Windows Server 2016 reaches end of support on January 12, 2027. After that date Microsoft stops releasing security updates for it, so any new flaw found in the operating system stays open. The server keeps running, which is exactly why this deadline gets missed. You have four realistic options: upgrade the server in place to a newer version, move the work to a new server, move it to a hosted server or the cloud, or pay Microsoft for Extended Security Updates, which cover the most serious patches for up to three more years. For most small businesses the right first step is an inventory of every server running 2016 and what each one actually does. Then decide server by server. Waiting past January won’t save you money.
Key Takeaways
- Windows Server 2016 gets its last security update in January 2027, and nothing after that without a paid add-on.
- Find every 2016 server first, including the ones nobody thinks of as a server.
- Upgrading, replacing, or moving to a hosted server ends the problem. Extended Security Updates only delay it.
- Extended Security Updates have licensing strings attached, and signing up late doesn’t lower the bill.
- Internet-facing servers and domain controllers go to the front of the line.
What actually changes on January 12?
Think of your server as a building, and Microsoft as the locksmith who’s been coming by every month for about ten years. Each visit, they swap out the locks somebody figured out how to pick, and most owners never notice. That’s how it’s supposed to work.
On January 12, 2027, he stops coming. Microsoft’s lifecycle page for Windows Server 2016 lists that date as the end of extended support for the Standard, Datacenter, and Essentials editions. Mainstream support ended in January 2022, so for almost five years the only thing this server has been getting is security fixes. Those fixes are what end in January.
Nothing looks different the next morning. The building is still standing, the file shares still load, and the accounting software still prints invoices. The difference is the locks. From then on, any new hole somebody finds stays pickable, and no one is coming to close it.
My server works fine. Why does this matter?
This is the objection I hear most, and I get it. The server works, replacing it costs money, and it causes a weekend of headaches. Why poke it?
Because the people picking locks know exactly which buildings stopped getting visits, and end-of-support dates are public. When Microsoft patches a security hole in a newer version of Windows Server, attackers can check whether the same hole exists in 2016, and from January on, nobody is coming to close it. You don’t get to choose whether you end up on that list. Being a 25-person office in northwest Iowa doesn’t take you off it, because most of this starts with automated scanning that never checks how big you are. It just looks for what’s exposed.
CISA, the federal cybersecurity agency, puts the use of unsupported software on its short list of exceptionally risky bad practices, and calls it especially bad for anything reachable from the internet. In building terms, that’s the front door. A server sitting behind a good firewall with no outside access is a back room. It still needs locks, but it isn’t the first door anyone tries.
There’s a paperwork side, too. If you renew cyber insurance, expect the application to ask whether anything in your environment is past end of support. We covered that in our post on what cyber insurers expect now. “Yes, and we have no plan” is a bad answer to give an underwriter.
How do I know if we’re running Windows Server 2016?
On the server itself, press the Windows key and R, type winver, and press Enter. The window that pops up tells you the version. That’s the easy part.
The harder part is finding all of them. In a small office, Windows Server 2016 tends to hide in a few places:
- The domain controller that handles everyone’s logins, often the oldest box in the closet.
- A file server that has been “temporary” since 2017.
- The server running your practice management, accounting, or ERP database, sometimes because the software vendor only certified it on 2016.
- A Hyper-V host, plus every virtual machine on it. A host running 2019 can still have 2016 guests underneath.
Check what runs on top of the server while you’re at it. SQL Server 2016, which a lot of line-of-business apps quietly install, already reached the end of its extended support in July 2026. If your app vendor’s database is on that version, you have two deadlines, and one of them already passed.
Write down what each server does and who would notice if it disappeared for a day. You’ll need that list for every decision that follows.
What are my options?
There are four. The first three get you a new set of locks. The fourth pays the locksmith to keep coming, on limited terms.
Upgrade the server in place
This keeps the same hardware and the same building, and swaps the locks. Microsoft’s supported upgrade paths let a 2016 server go straight to Windows Server 2019, 2022, or 2025, as long as it isn’t part of a failover cluster. Clusters have to step up one version at a time.
Two cautions. First, Microsoft’s own in-place upgrade guidance says not to use it on domain controllers. Build a new domain controller and retire the old one instead. Second, the same guidance asks for a full backup and a restore test before you start. Take that seriously. The most common thing we find in a first audit is a business with no backup it could actually restore from, and an upgrade is the wrong day to learn that.
My honest opinion: for a file server that has been running since 2017, I’d usually rather build fresh than upgrade in place. An upgrade carries along nine years of software somebody installed and forgot about, and if the hardware is that old, the next question is whether you want to spend a Saturday upgrading a box that may not have many years left in it anyway.
Move to a new server
This is moving into a new building: new hardware, a current version of Windows Server, a planned cutover. It costs more up front, and it’s the cleanest result. If your 2016 server was bought around the time it was installed, it’s likely out of warranty, and this is usually where we land. If you followed our 2027 IT budget planning post, this is the line item it told you to fund.
Move to a hosted server or the cloud
This is renting space from a landlord who handles the locks. Some workloads don’t need a box in your closet at all. Files and email often fit well in Microsoft 365. An app that has to stay on Windows Server can run on a hosted server instead, which is one of ANP’s cloud based solutions. You still have to plan the move, and you still need a current, supported version of Windows Server underneath it. What you stop doing is owning the hardware.
Buy Extended Security Updates
This is paying the locksmith to keep visiting after his contract ends. Microsoft sells Extended Security Updates for Windows Server 2016 through Azure Arc, covering Critical and Important security fixes for up to three years, through 2030. He only fixes the serious locks. No new features, and no fixes for problems that aren’t security problems.
Read the fine print before you count on it:
- Microsoft lists Standard and Datacenter editions as eligible. Essentials, which plenty of small offices bought, isn’t on that list.
- Buying them requires Software Assurance through a volume licensing program, or a subscription or SPLA license. If your Windows Server license came bundled with the hardware, which is common for small offices, you may not qualify.
- The usual route is Azure Arc, Microsoft’s management service, which means connecting the server to Azure. That’s one more thing to set up and keep running.
- Through Azure Arc, billing is monthly, per core, starting January 13, 2027. If you sign up later, Microsoft’s billing terms for Extended Security Updates back-bill you to the end-of-support date. Waiting doesn’t save anything.
I’m fine with Extended Security Updates for the one server you truly can’t move in time, usually because a software vendor is dragging its feet. I don’t like them as a plan. You pay every month to keep a building you’ve already decided to leave, and the bill keeps coming until you finally move.
Can we really get this done by January?
For a typical small office, yes, for most of it. From the end of November, that’s about six weeks, with Christmas and New Year’s in the middle. So don’t try to do everything at once. Triage.
Start with the front doors. Anything reachable from the internet, like a server running remote desktop or a web-facing app, gets fixed or locked down first. Then the domain controller, because everything else depends on it. Then the servers holding the data you’d miss most. A file share nobody has opened since 2021 can wait.
Before you touch any of it, get a backup and test the restore. I’ll keep saying that until people stop being surprised by it.
If one server genuinely can’t move before the deadline, that’s where Extended Security Updates earn their keep. Put a date on the replacement anyway, so the bridge doesn’t become the plan.
Where ANP fits
This is the kind of project our process was built for. Every engagement at Advanced Network Professionals starts with an audit, so the first thing we do is find every server and virtual machine running 2016, what runs on it, how it’s licensed, and which edition it is. That tells you right away whether Extended Security Updates are even on the table. From there we put a plan on paper server by server, do the work, and schedule the cutovers around your business instead of in the middle of it.
We’re a local team in Spencer, Microsoft and Fortinet certified, and our managed IT services include 24x7x365 support for when something breaks. When the old hardware comes out, we recycle it responsibly. If you’re weighing whether to hand this kind of work to an outside team at all, our guide to managed IT vs. in-house vs. break-fix lays out the trade-offs.
Frequently Asked Questions
What happens if I do nothing by January 12, 2027?
The server keeps running, and Microsoft stops sending security updates and stops offering support for it. Any vulnerability found after that date stays open on your server unless you’re enrolled in Extended Security Updates. Expect insurers and auditors to start asking about it, too.
Can Windows Server 2016 upgrade directly to Windows Server 2025?
Yes, for servers that aren’t in a failover cluster. Clustered servers have to upgrade one version at a time. Microsoft advises against in-place upgrades on domain controllers, so plan to build a new one and retire the old one.
How long do Windows Server 2016 Extended Security Updates last?
Up to three years after end of support, through 2030. They include only Critical and Important security fixes, with no new features or general bug fixes. Billing starts January 13, 2027, and late enrollments get back-billed to the end-of-support date.
Do I have to buy new server hardware?
Not always. If the hardware is still in good shape, an in-place upgrade may be all you need, and some workloads can move to a hosted server or Microsoft 365 instead. That said, a server bought around 2016 is likely out of warranty, and that usually makes replacement the better long-term buy.
Does this affect our workstations?
Not directly. This deadline is for Windows Server 2016, the operating system on servers. Your users’ PCs follow their own support dates, so it’s worth checking those in the same inventory.
Six weeks is enough if you start now
You don’t need to fix every server by January. You do need to know which ones you have and what you’re doing about each. If you want a second set of eyes on that list, request a quote from our team and we will start with an audit.