Windows Server 2016 reaches the end of extended support on 12 January 2027, and regular security updates stop that day. You have three realistic paths: upgrade to a newer Windows Server, buy Extended Security Updates, or use the deadline to check which roles still need Windows at all. Leaving the server running unpatched is not one of them.
What exactly ends on 12 January 2027?
Every edition of Windows Server 2016 is affected, plus Hyper-V Server 2016 and WSUS on 2016. The machine will still boot on 13 January. It just won’t get patches, so every vulnerability disclosed after that date stays open.
A 2016 server rarely sits alone. In a lot of server rooms it runs next to software whose clock has already run out, or soon will:
| Product | End of support | Status |
|---|---|---|
| Exchange Server 2016 / 2019 | 14 October 2025 | ended |
| SQL Server 2016 | 14 July 2026 | ended, ESU available |
| Windows Server 2012 / 2012 R2 (ESU year 3) | 13 October 2026 | fully ended |
| Windows Server 2016 | 12 January 2027 | ESU available |
| Windows Server 2019 | January 2029 | still supported |
So the “quick upgrade” of the 2016 box often turns up a SQL Server 2016 next to it that hasn’t had regular updates since July. At that point the upgrade has become an inventory.
Option 1: upgrade to a newer Windows Server
This is the obvious path, and for some roles it’s the right one. Active Directory, line-of-business apps that require Windows, anything that depends on Group Policy: move it to a current version and be done. Just don’t land on 2019, which runs out itself in January 2029 and puts the same project back on your desk about two years later.
The catch with the reflex upgrade is that every role comes along, including the ones nobody needs on Windows anymore. You end up buying licences and CALs for a setup that nobody actually chose.
Option 2: Extended Security Updates through Azure Arc
For Windows Server 2016 Standard and Datacenter, Microsoft sells up to three years of ESU: Critical and Important security updates through 2030, with no new features and no other fixes. You could configure it in the Azure portal from 3 August 2026, and billing starts on 13 January 2027 — monthly, based on cores and edition. Sign up late and you are back-billed to 12 January.
Two things to know first. ESU requires Software Assurance or an equivalent server subscription, and SPLA through your hosting provider isn’t available for 2016. Microsoft also hasn’t published a price, so you’re budgeting from a quote rather than a price list.
ESU buys time. It makes sense for the one server with the line-of-business app whose successor arrives next summer. As a plan for the whole estate, it is the most expensive way of not deciding.
Option 3: check what actually needs Windows
This is the path I recommend most often, for a boring reason: the inventory is due anyway. A typical 2016 server at a small or mid-sized company runs things like the file share, an intranet, maybe a wiki, and a small web app someone once put on IIS. None of that strictly needs Windows.
File storage and collaboration run on Nextcloud, and intranet and wiki work as self-hosted services on a lean Linux server. The little IIS app is often better off in a container than on its own licensed Windows server. You may know the pattern from Windows 10’s end on the desktop: not everything switches, but whatever can switch saves licences and dependency for good.
In most companies Active Directory stays where it is for now, and that’s fine. A mixed setup with a small, current Windows core and the rest on Linux is simply the sensible choice for many businesses. If you’re rethinking mail while you’re at it (Exchange 2016 has been out of support for a year), our post on Microsoft 365 alternatives covers the options.
Why running unpatched is not an option
A server with known, open vulnerabilities is exactly what automated attacks scan for. If you fall under NIS2, you also have to prove it: patch management that hasn’t been able to patch a production server for months won’t survive an audit. The NIS2 self-check tells you in a few minutes whether you’re in scope.
A pragmatic plan until January: list the roles, decide per role (upgrade, ESU as a bridge, or move), and finish the moves before the deadline. If you want the day-to-day running afterwards (updates, monitoring) off your plate, that’s what our maintenance service is for.
Your Windows Server 2016 runs more than you’d like, and January is getting close? Get in touch — we’ll do the inventory and decide role by role.