Windows Server 2016 reaches the end of extended support on 12 January 2027 (Microsoft, Planning ahead for Windows Server 2016 end of support). From that day Microsoft issues no more security updates for it and offers no support. The server keeps running, without any further fixes.
That is eight weeks away, and the servers running it were bought nine or ten years ago, so the question for each one is what it is for. The operating system follows from that.
What actually stops on 12 January
Mainstream support for Windows Server 2016 ended in January 2022. Since then it has had security fixes only, and those are what end now. After 12 January 2027:
- A vulnerability found in Windows Server 2016 is not fixed. Attackers read the same patch notes as everyone else, and a fix released for Server 2019 and 2022 tells them where to look in 2016.
- Cyber Essentials requires supported software, so a 2016 server that is still in scope fails the assessment outright. Insurers ask the same question in their own words.
- Microsoft support cannot be called on for it, and the software vendors whose products run on it drop it from their supported list soon after.
The four ways to deal with a 2016 server
Every server we find on 2016 ends up on one of these routes. Which one depends on what the server does.
1. Upgrade the operating system
Windows Server 2016 can be upgraded in place to Windows Server 2025, or rebuilt on a new version and the roles moved across. This is the route when the server is doing a job that still has to be done on a server you own: a line-of-business application the vendor supports only on Windows, a print or file role that is staying on site, a domain controller the business still needs. It is also where the hardware question arrives, because a server that shipped with 2016 is out of warranty and may not run 2025 well. Often the honest answer is a new server with a new operating system and the application moved onto it.
2. Move the job somewhere else and switch the server off
A lot of 2016 servers are doing work that has a better home now. A file server’s shares belong in SharePoint and OneDrive, where the Microsoft 365 licences you already pay for include them. A domain controller for a business whose laptops are already joined to Microsoft Entra may be a domain controller nobody needs. An application the vendor now hosts for you is one fewer server to patch. This route costs the least to run afterwards and takes the longest to plan, because every share, printer, scheduled task and mapped drive has to be found first.
3. Move the server to the cloud, as it is
A virtual machine can be moved to Azure or to our private cloud and upgraded there, which takes the hardware problem away at once and makes the operating system upgrade a job for a quiet weekend. Microsoft also offers Extended Security Updates at no charge for Windows Server 2016 machines running in Azure, which buys time for an application that cannot move yet.
4. Buy time with Extended Security Updates
Microsoft sells Extended Security Updates (ESU) for Windows Server 2016 for up to three years after the end date, a year at a time, with the price rising each year. It covers security fixes only, and it is the most expensive way to keep a 2016 server, so it suits one server with one awkward application while its replacement is arranged. For a whole estate it costs more than replacing them.
How long each route takes
| Route | Typical time from decision to done |
|---|---|
| In-place upgrade of a healthy virtual server | A week, including a tested backup, the upgrade and a day of checks |
| New server, operating system and application moved | Four to eight weeks, most of it waiting for hardware and the vendor |
| Shares and roles moved into Microsoft 365, server retired | Four to twelve weeks, depending on how much has accumulated on it |
| Move to Azure or our private cloud, then upgrade | Two to four weeks |
| Extended Security Updates | Days to arrange, then a year at a time |
Hardware lead times are what make this urgent. A server ordered in December is not racked, built and tested before 12 January, which is why we are asking every client with a 2016 server to choose a route in November.
The same month as the phone lines
January 2027 is a crowded month. BT and Openreach retire the analogue and ISDN phone network on 31 January 2027, so a business with a 2016 server and an old phone system has two deadlines nineteen days apart. Both are easier if the same people plan them. Our PSTN switch-off guide covers the phones.
Some other Microsoft dates have already passed. Windows 10, Office 2016 and Office 2019, and Exchange Server 2016 and 2019 all left support in October 2025, and SQL Server 2016 followed in July 2026. A 2016 server is quite often running SQL Server 2016 underneath the application, which means it has been unsupported for months already. Our guide to end of life IT explains what end of support means in general; this one is about the date in front of us.
What to do this week
- Find every server, physical and virtual, and note its operating system. Hosts people have forgotten about are the ones that bite: the one in the comms cupboard, the one at the other site, the one that only runs the backup software.
- For each 2016 server, write one line on what it does and who depends on it. That line picks the route.
- Check the application vendors’ supported versions. A vendor that supports Windows Server 2025 makes route 1 easy; one that does not makes route 2 or 4 the conversation.
- Take a backup before anything is upgraded, and restore a file from it to prove it works.
If you would like us to do the first two for you, an IT health check covers every server, firewall and PC against its support dates and comes back with a route for each. Clients on managed IT already have the list; we are working through it with them now. Either way, the service desk answers within three rings on 01642 661888.