Skip to content
Managed IT & Support

Windows Server 2016 end of support: 12 January 2027

Windows Server 2016 stops getting security updates on 12 January 2027. What that means, your Extended Security Update options and how to plan the upgrade.

Geidi Infrastructure Team5 min read

In brief

What it is
Windows Server 2016 stops getting security updates on 12 January 2027 unless you pay for Extended Security Updates.
Who it affects
Organisations with a server installed around 2017 to 2019, such as a domain controller, file server or line-of-business server.
What to do
List every server with its roles, applications and dependencies, then decide one by one: upgrade, rebuild, move to the cloud or pay for ESUs.
On this page
  1. What end of support actually means
  2. Your Extended Security Update options
  3. Your upgrade paths
  4. What to inventory now
  5. Where Geidi fits
  6. Sources

Windows Server 2016 reaches the end of extended support on 12 January 2027. That's the January 2027 Patch Tuesday in the US, which lands in Perth on Wednesday 13 January. After that update, Microsoft stops shipping security fixes for it unless you pay for them.

If your business has a server in the comms cupboard, in a data centre or in the cloud that went in around 2017 to 2019, there's a good chance it runs Windows Server 2016. It might be your domain controller, your file server, the box that runs your accounting or practice management software, or a remote desktop server people use from home.

How worried should you be? Not panicked, but busy. The server won't stop working on the day. It will just get less safe every month after, and servers are exactly what ransomware crews go looking for once they're inside.

What end of support actually means

Microsoft ended mainstream support for Windows Server 2016 in January 2022, so it has had no new features or non-security fixes for years. Extended support, which is the security updates, is what ends in January 2027.

From then on:

  • New vulnerabilities in Windows Server 2016 won't be fixed for you unless you're enrolled in Extended Security Updates.
  • Software vendors will start dropping support for their products on it, if they haven't already.
  • Cyber insurers and auditors will ask about unsupported operating systems, and so will anyone assessing you against the Essential Eight. Our Essential Eight patching timelines guide explains what the patching strategies expect.

Check the software on top as well. SQL Server 2016 reached the end of its own extended support in July 2026, so a 2016 server running a 2016 database may already be a step behind.

Your Extended Security Update options

In February 2026 Microsoft announced Extended Security Updates (ESUs) for Windows Server 2016. ESUs are security updates only, and Microsoft says coverage runs for up to three years after the end of support date. They buy time. They don't fix the underlying problem.

There are three main routes:

  1. Run it in Azure. Microsoft's ESU FAQ says ESUs are free for virtual machines in Azure, including Azure Virtual Machines, Dedicated Host, Azure VMware Solution and the Azure Stack portfolio, and they switch on automatically when the VM is set to receive updates. If a 2016 server hosts an application you can't move yet, lifting it into Azure can be the cheapest way to keep it patched.
  2. Keep it on premises and pay through Azure Arc. You connect the server to Azure Arc, then create a Windows Server 2016 ESU licence in the Azure portal by edition (Standard or Datacenter) and core count, and link it to the server. Microsoft pitches this as flexible subscription billing, so you can stop paying once the server is retired.
  3. Buy ESUs through volume licensing. Microsoft still lists volume licensing as an option for on-premises servers. Talk to your licensing partner about eligibility, since it usually depends on the agreement you hold.

We haven't included prices here because they depend on your cores, your agreement and the route. Get a quote before you assume ESUs are cheaper than upgrading. Once you add the second and third years, they often aren't.

Your upgrade paths

Microsoft supports an in-place upgrade from Windows Server 2016 directly to Windows Server 2019, 2022 or 2025 using installation media. In-place upgrades work, but they carry over years of accumulated settings and old software. For most small business servers we'd rather build a new server and migrate the roles across.

Which version? For anything new, we'd pick Windows Server 2025. Its extended support runs to November 2034. Windows Server 2022 is supported until October 2031, but its mainstream support ended in October 2026, so you'd be installing something already in its security-updates-only years.

Also ask the harder question: does this still need to be a server? File shares can often move to SharePoint and OneDrive, and on-premises Active Directory can sometimes give way to Microsoft Entra ID with Intune-managed devices. Not always. A line-of-business application that needs a Windows server will still need one, somewhere.

What to inventory now

The time goes quickly once you add vendor lead times, a change freeze over Christmas and staff leave. Start with a list:

  1. Every server and what it does. Name, physical or virtual, where it runs, and its roles: domain controller, DNS, DHCP, file, print, Remote Desktop, SQL, backup.
  2. The applications on each one, with the vendor's supported operating system list. Some vendors only support newer versions of their own software on Server 2022 or 2025, which means an application upgrade too.
  3. The hardware. A host bought in 2017 is due for replacement anyway, so check it against the requirements of the version you're moving to.
  4. Your licences. Whether you have Software Assurance or a subscription affects both upgrade rights and ESU eligibility.
  5. Dependencies. Scanners that send to a file share, scripts with server names hard-coded, printers pointing at a print server, and other servers relying on a 2016 domain controller.
  6. Backups. Take a known-good backup and test a restore before you touch anything.

Then decide, server by server: upgrade, rebuild, move to Azure, move to Microsoft 365, or pay for ESUs while you get there. If you worked through the Windows 10 end of support in 2025, this is the same exercise for the back room.

Where Geidi fits

Server upgrades and migrations are part of our managed IT support, with a 7-day service desk and support for organisations from 5 to 1,000 staff. If you're not sure how many 2016 servers you have or which route makes sense for each, talk to us and we'll help you work through the list before January.

Sources

More on Managed IT & Support

One partner for the whole environment.

Tell us about your existing IT. We would be pleased to review your current system and give you an overview as to how Geidi may be able to deliver and enhance your IT operations.

Book a consultationCall 1300 855 049