Windows Server 2016 End of Life: Your Options Before 12 January 2027

Windows Server 2016 end of life is 12 January 2027, when Microsoft ends extended support. After that date, servers running it get no security updates unless you pay for Extended Security Updates (ESUs), usually through Azure Arc. You have four options: upgrade in place, migrate to new servers, buy ESUs for up to three years, or move the workload to managed cloud server hosting.

One detail changed on 12 October 2026. Microsoft updated its ESU guidance to say that Windows Server 2016 servers licensed through a hosting provider’s Services Provider License Agreement (SPLA) can be covered by ESUs bought through Azure Arc, without Software Assurance. Until then, the same guidance said SPLA was not available for 2016 ESUs. Microsoft describes the edit as a clarification.

What happens when Windows Server 2016 reaches end of support?

Your servers keep running, but Microsoft stops fixing them. Microsoft supports each long-term Windows Server release for about 10 years: five years of mainstream support, with features and fixes, then five years of extended support, with security updates only. Windows Server 2016 has been on security updates only since January 2022, and those stop on 12 January 2027.

Source: Microsoft’s Fixed Lifecycle Policy and ESU lifecycle FAQ, checked on 19 October 2026.

What stops on the Windows Server 2016 EOL date is the monthly security update, which Microsoft publishes on the second Tuesday of each month. The end date, 12 January 2027, is itself the second Tuesday of that month. From then on, any newly found vulnerability stays open on servers without ESUs, and the risk grows with every month they run unpatched.

Other Microsoft products end the same week, according to Microsoft’s 2027 end of support list. Hyper-V Server 2016, Windows Server Update Services for Windows Server 2016, IIS 10 on Windows Server 2016 and .NET Framework 4.6.2 also end on 12 January 2027. System Center 2016 ends a day earlier, on 11 January 2027.

When do Windows Server 2019, 2022 and 2025 reach end of life?

Windows Server 2019 end of life is 9 January 2029, Windows Server 2022 end of life is 14 October 2031 and Windows Server 2025 end of life is 14 November 2034. Each Windows Server end of life date is the end of extended support on Microsoft’s lifecycle pages. Windows Server 2022 left mainstream support on 13 October 2026, so it now receives security updates only.

Source: Microsoft’s lifecycle pages for Windows Server 2016, 2019, 2022 and 2025, checked on 19 October 2026.

The Windows Server 2016 lifecycle page lists four editions: Datacenter, Essentials, MultiPoint Premium and Standard. The Windows Server 2016 support end date is the same for all of them. Microsoft’s ESU guide names only Standard and Datacenter, though, so plan to replace any Essentials or MultiPoint Premium server before the deadline.

Windows 2016 end of life can also refer to a desktop edition with a similar name, Windows 10 Enterprise 2016 LTSB. It has its own lifecycle page, and its support ended on 13 October 2026.

Why does it matter for UK organisations?

Five reasons stand out:

1. Attackers look for unpatched systems, and older servers often hold the most sensitive data and the widest network access.
2. Cyber Essentials requires in-scope software to be supported, so an unsupported server can put certification, and the contracts that depend on it, at risk.
3. UK GDPR requires appropriate security. Unsupported systems holding personal data are hard to defend after an incident.
4. Cyber insurers and larger customers often ask whether your systems are supported.
5. Application vendors stop supporting older operating systems, which can block upgrades to the software your teams rely on.

What does end of support mean for Cyber Essentials?

Cyber Essentials requires all software on in-scope devices to be licensed and supported. Software that becomes unsupported must be removed, or taken out of scope in a separate sub-set that blocks all traffic to and from the internet. A Windows Server 2016 machine still in scope after 12 January 2027, with no ESUs, would not meet that requirement.

These rules come from the NCSC’s Cyber Essentials: Requirements for IT Infrastructure v3.3, dated April 2026. It defines supported software as software whose vendor has committed to regular vulnerability fixes and has said when those fixes will stop. A sub-set is part of the organisation whose network is separated from the rest by a firewall or VLAN. Updates rated critical or high risk must be installed within 14 days of release.

IASME, the NCSC’s Cyber Essentials Delivery Partner, adds detail in its Windows Server guidance, checked on 19 October 2026. It says a server operating system is compliant if it is in mainstream or extended support. It calls ESUs a last resort, supplied at Microsoft’s discretion, and prefers an upgrade to a supported version. IASME’s separate Windows 10 guidance treats devices enrolled in ESUs as compliant, but its Windows Server page does not say the same for 2016 servers. If you plan to rely on ESUs, ask your certification body first.

How do Windows Server 2016 Extended Security Updates work?

Windows Server 2016 Extended Security Updates give you Critical and Important security updates for up to three years after 12 January 2027, through 2030. You buy them through Azure Arc, Microsoft’s service for managing servers that run outside Azure, and pay monthly by the core. They include no new features, no non-security fixes and no general technical support.

Microsoft announced ESUs for Windows Server 2016 on 25 February 2026. Its ESU FAQ describes the programme as “a temporary bridge” while you move to a supported platform. Microsoft’s ESU guide sets out the terms.

Setting them up takes four steps:

1. Install the Azure Connected Machine agent, version 1.62 or later, on each server. This connects the server to Azure Arc, so it needs outbound access to a set of Azure addresses, directly or through a proxy or private link.
2. In the Azure portal, create a Windows Server 2016 ESU licence. Choose Standard or Datacenter, physical or virtual cores, and the number of cores.
3. Link the licence to the Arc-enabled servers it covers.
4. Keep patching as you do now. Enrolment makes a server eligible, and the updates still arrive through Microsoft Update, Windows Server Update Services or your usual patching tool.

For larger estates, Microsoft documents onboarding through Configuration Manager, Group Policy, VMware vCenter or System Center Virtual Machine Manager. Virtual desktop machines are the exception: Microsoft says to apply their ESUs with Multiple Activation Keys rather than through Azure Arc.

Two points catch people out.

ESUs are not free in Azure this time. Microsoft’s pricing change of 1 April 2026 means new ESU offerings cost the same wherever the server runs, and Microsoft’s Azure Arc pricing page lists Windows Server 2016 ESUs among them. That is a change from Windows Server 2012, whose ESUs Microsoft left on the old terms. Microsoft’s general ESU FAQ still says ESUs are free for virtual machines in Azure, but it covers Windows Server 2012 and Windows 10, not 2016.

You pay by the core. You license either physical or virtual cores, with the minimums shown in the table. A Standard licence on physical cores covers up to two virtual machines on that host, while Datacenter covers any number. Virtual core licences cannot be used on physical servers, and a licence’s edition and type cannot be changed once you create it. As servers are upgraded you can reduce the cores on the licence, but this is not automatic: billing follows the licence until you change it.

How much do Windows Server 2016 ESUs cost?

Microsoft’s public Azure Retail Prices API lists Windows Server 2016 ESUs at US$0.007132 per core per hour for Standard and US$0.041067 per core per hour for Datacenter, effective from 1 August 2026 (checked on 19 October 2026). Over a 365-day year, that is about US$62 per core for Standard and US$360 per core for Datacenter.

The Azure Arc pricing page shows the same rates per two cores a month: about US$10.40 for Standard and US$60 for Datacenter. These are US dollar list prices before VAT. Microsoft says prices in other currencies are for reference only, and it calls its published prices estimates, because what you pay depends on your agreement with Microsoft and the exchange rate. The examples below use the list prices and assume they stay the same.

In the second and third rows, the same ten virtual machines cost less than half as much when you license virtual cores. Microsoft’s own licensing examples make the same point for a large VMware cluster. Because the licence type cannot be changed later, model both before you create anything in the portal.

How does SPLA licensing affect Windows Server 2016 ESUs?

SPLA licensing is how hosting providers pay for Microsoft software they run for customers. Under Microsoft’s Services Provider License Agreement, they license eligible products monthly during a three-year term. Since 12 October 2026, Microsoft’s ESU licensing guide says Windows Server 2016 machines licensed through SPLA do not need Software Assurance to buy ESUs through Azure Arc. Before that edit, the guide said SPLA was not available for 2016 ESUs.

The change sits in Microsoft’s ESU licensing guide, and Microsoft calls the edit a clarification. Servers covered by Software Assurance through a Volume Licensing programme, such as an Enterprise Agreement, or by a server subscription were already eligible. Only SPLA is new, and the ESUs themselves are still bought through Azure Arc.

Under SPLA, the hosting provider holds the licence, so the arrangement runs through your provider. Ask it:

• whether it will connect your Windows Server 2016 machines to Azure Arc, or expect you to
• who will hold the ESU licence and which Azure subscription it is billed to
• how the monthly ESU cost will appear on your invoice from 13 January 2027
• when it expects to move your servers to a supported version

What are your options?

There is no single right answer. The best route depends on how many servers you have, what runs on them and how much change your team can take on before January.

Can you upgrade Windows Server 2016 to 2022 or 2025?

Yes. Microsoft supports a Windows Server 2016 upgrade in place directly to Windows Server 2019, 2022 or 2025, keeping settings, roles, features and data. From 2016 you need installation media, because the Windows Update route to 2025 is offered only on 2019 and 2022. Clusters, domain controllers and a few roles need a different approach.

Source: Microsoft’s upgrade guide, checked on 19 October 2026. The paths apply to servers that are not clustered.

Check the restrictions before you start. You cannot change the language, or switch between Server Core and Server with Desktop Experience, during an upgrade. Standard can move up to Datacenter, but Datacenter cannot move down to Standard. Turn off NIC Teaming before the upgrade and turn it back on afterwards. Servers that boot from a virtual hard disk, and Windows Storage Server editions, cannot be upgraded in place. Each upgrade also needs a licence for the new version.

The server must meet the hardware requirements too. Microsoft’s minimums include a 1.4 GHz 64-bit processor that supports the SSE4.2 and POPCNT instructions, and 32 GB of disk space for the system partition. Microsoft suggests its Coreinfo tool for checking what an older processor supports.

Some roles cannot be upgraded in place at all. Microsoft’s guide to upgrading and migrating roles and features lists Active Directory Federation Services and Print and Fax Services as migration only. Print servers migrate with the Printbrm.exe tool.

Domain controllers are a special case. Microsoft’s in-place upgrade instructions say not to upgrade them in place. It is technically possible, but it does not deliver the Active Directory performance and feature improvements in Windows Server 2025. Instead, build new servers, promote them to domain controllers and demote the old ones.

Failover clusters use a cluster OS rolling upgrade, one version at a time. A 2016 cluster therefore goes to 2019, then 2022, then 2025, unless you build a new cluster and migrate. Microsoft recommends finishing each step within four weeks, because a cluster running mixed versions is only meant as a temporary state.

Before any in-place upgrade, Microsoft asks for a full backup with a tested restore and a maintenance window, as the server restarts several times. It also suggests saving the output of Get-ComputerInfo, systeminfo and ipconfig somewhere off the server. If the upgrade fails, the Setup logs are in C:\Windows\Panther.

When is a clean install or migration better than an in-place upgrade?

Migrate when you are moving to new hardware or new virtual machines, and choose a clean install when you want a fresh start. Microsoft’s upgrade guide gives both reasons. Migration is also the only route for some roles, and the better one for domain controllers and for servers that have gathered years of old settings.

A simple test helps. If you would not build the server the same way today, migrate it. An in-place upgrade carries over every old setting, driver and leftover application, and if it goes wrong, the way back is a restore from backup.

Which tools help with a Windows Server migration?

Microsoft provides two main tools for a Windows Server migration. Storage Migration Service moves file servers, including shares and their security settings, and can pass the old server’s name to the new one. Windows Server Migration Tools, a feature built into Windows Server, moves roles, features, operating system settings and shares. Some roles have their own migration guides.

Storage Migration Service works in three stages: inventory the source servers, transfer the data, then cut over if you want to. At cutover, the new server takes on the old one’s identity, so users and applications keep the same paths. The old server keeps its files in a maintenance state until you retire it.

The orchestrator, the server that runs the migration, must run Windows Server 2019 or later. A 2016 destination is allowed, but Microsoft says it may be harder to migrate to, so use 2019 or later there too. Microsoft strongly recommends at least two cores and 2 GB of memory for each. The service can copy files from a domain controller but cannot cut over from one.

Windows Server Migration Tools is covered in the same Microsoft roles and features guide linked above. That guide links role-by-role instructions for DHCP, DNS, print and Remote Desktop Services, among others. Before you start, Microsoft says both source and destination servers should have their latest updates installed.

What about SQL Server 2016 on the same servers?

SQL Server 2016 is already out of support. Its extended support ended on 14 July 2026, and its ESUs run until 17 July 2029 for Enterprise and Standard editions only, with Critical security updates only. If a Windows Server 2016 machine also runs SQL Server 2016, plan both upgrades together.

Source: Microsoft’s SQL Server 2016 lifecycle page and SQL Server ESU FAQ (linked below), checked on 19 October 2026.

Unlike SQL Server 2014, SQL Server 2016 ESUs are not free on Azure virtual machines. On premises or in a hosted environment, you subscribe after connecting the instance to Azure Arc, and an instance that cannot connect may qualify through volume licensing. According to Microsoft’s SQL Server ESU FAQ, billing started at midnight UTC on 15 July 2026. Anyone who subscribes later pays a one-time charge back to that date.

What about Remote Desktop servers running Windows Server 2016?

Remote Desktop Services (RDS) session hosts need extra care, because they serve every user at once. Check that each published application is supported on the newer version, plan how user profiles will move and review your licensing.

Licensing is easy to miss. Microsoft’s RDS licensing rules say an RDS client access licence (CAL) must be the same version as the server it connects to, or newer. Windows Server 2016 RDS CALs therefore do not work with 2019, 2022 or 2025 session hosts. The licence server must also run the same version as the CALs, or later, so a 2016 licence server can only hold 2016 CALs.

Microsoft’s role matrix adds one more rule: RDS servers can be upgraded in place, but a farm that mixes versions is not supported. Plan to move the whole deployment together.

Our guide to RDS licensing in 2026 explains the details. If you are reviewing your remote desktop platform at the same time, our Citrix alternatives comparison compares Citrix, managed RDS and Azure Virtual Desktop, and our remote desktop services page explains how we run them.

How do you plan a Windows Server 2016 migration?

Find every 2016 server, choose a route for each one, test your backups and move the low-risk servers first. From late October there are about 12 weeks left, and many teams freeze changes over Christmas. So plan to finish the main work by mid-December and keep January for checks.

Work through these steps in order:

1. Find every Windows Server 2016 machine, including virtual machines, test servers and anything in a branch office or under a desk. Active Directory records each computer’s operating system, and the Get-ADComputer PowerShell cmdlet can list it.
2. Confirm the version wherever you are unsure. Get-ComputerInfo shows the product name, and Microsoft’s release information gives Windows Server 2016 as version 1607, OS build 14393.
3. Record each server’s roles, applications, SQL Server version, dependencies, data and owner.
4. Ask each software vendor whether its product supports Windows Server 2022 or 2025.
5. Choose a route for each server. Check its hardware against the new version’s requirements, and budget for new Windows Server licences and RDS CALs.
6. Start Azure Arc set-up for any server that will need ESUs, or agree the arrangements with your SPLA provider.
7. Back up every server and test a restore before you change it. Our guide to the 3-2-1 backup rule explains how to keep copies you can recover.
8. Move lower-risk servers first. Replace domain controllers by promotion and move file servers with Storage Migration Service.
9. Move RDS session hosts and the licence server together, with new CALs installed before the cutover.
10. After each move, test the applications, update your asset list for Cyber Essentials and retire the old server.
11. Before 13 January 2027, check that every server left on 2016 is enrolled for ESUs or isolated, and cut ESU cores as servers move.

How BlackBox Hosting can help

For many organisations, the end of Windows Server 2016 is a good moment to stop buying and maintaining server hardware. BlackBox Hosting runs workloads on fully managed, supported infrastructure in UK data centres.

• Managed private cloud and cloud server hosting, with patching, monitoring and security handled for you.
• Managed remote desktop services for teams moving off 2016 session hosts.
• Migration planning support, including version compatibility and RDS licensing.
• Backup as a Service, built on Veeam Cloud Connect, so you have tested backups before and after the move.
• ISO 27001, ISO 22301, ISO 9001, ISO 14001 and CSA STAR Level 2 certified, Cyber Essentials Plus certified, and listed on G-Cloud 15 (Lot 1a).

Matt Burden, founder and managing director of BlackBox Hosting, says most businesses still on Windows Server 2016 are not there by choice: the servers work, so they have never been top of the list. In his view, January is the point where “it works” stops being good enough, and a good moment to ask whether you want to own servers at all.

Still running Windows Server 2016? Talk to an expert about moving your servers onto managed, supported UK infrastructure before January 2027, or start a 30-day free trial.

Frequently asked questions