insurance policies limit coverage after data breaches traced to them.
Software vendors move on. Security tools, backup agents, and line-of-business apps drop support for old platforms, so vendor compatibility erodes even before Microsoft’s date.
Operations get worse. Outdated hardware, performance degradation, longer recovery times, and rising maintenance and operational costs all add to your technical debt.
Incidents get harder to resolve. Without Microsoft technical support, incident-response assistance on a breached 2016 server depends entirely on your own team and partners.
Step 1: Inventory Every Windows Server 2016 Machine
You cannot pick a path until you know what you have. Most server upgrade assessments start with three lists: servers, what runs on them, and what they run on.
Find the servers
Start with Active Directory, then cross-check your hypervisor inventory, RMM tool, and CMDB. Servers that never joined the domain, such as appliances and NAS devices running Storage Server editions, are the ones teams miss. These PowerShell commands give you a starting list:
# Domain-joined Windows Server 2016 machines
Get-ADComputer -Filter 'OperatingSystem -like "*Server 2016*"' -Properties OperatingSystem, LastLogonDate |
Select-Object Name, OperatingSystem, LastLogonDate
# On each server: edition, Server Core vs. Desktop Experience, build, BIOS
Get-ComputerInfo | Select-Object CsName, WindowsProductName, WindowsInstallationType, OsBuildNumber, BiosSMBIOSBIOSVersion
# Installed server roles and features
Get-WindowsFeature | Where-Object InstalledMap what runs on them
For each server, record its server roles, line-of-business apps, database engines, and application dependencies. Ask software vendors which supported Windows Server version they certify, and flag legacy applications with no upgrade path. Application compatibility is the most common reason an upgrade slips.
Check what they run on
Hardware dependencies matter as much as software. Check each host’s warranty date, firmware and BIOS update status, and whether hardware manufacturers support the target OS. Note licensing too: OEM licenses are tied to the original hardware, and your KMS host needs a new key before it can activate newer servers.
Use ISO 8601 dates (2027-01-12) for warranty and retirement dates so your inventory sorts cleanly. The result is your server and infrastructure review: the list each decision below is made from.
Option 1: Upgrade to a Supported Windows Server Version
For most on-premises workloads, upgrading is the default answer. The first decision is which version to target.
| Target version | Mainstream support ends | Extended support ends | Verdict |
| Windows Server 2025 | November 2029 | November 14, 2034 | Best target for new builds |
| Windows Server 2022 | Ended October 13, 2026 | October 14, 2031 | Only if an app is not certified on 2025 |
| Windows Server 2019 | Ended January 9, 2024 | January 9, 2029 | Buys about two years; avoid |
On a phone, scroll the table sideways to see every column.
Source: Microsoft Lifecycle
In-place upgrade vs. clean install
Windows Server 2025 supports a direct Server 2016 to 2025 in-place upgrade, keeping roles, settings, and data. It is fast, but it carries old drivers, registry clutter, and configuration drift onto the new OS. An in-place upgrade also cannot switch between Server Core and Desktop Experience.
A clean install with role migration builds a fresh server and moves roles and data across. It takes longer but leaves a clean migration with no inherited problems. Use it for domain controllers, file servers, and anything business-critical.
Whichever method you pick, test it first. Take a clone test of the server’s VHD, run the upgrade from current installation media in an isolated network, and check that every service starts before you touch production.
Watch for compatibility limitations
The OS is rarely the blocker; what runs on it is. SQL Server 2016 is supported only up to Windows Server 2019, so a SQL host on Server 2025 also needs a newer database version. For clusters, a cluster rolling upgrade can move nodes without downtime, but supported paths vary, so confirm the hops before you plan the weekend.
Every server needs a path before January 12, 2027. Do you know yours?
We can turn your server list into a dated plan, mapping each 2016 machine to upgrade, ESU, or Azure.
Option 2: Buy Extended Security Updates (ESU)
Extended Security Updates are a paid option that keeps critical and important security updates flowing for up to 3 years after the deadline, through 2030, for Standard and Datacenter editions. Microsoft announced ESU for Windows Server 2016 in February 2026, delivered through Azure Arc with subscription billing for on-premises servers.
Treat ESU as a security-only bridge, not a destination:
What you get: security patches for critical and important vulnerabilities.
What you don’t get: new features, non-security bug fixes, or a fix for vendor compatibility. Your backup agents and security tools may still drop 2016.
What it costs: confirm current pricing with Microsoft or your licensing partner. In past ESU programs, costs rose each year, so a three-year bridge was the most expensive way to stand still.
ESU makes sense for a short list of servers: a legacy application waiting on a vendor, a system mid-way through a phased migration, or a server you plan to retire in 2027. Don’t count on a Custom Support Agreement as an alternative; for Windows Server 2016, ESU is the path Microsoft offers.
Before you buy, confirm eligibility, licensing, and Azure Arc onboarding in Microsoft’s ESU FAQ. Good ESU planning and guidance means buying coverage only for the servers you have a dated exit plan for.
Option 3: Move the Workload to Azure or SaaS
The deadline is also a chance to ask whether a server needs to exist at all. Cloud migration turns an upgrade project into infrastructure modernization, and Microsoft is offering benefits through Azure to encourage it.
There are three common patterns:
Rehost on Microsoft Azure. Move the VM to Azure and upgrade it there, or rebuild it on Windows Server 2025. This removes the hardware refresh from the equation.
Replace the server with a service. File shares can move to Azure Files, or to SharePoint and OneDrive for user content. Identity and authentication can lean more on Entra ID.
Retire the app. A SaaS replacement for an aging line-of-business app often costs less than keeping its server alive.
Workload-Specific Gotchas
Generic upgrade advice breaks down at the role level. These are the workloads that cause the most rework.
Domain controllers and Active Directory
Don’t in-place upgrade a domain controller. Build a new Windows Server 2025 DC, let Active Directory Domain Services replicate, transfer the FSMO roles, then demote and remove the old server. Confirm DNS, DHCP, and time sync have moved before you decommission.
File servers
Use Storage Migration Service to inventory shares, copy data, and cut over the server’s identity. Verify NTFS permissions after the copy, update DFS namespaces to point at the new targets, and schedule the final synchronisation for a quiet window.
Remote Desktop Services
RDS licensing is the trap. RDS CALs must match or exceed the version of the RDS hosts, so 2016 RDS CALs won’t license Windows Server 2025 session hosts. Budget new client access licenses, and upgrade RD Gateway, which is internet-facing and a prime target.
Hyper-V hosts
Plan a Hyper-V host upgrade node by node, using live migration to move VMs off each host first. Check networking: older NIC Teaming (LBFO) is not supported for Hyper-V virtual switches on newer versions, so plan a move to Switch Embedded Teaming.
Exchange and SQL Server
Exchange Server 2016 and SQL Server 2016 are already out of support, so upgrading the OS underneath them doesn’t fix the risk. Plan the application move first, to Exchange Online or Exchange Server Subscription Edition, and to a current SQL Server release, then retire the 2016 host.
Pilot, Rollout, and Rollback Plan
With less than three months left, sequencing matters more than speed. Phased migrations with staggered rollouts keep one bad upgrade from becoming an outage.
Pick a pilot. Choose two or three low-risk servers that represent your common builds.
Write pilot acceptance criteria. Define success before you start: services running, apps passing smoke tests, monitoring and backup agents reporting, and users able to work.
Set a rollback trigger. Decide in advance what failure looks like (for example, an app down for more than 30 minutes) and keep a snapshot or backup so rollback takes minutes, not hours.
Schedule around the freeze window. Many organizations freeze changes in late December. Plan to finish pilots in November and business-critical workloads in early January, before January 12, 2027.
Roll out in waves. Move from low-risk to business-critical workloads, with planned downtime communicated to owners for each wave.
Run validation steps after every wave. Check event logs, patch status, application health, and security tooling before you start the next one.
Upgrade, ESU, or Azure: Which Path Fits?
Most organizations end up using all three, server by server.
| Path | Best for | Main trade-off |
| Upgrade to Windows Server 2025 | Workloads that must stay on-premises and are certified on 2025 | Hardware readiness and app testing take time |
| Extended Security Updates | Servers with a dated exit plan that can’t move by January 12, 2027 | Paid, security-only, and temporary |
| Move to Azure or SaaS | File shares, aging apps, and servers due a hardware refresh | Needs cost modeling and may change how users work |
On a phone, scroll the table sideways to see every column.
Frequently Asked Questions
When is Windows Server 2016 end of support?
Extended support ends on January 12, 2027. Mainstream support already ended on January 11, 2022.
Will Windows Server 2016 stop working after January 12, 2027?
No. Servers keep running, but they no longer receive security updates, bug fixes, or Microsoft technical support.
Can I upgrade directly from Windows Server 2016 to 2025?
Yes. Windows Server 2025 supports an in-place upgrade from 2016. For domain controllers and business-critical servers, a clean install with role migration is usually safer.
How long do Extended Security Updates last?
ESU for Windows Server 2016 covers up to 3 years, through 2030, for Standard and Datacenter editions.
Does Windows Server 2016 Standard get the same end date as Datacenter?
Yes. Windows Server 2016 Standard, Datacenter, and Essentials all reach end of extended support on the same date.
Get a Windows Server 2016 Upgrade Path Review
Windows Management Experts helps IT teams turn a server list into a dated plan. Our Microsoft Architecture & Migration and Licensing Optimization teams provide:
Server upgrade assessments that map each 2016 server to upgrade, ESU, or Azure.
Migration planning for domain controllers, file servers, RDS, and Hyper-V clusters.
ESU planning and guidance, so you only pay for coverage you need.
Azure and cloud migration support from cost modeling through cutover.
With January 12, 2027 approaching, every week counts. Book a server and infrastructure review and get a clear path for every server before the deadline.
With January 12, 2027 approaching, every week counts.
Get a clear path for every server before the deadline: upgrade, ESU, or Azure, mapped server by server.
