Windows Server 2016 gets its last security update from Microsoft on January 12, 2027. If you still have servers running it, you have about ten weeks to decide whether to upgrade, move the workload, or pay for more time.
What’s changing
- Microsoft’s extended support for Windows Server 2016 ends January 12, 2027. That covers all editions, including Standard, Datacenter and Essentials.
- After that date, those servers stop receiving security updates, bug fixes and technical support. They’ll keep running; they just won’t be patched. Given that Microsoft fixed more than 1,400 security flaws in October alone, “won’t be patched” is doing a lot of work in that sentence.
- Mainstream support ended back in January 2022, so this is the last stop.
What it means for you
Windows Server 2016 tends to hide in places nobody has looked at lately: a file server in a closet, a print server, a line-of-business application that “just works,” a domain controller, or a virtual machine nobody remembers creating. Unpatched servers are a favorite target for attackers, and they can complicate cyber insurance questionnaires and compliance audits.
Hardware is part of the picture, too. A server bought when 2016 was current is approaching ten years old and may be due for replacement regardless of what operating system it runs.
Your options
Upgrade to Windows Server 2025. This is Microsoft’s recommended path. Standalone (non-clustered) servers can upgrade in place directly from 2016 to 2025. Clustered servers have to step up one version at a time, and domain controllers have their own procedure. Many teams use the occasion to build fresh on new hardware instead.
Move the workload to the cloud. Migrating to Azure or another cloud provider takes the server hardware off your plate, though it brings its own planning around licensing, connectivity and monthly costs.
Buy Extended Security Updates (ESU) as a bridge. Microsoft offers paid ESUs for Windows Server 2016, delivered through Azure Arc, its tool for managing on-premises servers from Azure. ESUs cover critical and important security fixes only and are sold one year at a time; signing up late means paying for the years you missed. Eligibility generally requires Software Assurance or subscription licensing. Think of ESU as renting time, not buying it.
What we recommend
- Inventory every server and virtual machine still on Windows Server 2016, including what it does and who owns it.
- Check the age of the hardware underneath. If it’s near the end of its life, plan a replacement rather than an upgrade.
- Test critical applications on Windows Server 2025 before committing. Microsoft offers a free 180-day evaluation version.
- If something can’t move by January, price out ESU now rather than in late December.
- Count your cores. Windows Server 2025 and ESU are both licensed per core, and a quick count now prevents surprises on the quote.
How DTM can help
DTM can help you size and source replacement servers, Windows Server 2025 licenses and client access licenses (CALs), or ESU coverage, across a range of manufacturers and with no brand to push. If you’re not sure which path makes sense for a particular server, we’re glad to help you weigh the options.
Ready to plan your move off Windows Server 2016? Contact us.
Microsoft licensing terms and pricing can change; confirm current details before purchasing.
Sources
- Planning ahead for Windows Server 2016 end of support (Microsoft Windows Server Blog)
- Windows Server 2016 lifecycle (Microsoft Learn)
- Windows Server upgrade overview (Microsoft Learn)
- Windows Server 2016 to get final update on 12 January 2027 (ITdaily)
- Windows Server 2016 End of Support: What Changes on January 12, 2027 (CloudServus)
- Inquiry about ESU for Windows Server 2016 (Microsoft Q&A)
- Microsoft patches more than 1,400 security flaws (Krebs on Security)
- Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days (BleepingComputer)