Windows Server 2016: Support Ends in January 2027—What to Do Now

What the End of Support Means in Practice

Windows Server 2016 follows Microsoft’s standard lifecycle policy. Mainstream support ended in January 2022, and according to Microsoft’s lifecycle page, extended support will end on January 12, 2027. That’s a patch day—the updates released on that day will be the last regular ones. After that:

• No more security updates. Newly discovered vulnerabilities will remain unpatched. The server will continue to run, but every vulnerability that Microsoft patches in newer versions serves as a guide for attackers.
• No manufacturer support. Microsoft will no longer provide assistance in the event of malfunctions. Software vendors are also gradually withdrawing their support for the old system.
• Insurance. Many cyber insurers ask in the application and in the event of a claim whether systems without manufacturer support are in use. What this means for your policy is outlined in your terms and conditions—ask your insurer or broker before the deadline passes.
• Data protection. Article 32 of the GDPR requires technical measures “taking into account the state of the art.” A server containing personal data that no longer receives security updates is therefore difficult to justify. This article is not legal advice.

Server 2016 is rarely the only one. Exchange Server 2016 and 2019 have been out of support since October 14, 2025, and SQL Server 2016 since July 14, 2026. Anyone working on the server should check the applications running on it as well.

Count first, then plan: taking stock

The first question isn’t “How do I migrate?” but “What do I actually have?” In mature environments, there are almost always servers that no one has thought about anymore: the old time-tracking system, the license server, a forgotten test VM.

In a domain, Active Directory provides the quickest overview:

Get-ADComputer -Filter 'OperatingSystem -like "*Server 2016*"' -Properties OperatingSystem | Select-Object Name, OperatingSystem

On an individual server, two additional commands show the version and installed roles. You can identify Windows Server 2016 by version 1607 with build number 14393.

Get-ComputerInfo | Select-Object CsName, OsName, OsVersion, OsInstallDate

Get-WindowsFeature | Where-Object Installed

If you prefer a more traditional approach, you can use ` systeminfo` to obtain the same key data. We’ve compared additional tools for hardware and system data in the article “System Information for Windows Server.” You can locate servers outside the domain using a network scanner.

For each server, note the following:

• Role: domain controller, file server, Remote Desktop (RDS), SQL Server, print server, industry-specific application
• Platform: physical or virtual; age and warranty status of the hardware
• Dependencies: Which applications, interfaces, and devices access it?
• Person in Charge: Who in-house is familiar with the application, and who is the point of contact at the manufacturer?
• Data volume: How much data needs to be migrated? A look at storage usage usually reveals what can be cleaned up beforehand.

Four Approaches and Their Advantages

1. In-Place Upgrade

The setup installs the new version over the existing one. Roles, settings, and data are preserved. According to Microsoft documentation, Windows Server 2016 supports direct upgrades to 2019, 2022, and 2025 using the installation media. Failover clusters are limited to upgrading one version per step during a rolling upgrade.

Pros: the fastest method, same hardware, same server name. Cons: legacy issues carry over, not every role supports this method, and each upgrade requires a new license. You cannot change the language or installation edition (Core or Desktop) during the process, and NIC teaming must be disabled beforehand. You should not begin without a verified backup or VM backup.

2. Fresh Installation and Migration

A new server is set up, and roles and data are migrated. Pros: a clean system; the old server remains as a fallback; hardware replacement can be combined with this process. Cons: more effort required; new names or IP addresses must be properly updated. For domain controllers, we recommend this approach: add a new DC, transfer FSMO roles, and demote the old one.

3. Move the role to the cloud or to a hosting provider

Not every role requires its own server anymore. File storage, email, or individual line-of-business applications are available as services or hosted solutions. Pros: no need for your own hardware; the provider manages the lifecycle. Cons: ongoing costs, dependence on network connectivity and the provider, and data protection as well as contractual terms must be clarified in advance.

4. ESU as a bridge

Microsoft offers Extended Security Updates for Windows Server 2016. According to an announcement by the Azure Arc team, this provides “critical” and “important” security updates for up to three years—that is, until January 2030—without new features or other bug fixes. Billing via Azure Arc is based on a monthly subscription. The Standard and Datacenter editions are covered; typically, Software Assurance from a volume licensing program is a prerequisite.

This is precisely where many SMBs run into trouble: Servers with OEM or per-user licenses without Software Assurance generally do not meet this requirement. We were unable to find specific prices for Server 2016 in public Microsoft sources; please contact your licensing partner for more information. Microsoft itself describes ESU as a last resort and not a permanent solution. That’s how you should plan for it: for the one application that demonstrably cannot be migrated in time.

Which Target Version Is Worth It

The table pretty much answers the question on its own. Switching to 2019 only buys you two years—then the same project comes up again. Windows Server 2025 is the preferred target. 2022 is the fallback option if a software vendor hasn’t released a version by 2025; mainstream support for that version ends as early as October 13, 2026.

Timeline: Counting backward from January 12

The remaining weeks may sound like a lot. After accounting for holidays, year-end closing, and delivery times, there are really only about six weeks left for the actual work. Here’s how we’ll allocate the time:

1. By the end of October: Complete the inventory. Send written inquiries to all software vendors asking which version of Windows Server has been released. Experience shows that these responses take the longest.
2. By mid-November: Make a decision for each server (upgrade, migration, relocation, shutdown). Order hardware and licenses. Check delivery times for servers with the supplier in advance—don’t just estimate them.
3. Second half of November: Test run. For virtual servers, upgrade a clone in an isolated network and have the applications tested by the business departments. Run through the backup and restore process one full cycle.
4. By mid-December: Productive migration, one server at a time, with a maintenance window and a fallback plan. Non-critical systems first.
5. Mid-December through early January: Change freeze. Inventory, year-end closing, and vacations do not allow for server migration.
6. January, before the 12th: Buffer for follow-up work. Downgrade old servers, shut them down, and remove them from monitoring, backup, and documentation.

If it’s already clear that a system won’t meet the deadline, include a workaround in the plan: ESU, provided the licensing requirements are met, or at least isolate the server on the network—separate segment, no internet access, only the necessary ports.

Typical stumbling blocks

• Old hardware. Windows Server 2025 requires processors with SSE4.2 and POPCNT. According to Microsoft, a TPM 2.0 is not a general installation requirement, but it is needed for features such as BitLocker and Secured-Core. Often, the more critical factor is whether the hardware manufacturer still offers drivers and firmware for the new version for that particular model.
• Domain functional level. A domain controller running Windows Server 2025 requires at least the Windows Server 2016 functional level. Additionally, SYSVOL must be replicated via DFSR; the older FRS is no longer supported. The current level can be viewed with the command `Get-ADDomain | Select-Object DomainMode`.
• RDS CALs are version-specific. According to Microsoft, you cannot use RDS CALs for 2016 to access a session host running a newer version. For the new terminal server, you’ll need new CALs and a license server of the appropriate version. This should be factored into the budget early on.
• Remaining SMB1 devices. Older scanners, copiers, or machine controls sometimes only support SMB1. To check whether the protocol is still active on the server, run ` Get-SmbServerConfiguration | Select-Object EnableSMB1Protocol`. Before the migration, identify which devices depend on it—and replace the device rather than re-enabling SMB1 on the new server.
• Missing vendor approvals. Industry-specific software, inventory management, time tracking: Without the vendor’s approval, you risk losing their support. Sometimes an application update is required before the server can be replaced.
• Applications with their own lifecycle. A SQL Server 2016 instance won’t become newer just because you install a new operating system. Plan your database and operating system together.

Conclusion

The end of support for Windows Server 2016 isn’t a deadline after which something stops working. It’s the day from which the risk grows every month—and from which you would have to explain the situation to insurers, customers, and regulatory authorities. The technology itself is rarely the problem. What’s running out is the time for approvals, deliveries, and testing.

Here’s a quick checklist:

• Identify all servers running Windows Server 2016, including roles and dependencies
• Obtain written vendor approvals for each application
• Decision made for each server: upgrade, migration, relocation, or decommissioning
• Target version defined; hardware, licenses, and RDS-CALs ordered
• Backup verified and restore tested
• Test run conducted with the business departments
• Migration scheduled before the year-end shutdown
• For stragglers: ESU clarified or server isolated from the network
• Legacy servers have been shut down and removed from the documentation