Windows Server 2016 End of Life: January 12, 2027

Windows Server 2016 end of life is January 12, 2027. On that day extended support ends for every edition. Mainstream support already ended back in January 2022. After 2027, fixes come only through paid ESU, for up to three years.

Microsoft ships the last regular security update then. The server keeps booting and running afterwards, and it just stops receiving fixes.

The license stays valid too, a question that comes up a lot. Nothing switches off on that date; Microsoft’s security updates simply stop coming.

As of November 2026, that leaves about nine weeks.

Windows Server end-of-support deadlines tend to go the same way, from the 2008 days on. Every time.

There’s plenty of warning, and then a scramble in the last quarter.

Nine weeks is enough for a small estate with a plan. It isn’t enough for an estate nobody has inventoried yet.

This page shows what changes, what waiting costs and the least painful way off 2016.

When Windows Server 2016 reaches end of life

End of life falls on January 12, 2027, the end of extended support.

We count from the release on October 15, 2016, under the Fixed Lifecycle Policy. That policy gave it five years of mainstream support, which ended on January 11, 2022.

Five years of extended support followed, with security updates only. The date is the same for all editions.

Microsoft’s Windows Server 2016 lifecycle page lists the dates in Pacific Time.

That’s why the extended end shows there as 6:59 in the morning of January 13, 2027. It marks the end of January 12.

Containers based on Server 2016 images follow the same dates.

What happens at Windows Server 2016 end of life

The operating system keeps running, activation keeps working and existing updates stay installed. What stops is fresh patches.

The risk grows every month you stay.

WannaCry in 2017 is the example worth showing managers. It spread through systems that hadn’t installed a patch that already existed.

An unsupported server is worse, because there’s no patch to install. Ransomware crews typically know the end-of-support calendar as well as we do.

Compliance and audits

GDPR, HIPAA and PCI DSS all expect “appropriate” security measures. An operating system that can’t receive patches is hard to defend in an audit.

GDPR fines reach €20 million or 4% of global annual turnover, whichever is higher.

PCI DSS expects critical security patches within one month of release. That can’t be met when no patch exists.

Software support

Vendors follow Microsoft. Microsoft 365 Apps are already there.

Expect more “not supported on Windows Server 2016” lines in release notes through 2027.

Cyber insurance

Insurers often ask about unsupported software in renewal questionnaires. Read your own policy.

If it excludes incidents on unsupported systems, a breach on a 2016 machine could leave the whole cost with you.

Extended Security Updates for Server 2016

Microsoft offers ESU for up to three years after January 12, 2027. It delivers Critical and Important security fixes only.

ESU works as a paid bridge, not as a support extension.

• No new features.
• No general bug fixes.
• No technical support beyond ESU installation issues.
• Each year must be bought in order.

The licensing details decide if ESU is realistic for you.

Run the numbers honestly. Three years of ESU on a modest Standard server can come close to the cost of a Server 2025 license, or beyond it.

And at the end you still have to migrate.

ESU makes sense for one or two servers with a line-of-business app that truly can’t move yet. For everything else, we’d spend the money on the upgrade.

Server 2022 or Server 2025 as the target

Choose Server 2025 for most upgrades. Its extended support runs to November 14, 2034.

Server 2022 reaches October 14, 2031. It already left mainstream support on October 13, 2026.

Pick it only in two cases.

• An application vendor certifies 2022 but not 2025 yet.
• Your hardware fails the processor requirements of the newer release.

Server 2022 is mature and well understood.

• Secured-core server features
• TLS 1.3 on by default
• Better container support

The 2025 release adds more, along with the longest support window on the market.

• Hotpatching options
• The desktop in the style of Windows 11
• Faster storage
• Active Directory improvements

Server 2019 still gets security fixes until 2029. Moving to it now would repeat this project in two years.

Before committing to the newest release on older hardware, we’d check the processor.

It has to be a 64-bit CPU with SSE4.2 and POPCNT, among other instructions. That rules out some very old hosts.

Our overview of Windows Server 2025 editions and features covers the rest.

Need a license? Our Windows Server 2025 Standard key comes as a genuine license. Delivery is instant to email.

The full range, including Datacenter and CALs, is in the Windows Server category.

Three ways off Server 2016 before end of life

How to upgrade in place

Microsoft supports an in-place upgrade from installation media to any of the three newer versions. With Server 2025, non-clustered systems can jump up to four versions.

Settings, roles and data stay. A simple server usually takes a couple of hours with reboots, and longer with many roles.

1. Take a full backup and confirm you can restore it. Our page on Windows Server Backup covers the built-in tool.
2. Check that each role and application allows an in-place upgrade to the target version.
3. Disable NIC Teaming if you use it, and re-enable it afterwards.
4. Mount the ISO of the target version and run setup.exe. Choose to keep files, settings and apps.
5. Enter the product key for the target version. Every Windows Server upgrade needs its own license.
6. Afterwards, install the latest cumulative update and test every service before calling it done.

Some upgrades are blocked outright.

• Language changes
• Server Core to Desktop Experience, or the reverse
• Evaluation copies
• Datacenter down to Standard

Domain controllers have their own guidance. Usually it’s cleaner to promote a fresh DC than to upgrade the old one.

We’d test the upgrade on a clone first. A snapshot of the VM, restored to an isolated network, shows the problems before your users do.

Side-by-side and cloud migration

Side-by-side

Build a fresh Server 2022 or 2025 machine and move roles and data across. Switch users over, then retire the old box.

It takes more time and hardware. In return you get a clean install, and the old server stays available for rollback.

That’s generally the default we’d pick for file servers and domain controllers. The same goes for anything that has been upgraded in place before.

Cloud

Moving workloads to Azure or another provider removes the hardware question. It fits when the cloud was already on the roadmap.

It fits less well when data must stay on site. The same holds when long-term monthly costs would exceed a one-off license and hardware purchase.

A migration timeline for the last nine weeks

With about nine weeks left in November 2026, a realistic plan has four stages.

This line on each host gives the inventory quickly, and so does a query in your management tool.

Get-ComputerInfo | Select-Object WindowsProductName, OsVersion

Anything still on 2016 after that date should be covered by ESU or isolated from the network.

A migration rarely finishes faster than planned. We’d leave slack in December for the one application whose vendor answers tickets once a week.

Server 2016 end of life: the same pattern as 2012 R2

The pattern is the same, and the dates differ.

A 2012 R2 machine is already past its last ESU year and should move first.

The lessons from that round are in our article on Windows Server 2012 R2 end of life. It also covers what typically went wrong.

In most cases one plan works for both: one inventory, one migration project, one target version.

Where these steps apply

The steps and paths apply to licensed installations, not evaluation copies. Microsoft documents them for in-place upgrades from installation media.

That deadline won’t move. Microsoft extended consumer Windows 10 ESU, but it hasn’t moved a Windows Server end-of-support date in recent releases.

Extra time has always come as paid ESU. We’d plan for January 12, 2027 as the real date.

Common mistakes before Server 2016 end of life

• Reading the date as a shutdown. The server keeps running and stays activated.
• Counting on ESU with a retail or OEM license.
• Joining ESU late and expecting to skip the missed months.
• Moving to Server 2019 and repeating the project in two years.
• Starting the upgrade with no tested restore.
• Leaving NIC Teaming on during setup.
• Upgrading a domain controller in place.
• Forgetting the license and CALs for the target version.

Related guides

• the three current Windows Server releases compared

Terms used on this page

Server 2016 ESU through Azure Arc: what Microsoft has published

Here the picture got clearer in autumn 2026. Microsoft’s Azure Arc documentation now carries a separate Windows Server 2016 section.

Got an Essentials box? Then ESU isn’t on the menu at all. It has to be upgraded or replaced.

Same for a server bought with a plain retail or OEM license and no Software Assurance. Upgrade, or the cloud.

Details sit on Microsoft’s Azure Arc ESU preparation page, with a version switch at the top.

Arc only for ESU

Not planning to use anything else from Azure? Fine.

For servers that join Arc only for Server 2016 ESU, Microsoft lists a reduced set of network endpoints to open. We’d still check the firewall before the January rush, because the agent has to reach Azure at least once in 30 days.

A server that can never talk to Azure is a case for ESU keys applied by hand.

VDI machines

Virtual desktops are the exception here.

Microsoft says not to use Azure Arc for ESU on VDI virtual machines. Those get Multiple Activation Keys from the Microsoft 365 admin center.

Late sign-ups and offline images

Two rules carried over from the 2012 round, as Microsoft’s ESU FAQ describes it.

• Enroll after the end date, and Arc bills the missed months in one go.
• Offline servicing of images isn’t supported. ESU installs on a running system only.

So a golden image that gets patched offline needs a new routine. Boot it, update, capture again.