- Extended support for Windows Server 2016 ends on 12 January 2027. The January Patch Tuesday update is the last one for servers without ESU
- Extended Security Updates (ESU) run for up to three years, through 2030, and cover Critical and Important security fixes only
- On-premises servers get ESU through Azure Arc, billed monthly from 13 January 2027. You need Software Assurance, a Server Subscription or SPLA licensing to buy it
- Microsoft has not published a list price for Windows Server 2016 ESU. Ask your licensing partner for a quote now, before the January deadline
- SQL Server 2016 left support on 14 July 2026 and Exchange Server 2016 on 14 October 2025, so many 2016 servers already run more than one unsupported product
What changes on 12 January 2027
Windows Server 2016 was released in October 2016. Mainstream support ended in January 2022, and Microsoft's lifecycle page lists the end of extended support as 12 January 2027. That date is also the January Patch Tuesday, so the cumulative update released that day is the final one for any server not enrolled in ESU.
Nothing switches off. The servers keep booting, Active Directory keeps authenticating users and file shares stay online. The fixes stop. A vulnerability disclosed in February 2027 will be patched on Windows Server 2019, 2022 and 2025, and attackers can compare those patches to work out exactly what remains open on 2016. Container images built on the Windows Server 2016 base image follow the same dates.
Where Windows Server 2016 hides in your estate
Your main application servers are probably on the list already. The 2016 installs that cause trouble tend to be the ones left out of the server project:
- Domain controllers that were built in 2017 or 2018 and left alone since
- Hyper-V hosts, which leave every virtual machine on them exposed if the host itself is compromised
- Remote Desktop Services hosts and the licensing server behind them
- Backup, print and file servers, often on older hardware in a comms cupboard
- Vendor-supplied systems such as CCTV recorders, building management, lab equipment or a line-of-business application, where the supplier installed 2016 and controls the upgrade
- An Exchange Server 2016 box kept for hybrid management, which has been unsupported since October 2025
- SQL Server 2016 instances, which lost support in July 2026 and need their own plan
Your options compared
| Option | What you get | Best for |
|---|---|---|
| Upgrade in place to Windows Server 2025 | Support until November 2034. Windows Server 2025 accepts in-place upgrades from 2016 directly. Check application, backup agent and vendor support for 2025 first | Stable single-role servers on hardware with a few years left |
| Build new and migrate | A clean installation without 2016-era drivers, agents and settings | Domain controllers, file servers and anything on ageing hardware |
| Move the workload to Azure | No hardware to replace. Microsoft has previously included ESU for older Windows Server versions in Azure at no extra charge | Servers already due for a hardware refresh |
| Buy ESU through Azure Arc | Up to three years of security fixes, billed monthly | Servers that cannot move before January, such as vendor systems awaiting a supported version |
| Retire the server | One less system to patch and license | Workloads already moved to SharePoint, a SaaS product or another server |
Don't upgrade domain controllers in place. Add Windows Server 2025 domain controllers, move the FSMO roles, check replication, then demote and remove the 2016 machines. That leaves no upgraded system state behind. In a single-site domain it can take a day or two; more sites, or a certificate authority running on a domain controller, add time. For the Azure route, confirm the current ESU terms for 2016 with your licensing partner before you count on free coverage.
How ESU for Windows Server 2016 works
Microsoft announced Windows Server 2016 ESU in February 2026 and delivers it for on-premises and multi-cloud servers through Azure Arc. You install the Azure Connected Machine agent (version 1.62 or later) on each server, connect it to your Azure subscription and enrol it in ESU from the Azure portal or with Azure Policy. Enrolment has been open since 3 August 2026, and billing starts on 13 January 2027.
The terms are narrower than many teams expect:
- Only Standard and Datacenter editions are eligible
- To buy ESU you need Software Assurance through a Volume Licensing programme such as an Enterprise Agreement, Server and Cloud Enrollment or Open Value. Servers licensed through SPLA or a Server Subscription do not need Software Assurance
- ESU covers security updates rated Critical and Important. It does not include new features, non-security fixes or design changes
- Billing is pay-as-you-go per month, so you can stop paying for a server once it is migrated. Charges can draw down an existing Azure consumption commitment
- Virtual desktop (VDI) machines should not use Arc. Microsoft directs them to Multiple Activation Keys instead
- Enrolled servers get Azure Update Manager, Change Tracking and Inventory and Azure Policy guest configuration at no extra cost
Microsoft had not published a list price for Windows Server 2016 ESU at the time of writing. Ask your licensing partner for a written quote based on your core count and check that your Software Assurance does not lapse during the ESU period.
Each enrolled server must reach Microsoft Entra ID, the Azure Arc service endpoints and Microsoft's certificate download site, directly, through a proxy or over Private Link. Servers on isolated networks, such as production or building systems, need that path agreed with whoever owns the firewall. Microsoft keeps the current endpoint list and agent requirements in its Arc ESU preparation guide, and the list changes, so check it before you raise firewall requests. Test one server in November, not on 11 January.
An 11-week plan
This schedule is tight. Vendor systems, hardware orders and the Christmas change freeze can push some servers past January; steps 4 and 6 are there for those.
Compliance implications
Cyber Essentials requires in-scope software to be licensed and supported, with critical and high-risk updates applied within 14 days. A Windows Server 2016 machine without ESU fails that requirement from 13 January 2027, unless it sits on a network segment you have excluded from the assessment scope. Assessors have taken different views on ESU; confirm with your certification body before you rely on it.
ISO 27001:2022, Annex A.8.8 (management of technical vulnerabilities) expects you to identify vulnerabilities and deal with them within a defined timescale. An auditor will want a dated remediation plan for any server that no longer gets patches.
UK GDPR Article 32 requires appropriate technical measures to protect personal data. After a breach on an unsupported server, the ICO can treat the missing patches as evidence that those measures were not appropriate. Organisations under the NIS Regulations or supplying EU clients covered by NIS2 Article 21 face the same question from regulators and customers.
If you are also clearing out Windows 10, our guide to Windows 10 end of life covers the desktop side, and the vulnerability management guide explains how to track unpatched systems after the deadline.