Windows Server 2016 Support Ends on 12 January 2027: What to Do Now

If a server in your business still runs Windows Server 2016, the calendar has become the main risk. Microsoft's lifecycle page lists extended support for Windows Server 2016 as ending on 12 January 2027 (the dates are shown in Pacific Time). That is roughly two months away.

Nothing breaks on the day. The server keeps booting and the applications keep running. What stops is the flow of security fixes, and that is the part that matters.

What "end of support" actually means

Windows Server 2016 left mainstream support in January 2022, so for the last few years it has received security updates only. Microsoft's Windows Server documentation explains the consequence of reaching the end: it means the end of security updates and bulletins, which "can cause security or compliance issues and put business applications at risk."

The UK National Cyber Security Centre (NCSC) describes the same pattern for any obsolete product. Without updates, exploitable vulnerabilities are more likely to become known to attackers, and over time new vulnerabilities can be exploited by relatively low-skilled attackers. The NCSC's blunt conclusion is that the only fully effective way to mitigate the risk is to stop using the obsolete product.

There is also a compliance angle. If you hold personal data or must meet an insurer's or customer's security requirements, an unsupported operating system is hard to defend in an audit or a questionnaire.

Your realistic options

Microsoft's own guidance points to three broad routes.

1. Upgrade the server

Microsoft's upgrade documentation shows that an in-place upgrade from Windows Server 2016 to 2019, 2022 or 2025 is supported using installation media. Microsoft's Windows Server blog describes Windows Server 2025 as the most secure and cloud-connected version.

Some caveats from the same documentation are worth planning around:

• Not every role supports an in-place upgrade, so check the role and feature matrix first.
• Each Windows Server version needs its own licence and activation method.
• Domain controllers have specific upgrade considerations.
• Microsoft says to always back up before an in-place upgrade, clean install or migration.

A clean build on new hardware, with applications and data migrated across, is often the tidier answer for older servers. It also gives you the chance to retire software nobody uses.

2. Move the workload to Azure

Microsoft also recommends migrating to Azure as an option, using its migration and modernisation programme. This suits workloads that no longer need to sit in your office or server room, but it deserves a proper cost and connectivity review before you commit.

3. Buy time with Extended Security Updates

Microsoft has announced Extended Security Updates for Windows Server 2016 delivered through Azure Arc, managed from the Azure portal. Microsoft's blog positions this as a way to avoid disruption for business-critical applications while you plan the move to an upgrade or to Azure.

Treat it as a bridge, not a destination. Microsoft's ESU overview, written for the older 2012 and 2012 R2 versions, calls the programme a "last resort option" and says the updates cover only critical and important security fixes for a limited period. The 2012 programme's end date was 13 October 2026, a useful reminder that ESU always has an expiry. The Windows Server 2016 blog post does not spell out the terms, duration or price, so confirm those with Microsoft or your licensing partner before you budget.

A practical plan for the next few weeks

1. Inventory every Windows Server 2016 machine. Include forgotten file servers, print servers and the one that "only runs that old application".
2. Rank them by exposure and importance. Internet-facing and identity systems come first.
3. Check application compatibility. Ask the software vendor whether the line-of-business application is supported on a newer server version.
4. Choose a route per server. Upgrade, migrate, retire, or bridge with ESU.
5. Verify your backups before touching anything. A tested restore is the safety net for every upgrade. Our backup and disaster recovery service covers exactly this kind of change window.
6. Schedule the work, and keep a record. Written dates and owners turn a vague risk into a managed one.

If a server genuinely cannot move in time, the NCSC suggests reducing its exposure while you plan: limit email, web browsing and open network ports from that machine, segment it from the rest of the network, and strengthen logging and monitoring around it. The NCSC is clear that this is not a risk-free way to keep running an obsolete product, and that the decision should be revisited regularly.

Keep it in proportion

An end-of-support date is predictable, which makes it one of the easier risks to manage. The same discipline applies to workstations, as we covered in our look at the Windows 10 grace year, and to patching more broadly, as explained in why patching is not vulnerability management.

If you would like help mapping your estate and choosing between upgrade, migration and a short bridge, our server management and virtualisation team can walk through the options with you. Either way, the best time to start is before the date, not after it.