Windows Server 2016 reaches the end of extended support. The server carries on running that morning, which is exactly what makes this easy to leave alone until it is expensive.
Microsoft's lifecycle for Windows Server 2016 started in October 2016. Mainstream support ended in January 2022, so it has been on security fixes only for years already. Extended support ends on January 12, 2027, the date in Microsoft's Windows Server release information table. Its product lifecycle page renders the same deadline as January 13, 2027 at 6:59:59 in the morning, Pacific, which is the sort of one-day gap worth knowing about before you build a cutover weekend around it.
If you have a server in a closet that somebody set up around 2017 and nobody has touched since, this is about that machine.
The server keeps running. It just stops getting security fixes, while the vulnerabilities found after that date keep accumulating.
Microsoft runs an Extended Security Updates program as a paid last resort for legacy products. It covers Critical and Important security updates for up to three years past a product's end of extended support. It does not extend the lifecycle, it brings no new features and no customer-requested fixes, and it carries no technical support beyond security: Microsoft says customers on ESUs "will not receive standard support services such as troubleshooting, bug fixes, or technical guidance for issues unrelated to security updates."
For Windows Server 2016 the program is real and the dates are published. Microsoft says you can configure Server 2016 ESUs in the Azure portal starting August 3, 2026, that billing begins January 13, 2027, the day after support ends, and that the updates run for up to three years, through 2030. Delivered through Azure Arc it is a monthly pay-as-you-go charge on your Azure bill, with no product keys to install on each server. The catch is eligibility. You need Software Assurance through a volume licensing program such as an Enterprise Agreement, Enrollment for Education Solutions, Server and Cloud Enrollment, Open Value, or an equivalent Server Subscription, and Microsoft states that SPLA is not available for Server 2016 ESUs. Tell us how your licenses were bought and we will tell you whether you qualify.
Microsoft is direct about what the program is for. In its own words, these updates "are not intended as a long-term solution, but rather as a temporary bridge to stay secure while one migrates to a newer, supported platform." Paying to keep receiving only the fixes Microsoft rates Critical and Important is a way to buy time for a migration you have scheduled. It is not a substitute for having one.
The instinct is to move up one version. Windows Server 2019 is familiar, it looks like a smaller change, and it feels like the low-risk step.
Its extended support ends on January 9, 2029, which is about two years past Server 2016. So the full migration, with all the testing and downtime it involves, adds roughly two years of runway over simply staying put until the deadline. Windows Server 2022 is further out: mainstream support ends October 13, 2026, and extended support runs to October 14, 2031.
Migrating twice can mean paying for the testing, the downtime and the planning twice. Worth weighing the destination as carefully as the date.
Sometimes it is. If the application that runs your business is only supported on 2019, that decides it, and the job becomes planning for January 2029 with your eyes open. The point is to choose the landing spot deliberately rather than by reflex.
This is the part that decides whether the job takes a weekend or several months.
A machine bought for Server 2016 is approaching ten years old, so the replacement conversation often includes the hardware.
If it authenticates your staff, it cannot simply be switched off one evening. Roles move first, carefully.
Practice management, accounting, the industry package. The vendor decides what it supports, not you.
File shares, print queues, a database, the scanner drop folder, license servers nobody documented.
Before anything else, somebody has to ask the software vendor what they actually support today. That answer sets the whole plan, and occasionally it is unwelcome: the current version needs newer hardware, a different database, or a move to their hosted product. Finding that out in month one is very different from finding it out the week before a cutover.
Because plenty of other businesses are on the same deadline. The closer it gets, the more competition there is for vendor attention, hardware and the weekends when this work can actually happen.
And an unsupported server is the sort of thing that surfaces at the worst moment, when somebody is reviewing how you protect your data after something has already gone wrong.
Including the 2016 box somebody stood up for one thing and forgot about.
Roles, shares, applications, scheduled jobs, and who would notice within an hour if it stopped.
In writing, before any hardware is quoted, so the plan is built on their answer.
A version with years left on it, sized for what you actually run, so this is not repeated in 2029.
Backed up and tested first, cut over out of hours, with a rollback that has been thought through.
What moved where and why, so the next person is not starting from nothing. That record is yours.
We will tell you which servers you have, what each one is doing, and what moving off them realistically takes. Much easier to answer now than close to January 2027.
Start a Conversation