On January 12, 2027, the extended support for Windows Server 2016 ends. After that, Microsoft will no longer provide regular security updates. In many medium-sized companies, specialist applications, file storage, databases and sometimes half the data center run on these servers. Nearly three months remain until the deadline. This post shows what ways there are, what they cost and why the decision rarely depends on the operating system.
What happens on January 12, 2027
Windows Server 2016 follows Microsoft’s fixed lifecycle policy. General support ended in January 2022, since then there have only been security updates. With the 12. January 2027 this last stage is also omitted. The servers continue afterwards, and on the first day you do not notice anything. From then on, however, they are permanently open to any newly discovered vulnerability.
For companies covered by NIS2 or whose customers ask for the patch status in supplier audits, this is not an abstract risk. A server without manufacturer support is a finding in every security audit. And cyber insurance companies also regularly ask for systems that are no longer supported.
Often comes a second contamination. Many 2016 servers run SQL Server 2016, whose extended support is already on 14. July 2026 expired. Anyone who replaces the server must therefore touch the database anyway.
The Three Ways and What They Mean
There are basically three options to choose from. Each one is the right one for certain servers, and in most environments it boils down to a mix.
Upgrade to a current version. Windows Server 2022 or 2025 on new or existing hardware is the obvious way when the applications run on it. An upgrade in the running system is technically possible, but in practice a new installation with subsequent migration of the roles and data is usually successful, because it does not carry any legacy loads. The effort is therefore less in the operating system than in the move of what runs on it.
Buy advanced security updates. Microsoft offers Windows Server 2016 Extended Security Updates (ESU) for up to three more years. They can be obtained via volume licensing agreements or via Azure Arc. With Azure Arc, the server is connected to Azure and the ESU is billed monthly, the billing starts on January 13, 2027. The prerequisite for servers in your own data center is active software assurance. ESU only delivers critical and important security updates, no troubleshooting, and no new features. They buy time but do not solve anything.
Migration to the cloud. Instead of replacing the server one-to-one, it can be checked whether the services on it still need their own server. File storage often belongs to SharePoint or a managed file service, databases to a managed database service, and some specialist applications are now available as SaaS. What is left can be used as a virtual machine in Azure continue to run. The migration also solves the hardware issue, because the servers of 2016 are usually also at the end of their life.
The question is rarely which operating system comes next. It reads: Which application runs on this server, who maintains it, and can move it?
Where it ticks in practice
A domain controller or print server is replaced in a day. Difficult are the servers running a specialized application that someone installed years ago. The manufacturer may no longer exist, the license is tied to the old hardware, or the application requires a specific .NET or SQL version. These servers determine the schedule. If you identify them first, you can decide in good time whether an update of the manufacturer, continued operation with ESU or a replacement of the application is the right way.
A second classic is interfaces. A server that sends files to a supplier via FTP at night, pulls data from the ERP for reporting or operates a scanner in the warehouse does not appear in any license list. He only stands out when he is missing after the move. A clean inventory therefore lists not only servers and roles, but also planned tasks, service accounts and network connections.
The third point is the database. If you move SQL Server 2016 to a current version or a cloud service, you should check in advance whether compatibility level, stored procedures and reports are participating. Technically, this is usually uncritical, but needs a test run with real data, and you better not plan it in the first week of January. How we secure such moves, we describe on the page for Data Migration.
What the Options Cost
Flat-rate prices would be dubious because they depend on the number of cores, on the licensing agreements and, above all, on the applications. However, the cost logic can be clearly described.
The upgrade involves licenses for the new server version, possibly new hardware and the effort for migration and testing. ESUs incur ongoing costs per core with no lasting equivalent. They are worthwhile for individual servers, whose replacement really still takes time, not as a strategy for the entire environment. Cloud migration shifts investment into ongoing operating costs. It is especially worthwhile where new hardware would be due anyway or where services can be replaced by managed offers that no longer need their own server operation.
In practice, a mixed picture is almost always created. The majority of servers are updated or migrated, two or three problematic systems continue to run with ESU, and for these there is a concrete replacement plan with date.
A realistic roadmap by January
In three months with Christmas break, the order is crucial. First the inventory: all servers with Windows Server 2016, what runs on who is technically responsible and what dependencies exist. This takes one to two weeks in a manageable environment. After that, the decision between upgrade, migration and ESU is made per server.
The simple cases should move in the coming weeks, at the latest in November. For the difficult ones, the way via ESU is worthwhile: The configuration via Azure Arc is already possible, is calculated only from the deadline. In this way, the safety net can be tightened without the migration under time pressure. It is only important that ESU does not become a permanent solution.
Conclusion
The support end of Windows Server 2016 is a fixed date, and it comes shortly after the holidays. Companies that know their servers and applications do the majority in a few weeks and bridge the rest with ESU. It gets complicated where only in December notices what is actually running on a server. If you want to evaluate your surroundings now and plan the move, we will support you with the Cloud Migration and on request also in ongoing operation with our Managed Services. Talk to us.
Additional sources
- Microsoft Learn – Lifecycle of Windows Server 2016
- Microsoft Learn to Prepare Extended Security Updates via Azure Arc
Note: This article reflects the status of October 13, 2026. License terms and prices for Extended Security Updates may change and should be clarified before a decision is made with the License Partner.
Would you like to implement this in your company? We support you pragmatically – from the idea to the operation.