Windows Server 2016 reaches end of extended support on 12 January 2027. After that, Microsoft stops releasing security updates for it unless you pay for Extended Security Updates (ESU), which run for up to three years to January 2030. Your options are an in-place upgrade (2016 can go straight to Windows Server 2025), migrating roles to a new server, buying ESU as a stopgap, or moving workloads to the cloud.
Written by the Softkeyworld technical team · Updated October 2026
Windows Server 2016 has had a long, solid run. It's still the operating system behind a lot of small-business domain controllers, file servers and line-of-business application hosts. With fewer than three months left before extended support ends, the question for most owners is no longer whether to move but how, and how quickly it can be done without disrupting the business.
This guide covers what the deadline actually means, the four realistic paths forward, how to choose between them, and a practical checklist for the migration itself.
Key takeaways
- End of support: 12 January 2027. Servers keep running, but security patches stop.
- Windows Server 2025 supports a direct in-place upgrade from 2016.
- Paid ESU is available for up to three years, through Azure Arc or CSP. It's a bridge, not a destination.
- Domain controllers should be replaced with new servers rather than upgraded in place.
- Check the applications on the server too. SQL Server 2016 and Exchange Server 2016 are already out of support.
What "end of support" actually means
Microsoft confirmed the date in its Windows Server 2016 end-of-support announcement: extended support ends on 12 January 2027. That's the January 2027 Patch Tuesday, the last regular security update. After it:
- No more security updates for newly discovered vulnerabilities, unless the server is enrolled in ESU.
- No technical support from Microsoft for the OS.
- The server doesn't stop working. Activation, roles and services carry on exactly as before. The risk is gradual and invisible until it isn't.
- Compliance exposure. Frameworks such as Cyber Essentials in the UK and PCI DSS expect supported, patched operating systems. An unsupported server in scope is typically a fail.
- Software vendors move on. Backup agents, antivirus and line-of-business applications progressively drop support for an unsupported OS.
Windows 10 Enterprise 2016 LTSB shares the same end date. Check for any embedded or kiosk machines running it at the same time.
Windows Server support timeline at a glance
| Version | Mainstream support ends | Extended support ends | Verdict for a 2016 replacement |
|---|---|---|---|
| Windows Server 2016 | Ended January 2022 | 12 January 2027 | Replace |
| Windows Server 2019 | Ended January 2024 | January 2029 | Too short: you'd be migrating again in two years |
| Windows Server 2022 | Ended October 2026 | October 2031 | Workable if an application requires it |
| Windows Server 2025 | November 2029 | November 2034 | Recommended target |
Dates are from Microsoft's lifecycle pages, such as the Windows Server 2016 lifecycle entry. If you're weighing 2022 against 2025, our Windows Server 2025 vs 2022 comparison covers the feature differences, and our earlier piece on Server 2022 mainstream support ending explains what that milestone means.
Your four options
Option 1: In-place upgrade to Windows Server 2025
Starting with Windows Server 2025, non-clustered servers can upgrade up to four versions at once. Microsoft's upgrade path documentation lists 2016 as a direct source for 2025. Microsoft's rules for an in-place upgrade:
- The edition stays the same (Standard to Standard, Datacenter to Datacenter). You can go from Standard to Datacenter, but never down.
- You can't switch between Server Core and Desktop Experience, or change the system language, during the upgrade.
- Unlike Windows client upgrades, every Windows Server upgrade needs a new licence for the target version.
- Failover clusters use cluster OS rolling upgrades, which move one version at a time.
Best for: application or file servers on hardware with life left in it, where rebuilding would be disruptive. Check that the hardware meets Server 2025's processor requirements first. The CPU must support SSE4.2 and POPCNT, so very old hosts can fail this check.
Option 2: Migrate to a new server
Build a clean Windows Server 2025 machine (physical or virtual), move roles and data across, then decommission the old box. It takes more effort but leaves you with a clean OS, no inherited clutter, and usually new hardware with years of warranty. A 2016-era server is often eight to ten years old, so this is frequently the right call anyway.
Best for: domain controllers (where Microsoft recommends promoting new DCs rather than upgrading in place), ageing hardware, and servers that have accumulated years of roles and software.
Option 3: Extended Security Updates as a bridge
For servers that genuinely can't move by January, for example because of an application awaiting vendor certification, Microsoft offers paid ESU for Windows Server 2016 for up to three years, through to January 2030. According to Microsoft's Azure Arc ESU documentation:
- ESU covers Standard and Datacenter editions and is delivered through Azure Arc, with billing beginning on 13 January 2027. It's also sold through Cloud Solution Provider (CSP) partners.
- On-premises servers need Software Assurance through a volume licensing agreement, or an equivalent server subscription, to qualify.
- ESU provides Critical and Important security updates only: no new features, no non-security fixes.
Terms for workloads hosted in Azure have differed between ESU programmes, so confirm current eligibility with Microsoft or your licensing partner rather than assuming earlier arrangements still apply. Many small businesses buy perpetual licences without Software Assurance and won't qualify for on-premises ESU. For them, migration is the only supported path.
Option 4: Move the workload to the cloud
Some 2016 servers exist only to host things that now have managed equivalents. File shares can move to SharePoint/OneDrive, Exchange to Exchange Online, and some line-of-business apps to the vendor's SaaS version. Retiring a server entirely is the cleanest outcome, but it changes costs from one-off to recurring and depends on your connectivity. Assess it workload by workload rather than as all-or-nothing.
Comparing the options
| Option | Effort | Supported until | Main risk |
|---|---|---|---|
| In-place upgrade to 2025 | Low–medium | November 2034 | Carries old configuration and ageing hardware forward |
| New server + migration | Medium–high | November 2034 | Missed dependencies during cut-over |
| ESU | Low | Up to January 2030 | Recurring cost; problem only deferred |
| Cloud/SaaS replacement | Varies | Ongoing (subscription) | Ongoing cost, connectivity dependence |
Migration checklist
-
Inventory every 2016 instance, including VMs and forgotten utility servers. In PowerShell,
Get-ADComputer -Filter 'OperatingSystem -like "*2016*"' -Properties OperatingSystemlists domain-joined ones. -
List roles and features on each with
Get-WindowsFeature | Where-Object Installed, and note installed applications. - Check application support for Windows Server 2025 with each vendor. Pay particular attention to accounting, ERP and practice-management software.
- Check the software on top. SQL Server 2016 reached end of support in July 2026 and Exchange Server 2016 in October 2025. Upgrading the OS alone won't make those workloads compliant.
- Take a verified backup and test a restore before touching anything.
-
Domain controllers: build a new 2025 DC, promote it, transfer FSMO roles (
Move-ADDirectoryServerOperationMasterRole), update DNS settings on clients and DHCP, then demote the old DC. -
File servers: Storage Migration Service in Windows Admin Center can inventory, copy and cut over shares, including permissions. For small servers,
robocopywith/MIR /COPYALLalso works. Test it on a sample first. - Licensing: buy Windows Server 2025 licences and the right number of CALs before cut-over (details below).
- Decommission properly: remove the old server from AD and DNS, wipe its disks, and update your documentation.
Special cases worth planning separately
Hyper-V hosts
A 2016 Hyper-V host is two problems: the host OS and the guests on it. Upgrade or replace the host first, then deal with each guest on its own merits. A host running Server 2025 can run older guests, but a 2016 guest is still out of support whatever host it sits on. When moving VMs to a new host, export and import them (or use live migration between clustered nodes), then upgrade each VM's configuration version once you're sure you won't need to move it back.
Remote Desktop Services
RDS deployments need every role server (Connection Broker, Session Hosts, Gateway, Licensing) on a supported version, and RDS CALs that match the new server version. Plan the licensing server and RDS CALs before the first session host moves, or users will hit licensing grace-period warnings.
Windows Server 2016 Essentials
Small offices running 2016 Essentials face the same deadline. Microsoft's ESU documentation lists Standard and Datacenter only, so plan a straightforward replacement. For a single small-office server, a modern Essentials or Standard licence on new hardware is usually the simplest route. Check the user and device limits of whichever edition you choose against your headcount.
Line-of-business applications on SQL Server
If an accounting or practice-management package runs on a SQL Server 2016 instance on the same box, move the database to a supported SQL Server version as part of the same project. Vendors frequently certify new versions of their software only against current SQL Server releases, so the OS upgrade is often the trigger for an application upgrade too. Ask the vendor for their supported matrix before you schedule anything.
A realistic timeline from today
| When | What to get done |
|---|---|
| Late October – early November | Inventory, application compatibility checks, decide upgrade vs migrate per server, order hardware and licences |
| November | Build and test the first 2025 server; migrate low-risk roles; promote new domain controllers |
| Early December | Migrate file shares and line-of-business applications; user acceptance testing |
| Before the holiday change freeze | Final cut-overs; decide on ESU for anything that won't make it |
| January 2027 | Decommission 2016 servers; confirm ESU enrolment for any remaining |
The holiday period removes two or three working weeks for most businesses. Treat mid-December, not 12 January, as your practical deadline.
Licensing the replacement
Windows Server 2025 Standard and Datacenter are licensed per physical core. Every core in the server must be licensed, with a minimum of 8 core licences per processor and 16 per server. Standard covers two virtual machines (operating system environments) when all cores are licensed. Datacenter covers unlimited VMs on the licensed host. As a rule of thumb, a host running more than a handful of Windows VMs is usually better served by Datacenter.
Client Access Licences (CALs) are still required for users or devices that access the server. Note that 2016 or 2019 CALs don't cover access to a 2025 server; CALs must be the same version as the server or newer. If you've licensed CALs before, our Windows Server CAL installation guide shows how they're applied in practice. Once licensed, our Windows Server 2025 download, install and activation guide covers the build itself.
Frequently asked questions
When does Windows Server 2016 support end?
Extended support ends on 12 January 2027. Mainstream support already ended in January 2022.
Will Windows Server 2016 stop working after January 2027?
No. It will keep running and stay activated, but it won't receive security updates unless it's enrolled in paid ESU.
Can I upgrade directly from Server 2016 to Server 2025?
Yes. Windows Server 2025 supports in-place upgrades from 2012 R2 and later on non-clustered servers. Keep the same edition, and buy a new licence.
How long do Extended Security Updates last for Server 2016?
Up to three years, to January 2030. ESU is paid, sold through Azure Arc and CSP, and on-premises servers need Software Assurance or an equivalent subscription.
Should I move to Server 2022 or 2025?
Choose 2025 unless an application specifically requires 2022. 2025 is supported until November 2034, compared with October 2031 for 2022, whose mainstream support has already ended.
Can I in-place upgrade a domain controller?
It's possible, but Microsoft recommends promoting a freshly installed server and demoting the old DC instead. It's cleaner and easier to roll back.
Our recommendation
Start the inventory this week, because three months goes quickly once vendors and change windows are involved. For most small and mid-sized businesses, Windows Server 2025 Standard on new or recent hardware is the sensible target: eight years of support, a supported direct upgrade path from 2016, and no ESU bill to budget for. Keep ESU in reserve for the one or two servers that truly can't move in time.
View Windows Server 2025 Standard
Related reading
| Resource | Why read it |
|---|---|
| Windows Server 2025 vs 2022 | Pick the right target version |
| Windows Server 2025 install and activation | Build the replacement server |
| Windows Server CAL installation guide | How CALs are applied |