Infrastructure

Windows Server 2016 End of Support (January 12, 2027): Upgrade, Migrate or Modernize?

The three realistic paths for every Windows Server 2016 machine, how to map what runs on it, and what Extended Security Updates do and do not cover.

Close-up of blue-lit data center server racks of the kind still running Windows Server 2016 workloads

By DESSS Infrastructure Team

Windows Server 2016 end of support arrives on January 12, 2027, according to Microsoft's lifecycle page. After that date, servers get no more security updates unless enrolled in paid Extended Security Updates. For each server, choose one of three paths: upgrade in place, migrate to Windows Server 2025, or move the workload to Azure.

Windows Server 2016 end of support is a fixed deadline, but the risky part is rarely the operating system itself. It is the line-of-business software, scheduled jobs and integrations that run on top of it. That is why we treat it as an application migration project first and a server project second.

What Does Windows Server 2016 End of Support Mean?

End of support means Microsoft stops releasing security updates, non-security fixes and assisted support for Windows Server 2016 after January 12, 2027. Servers keep running, but every vulnerability found after that date stays open unless the server is enrolled in paid Extended Security Updates or moved to a supported version.

The date covers the Datacenter, Essentials, MultiPoint Premium and Standard editions, and Microsoft's list of products ending support in 2027 shows that Hyper-V Server 2016 and IIS 10 on Windows Server 2016 share it.

For regulated businesses, the real issue is evidence. Auditors and cyber insurers ask whether systems run supported software, and an unpatched server holding patient or payment data is hard to defend.

Upgrade, Migrate or Modernize: The Three Realistic Paths

1. In-place upgrade

An in-place upgrade installs a newer Windows Server version over the existing one and keeps settings, roles and data. Microsoft's upgrade path table confirms that Windows Server 2016 can move directly to Windows Server 2019, 2022 or 2025 using installation media.

It is the fastest option on the same hardware, but it carries forward old configuration, and not every role supports it. Failover clusters can only advance one version at a time with a cluster rolling upgrade.

2. Migrate to a new Windows Server 2025 server

A Windows Server 2025 migration builds a clean server, then moves roles, applications and data across. It takes more effort than an upgrade, but the old server stays untouched until cutover, which makes rollback simple. It is usually better when hardware is aging or the build is poorly documented. Our server upgrades and migrations work often runs old and new servers side by side for a short validation period.

3. Move workloads to Azure

Moving to Azure means running the workload on an Azure virtual machine with a newer Windows Server image, or replacing parts of it with managed services such as Azure SQL. It suits variable demand and companies that want to stop refreshing hardware. A Microsoft Azure consulting review should compare running costs honestly against keeping the server on-premises.

Path	Best for	Main risk
In-place upgrade	Simple servers on healthy hardware	Old configuration problems carry forward
New Windows Server 2025 server	Aging hardware, undocumented builds	More effort and a planned cutover window
Azure	Variable demand, avoiding hardware refresh	Cost surprises if servers are not right-sized

Engineer with a tablet checking a server rack while inventorying servers before a Windows Server 2025 migration

How Do You Inventory Servers and Application Dependencies?

Start by listing every Windows Server 2016 instance, physical or virtual, then record what each one actually does: roles, installed applications, databases, scheduled tasks, service accounts and the other systems it talks to. The dependency map, not the server count, determines how long the project takes.

Useful sources of truth include:

Your virtualization platform and Active Directory, to find forgotten servers
Installed programs and running services
Scheduled tasks and SQL Server Agent jobs, which often hide nightly exports
Firewall rules and network flow logs
Vendor support statements for your business software

Also talk to the people who use each application, because they know about the month-end report or label printer that never appears in a diagram. An IT infrastructure consulting assessment can speed up discovery.

If the inventory turns up SQL Server 2016, plan for it separately. It already passed its own end-of-support date, as our guide to SQL Server 2016 and SharePoint 2016/2019 end of support explains.

Plan the Rollback Before You Plan the Cutover

A rollback plan is a written, tested way to return to the last working state if the new server misbehaves. Write it before any change window:

Take a full backup or snapshot and prove you can restore it
Keep the old server intact until the new one has run through a full business cycle
Lower DNS time-to-live values before cutover so name changes can be reversed quickly
Agree on go or no-go checks in advance: logins, key transactions, printing, integrations and reports
Name who makes the rollback call and by what time

Domain controllers need extra care, and Microsoft publishes separate guidance for upgrading them.

Should You Buy Extended Security Updates for Windows Server 2016?

Extended Security Updates are a paid, temporary bridge, not a plan. Microsoft offers them for Windows Server 2016 for up to three years, through 2030, covering Critical and Important security fixes only. They make sense for a few servers that genuinely cannot move by January 12, 2027.

Here is what Microsoft's documentation says today:

Delivery is through Azure Arc. You install the Azure Connected Machine agent on each server and enroll it in the Azure portal. Configuration opened on August 3, 2026, and billing starts January 13, 2027.
Eligibility is limited. Standard and Datacenter editions qualify, and buying ESUs requires Software Assurance through a volume licensing program unless the servers are licensed through SPLA or a server subscription.
Coverage is narrow. ESUs exclude new features and non-security fixes, and they do not restore normal technical support.
Azure is no longer a free route. Windows Server 2012 ESUs were included at no extra charge for Azure virtual machines. Microsoft standardized ESU pricing for new offerings from April 1, 2026, so the same list price applies in Azure, on-premises or another cloud, and its Azure Local documentation names Windows Server 2016 as covered by that change. Azure-hosted servers can receive the updates, but they pay for them.

Mistakes to Avoid

Treating ESUs as the plan instead of a bridge
Upgrading in place without checking vendor support first
Forgetting appliances that run Windows Server 2016 underneath
Scheduling cutovers during year-end close, just before the deadline
Retiring the old server before a full business cycle has passed

What to Do in the Next 60 Days

Inventory every Windows Server 2016 instance, including virtual machines and appliances.
Map each server's applications, databases, scheduled jobs and integrations, and confirm vendor support for Windows Server 2025.
Assign each server a path: in-place upgrade, new server, Azure, retirement, or ESU as a last resort.
Move one low-risk server end to end, including a rehearsed rollback.
Book change windows that avoid year-end close.
For servers that cannot finish by January 12, 2027, confirm Software Assurance status and set up Azure Arc early.
Migrate the remaining servers in waves, keeping old ones intact until each wave is validated.

Frequently Asked Questions

Will Windows Server 2016 stop working after January 12, 2027?

No. Servers keep booting and running applications after the end-of-support date. What stops is the flow of security updates, bug fixes and assisted support from Microsoft. Each vulnerability discovered after that date remains unpatched unless the server is enrolled in Extended Security Updates, so the risk grows month by month instead of arriving all at once.

Can I upgrade Windows Server 2016 directly to Windows Server 2025?

Yes, for nonclustered servers. Microsoft lists a direct in-place upgrade from Windows Server 2016 to Windows Server 2025 using installation media. Clusters are different, because a cluster rolling upgrade moves only one version at a time. Back up first, check that each role and application supports the upgrade, and rehearse it on a copy before touching production.

Are Windows Server 2016 Extended Security Updates free in Azure?

Not under current Microsoft pricing. Free ESUs on Azure applied to Windows Server 2012, but Microsoft standardized pricing for new ESU offerings from April 1, 2026, and its documentation places Windows Server 2016 under that model. Azure-hosted servers can still receive the updates, but expect the same list price as servers running on-premises or in another cloud.

How long does a Windows Server 2016 migration take?

It depends far more on applications than on server count. A file server with few dependencies can move in a single change window, while a server running custom software, scheduled exports and vendor integrations may need weeks of testing. A dependency inventory in the first two weeks gives you a realistic timeline and shows which servers need a bridge.

Need a Plan Before January 12, 2027?

DESSS helps Houston businesses inventory Windows Server 2016 estates, choose a path for each server and carry out the move with tested rollback plans. If you would rather hand off patching and monitoring afterward, see our managed IT services. Contact DESSS to start with an inventory, visit us at 2825 Wilcrest Dr #608, Houston, TX 77042, call +1-713-589-6496 or email info@desss.com.