Windows Server 2016 support ends 12 January 2027: what now?

Microsoft’s extended support for Windows Server 2016 ends on 12 January 2027. This guide shows how to find every 2016 server, decide what to do with each one, and migrate without losing the things nobody wrote down.

What exactly ends on 12 January 2027?

Windows Server 2016 follows Microsoft’s Fixed Lifecycle Policy. Mainstream support ended on 11 January 2022. Extended support, which is the phase that still delivers security updates, ends on 12 January 2027 (Microsoft lists the date in US Pacific time). The date applies to the Datacenter, Essentials, MultiPoint Premium and Standard editions, and to containers released with Windows Server 2016.

After that date the server keeps running. What stops is the monthly security fix. Any vulnerability found in Windows Server 2016 from then on stays open on your server, while attackers can study the fixes Microsoft ships for newer versions to work out what’s still exposed on the old one.

Microsoft’s ESU FAQ describes ESUs as "a last resort paid option" and says they "are not intended as a long-term solution, but rather as a temporary bridge". They include Critical and Important security updates only. No new features, no non-security fixes, and no general technical support.

Which related end dates should you check at the same time?

A 2016 server rarely runs alone. These dates, all from Microsoft’s lifecycle pages, often turn up on the same server or the same project:

If your 2016 server also hosts SQL Server 2016 or an on-premises Exchange server, you have two out-of-support products on one box. Plan them together.

Step 1: Find every Windows Server 2016 machine

You can’t decide what to do with servers you haven’t found. Build the list from at least two sources, because each one misses something.

From Active Directory. On a domain-joined machine with the Active Directory PowerShell module, run:

Get-ADComputer -Filter 'OperatingSystem -like "*2016*"' -Properties OperatingSystem, LastLogonDate, IPv4Address |
  Select-Object Name, OperatingSystem, LastLogonDate, IPv4Address |
  Sort-Object Name

Check: any machine with an old LastLogonDate may be switched off, decommissioned without cleanup, or a forgotten VM. Confirm each one.

From your hypervisor. List every virtual machine and its guest operating system. Also check the host itself: a Hyper-V host running 2016 counts, even if the guests are newer.

From the network. Servers outside the domain (workgroup servers, vendor-supplied appliances running Windows, a box in the warehouse) won’t show in Active Directory. Your RMM or vulnerability scanner inventory, DHCP leases and switch tables will catch most of them.

From the cloud. Check any hosting provider or cloud subscription for 2016 virtual machines that someone set up years ago.

Check: the final list has one row per server with name, edition (Standard, Datacenter or Essentials), physical or virtual, location, and owner.

Step 2: Record what each server actually does

This is where migrations go wrong. For each 2016 server, capture:

• Roles and features: Get-WindowsFeature | Where-Object Installed (domain controller, DNS, DHCP, file server, print server, Remote Desktop Services, IIS, certificate services).
• Installed software:

Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*,
  HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* |
  Where-Object DisplayName |
  Select-Object DisplayName, DisplayVersion, Publisher |
  Sort-Object DisplayName

• Shares and who uses them: Get-SmbShare, then the share permissions.
• Scheduled tasks: Get-ScheduledTask | Where-Object State -ne 'Disabled'. Look for exports, backups and integration jobs that run under a named user’s account.
• Listening services: Get-NetTCPConnection -State Listen and the matching processes. This shows what other systems talk to the server.
• Service accounts and certificates: services running as domain accounts, and certificates that will need to move or be reissued.
• Dependencies: which apps, devices (scanners, copiers, door controllers) and people would notice if the server went off for an hour.
• Vendor support: for each line-of-business app, whether the vendor supports it on Windows Server 2025, and what version you’d need.

Check: you can answer "what breaks if this server is off?" for every server on the list. If you can’t, the inventory isn’t finished.

Step 3: Choose a path for each server

Use one row per server. Most organisations end up with a mix.

Check: every server has exactly one path, a named owner and a target month.

What are the ESU options for Windows Server 2016?

Microsoft announced ESUs for Windows Server 2016 in February 2026. Here’s what Microsoft’s own documentation says, as of writing:

• Coverage: Critical and Important security updates for up to three years after end of support, through 2030.
• Editions: Standard and Datacenter only. Essentials and MultiPoint Premium aren’t listed as supported, which matters because Essentials was common in small offices.
• Delivery on-premises or with another host: through Azure Arc-enabled servers. You install the Azure Connected Machine agent (version 1.62 or later for 2016), connect the server to Azure, and enrol it. You could configure 2016 ESUs in the Azure portal from 3 August 2026, and Arc billing starts on 13 January 2027.
• Licensing: you need Software Assurance through a volume licensing program, or the server must be licensed through SPLA or a server subscription. Servers bought with an OEM licence and no Software Assurance don’t qualify on-premises.
• Connectivity: an Arc-connected server needs to reach Azure at least once every 30 days.
• In Azure: Microsoft’s ESU FAQ says ESUs are free for virtual machines running in Azure (including Azure VMware Solution and the Azure Stack portfolio). Moving a 2016 VM into Azure is one way to buy time. Confirm the 2016 terms with your licensing partner before you rely on it.
• Late sign-up: for Windows Server 2012, Microsoft back-billed Arc customers who enrolled after end of support for the months they missed. The FAQ doesn’t yet spell this out for 2016, so don’t assume a late start saves money.

Microsoft doesn’t publish a Windows Server 2016 ESU price on these pages, and it varies with how your cores are licensed, so get a quote from your licensing partner before you count on ESU in a budget.

Check: if ESU is in your plan, confirm in writing that your licensing qualifies, which servers are covered, and the date the bridge ends.

Migration checklist

Work through this for each server you upgrade or migrate.

Before

1. Take a full backup and test a restore to a separate location. Microsoft’s upgrade guidance says to back up before any upgrade, clean install or migration. Check: you restored a file and, for a database server, mounted the database.
2. Confirm vendor support for every app on the target version. Check: written confirmation or a support matrix, saved with the project notes.
3. Confirm licensing for the new version (server and client access licences). Check: licence keys or subscription in hand before the change window.
4. Record the current configuration: IP addresses, DNS records, shares and permissions, scheduled tasks, service accounts, certificates, firewall rules. Check: someone else could rebuild the server from your notes.
5. Agree a change window and a rollback plan, and tell staff. Check: the rollback steps are written down and someone has read them.

During

1. Build or upgrade the server and apply all current updates before it takes production load. Check: Windows Update shows no pending security updates.
2. Apply your security baseline: endpoint protection, local admin restrictions, logging, and remove roles you no longer need. Check: the endpoint agent reports in, and the server appears in your patching and monitoring tools.
3. Move data and roles one at a time. For domain controllers, add the new DC, move the roles, then demote the old one. Check: replication is healthy and DNS resolves through the new server.
4. Update anything that pointed at the old server: mapped drives, scan-to-folder settings, app connection strings, DNS aliases. Check: a test user can do their normal day’s work.

After

1. Run both systems in parallel for an agreed period if you can, then switch the old one off (don’t delete it yet). Check: nothing broke while it was off.
2. Add the new server to backups and test a restore from the new backup job. Check: the restore worked, with the date recorded.
3. Decommission the old server: remove it from AD, DNS, monitoring and backup jobs, and wipe or destroy the disks. Check: it no longer appears in your inventory or vulnerability scans.
4. Update your documentation and asset register. Check: the inventory from Step 1 now shows zero 2016 servers, or only the ones on a dated ESU bridge.

What’s the risk of staying on Windows Server 2016?

Running an unsupported server isn’t illegal, and it won’t stop working on 13 January. The risks are practical:

• Unpatched vulnerabilities. New flaws in Windows Server 2016 won’t be fixed. Servers are often the most connected machines on the network (file shares, remote access, domain services), so one exposed server can reach everything else.
• Software stops supporting it. Microsoft 365 Apps on Windows Server 2016 already stopped getting feature updates at Version 2602. Backup agents, endpoint protection and line-of-business apps tend to follow, and an unsupported combination is hard to get help with when something breaks.
• Frameworks and contracts expect it gone. ASD’s guide to moving from the Essential Eight to ASD Essentials lists "processes for removing or replacing unsupported systems" among the existing work organisations can reuse. If a supplier questionnaire or insurance proposal asks about unsupported systems, "yes, we have one" needs an honest answer and a plan behind it.
• No vendor support when you need it. For Windows Server 2012, Microsoft’s ESU FAQ says customers without ESUs can’t log a support ticket after end of support, even with a support plan. Plan on the same for 2016.
• Compensating controls aren’t a fix. Microsoft’s ESU FAQ says third-party application control "is not a replacement for product security fixes". If you must run 2016 past the date, isolate it on its own network segment, block internet access it doesn’t need, restrict who can sign in, and monitor it closely. Treat that as damage limitation with an end date.

Check: if any 2016 server will still be running on 13 January 2027, it has a written risk acceptance signed by someone with the authority to accept it, a list of compensating controls, and a removal date.

How long will this take?

It depends on what you find in Steps 1 and 2. A single file server with no apps is a short job. A domain controller that also runs SQL Server, a line-of-business app and the scan-to-folder share is a project. Start the inventory now. If it shows more than a couple of servers, or anything you can’t explain, you’ll want the remaining time for testing rather than rushing.

If you need an outside view, our managed IT team can plan and carry out server upgrades and migrations, and our vulnerability management service finds unsupported systems you didn’t know you had. For servers that stay on-premises, the backup and disaster recovery page covers how we approach tested restores.

Key takeaways

• Windows Server 2016 extended support ends on 12 January 2027. Plan the work now, while you still have time to test.
• Inventory from several sources (Active Directory, hypervisor, network, cloud) and record what each server does, not just its name.
• Give each server one path: upgrade in place, migrate, move to a cloud service, retire, or ESU as a dated bridge.
• 2016 ESUs cover Standard and Datacenter only, are delivered through Azure Arc on-premises, and need eligible licensing. Confirm before you rely on them.
• Upgrade to Windows Server 2025, not 2019, which itself ends in January 2029.
• Test a restore before and after every migration, and keep a written risk acceptance for anything left on 2016.

Sources

• Windows Server 2016 lifecycle, Microsoft Learn
• Prepare to deliver Extended Security Updates for Windows Server through Azure Arc, Microsoft Learn
• Product Lifecycle FAQ: Extended Security Updates, Microsoft Learn
• Windows Server 2016 ESU announcement, Microsoft Windows Server blog (February 2026)
• Plan your Windows Server upgrade path, Microsoft Learn
• Windows Server end of support and Microsoft 365 Apps, Microsoft Learn
• SQL Server 2016 lifecycle, Exchange Server 2016, Exchange Server 2019, Office LTSC 2021, Windows 10 Enterprise and Education, Windows Server 2019, Windows Server 2025
• ASD Essentials transition guide, cyber.gov.au (15 October 2026)