About this article: AI-assisted writing, reviewed against the cited sources. This is source research, not lab validation. Check the stated versions and your own requirements before making changes.
Microsoft lists 12 January 2027 as the end of extended support for Windows Server 2016. After that date, a 2016 server gets no more monthly security updates unless its owner pays for Extended Security Updates (ESU). The server will keep running, so nothing visibly breaks on that day. Newly discovered vulnerabilities affecting that unsupported installation may remain unpatched unless addressed through an applicable update or support route, or migration to a supported system. Applicable mitigations may reduce exposure while that work is completed.
For a business running accounting, practice-management, ERP or similar software on a 2016 server, the decision is not simply "upgrade Windows". There are three real choices: upgrade in place, build a new server and move the application, or pay for ESU for a limited time while one of the first two is prepared. Which is right depends mostly on the application, not on Windows.
Why it matters
Windows Server Long-Term Servicing Channel releases get a minimum of 10 years of support: five years for mainstream support and five years for extended support, which includes regular security updates. Windows Server 2016 reached the end of mainstream support in January 2022, so for almost five years it has been getting security fixes only. When extended support ends, Microsoft's ESU overview says this also means the end of security updates and bulletins.
Three practical problems follow from that.
- Unpatched vulnerabilities can accumulate. Without an applicable update route, vulnerabilities affecting the installed system may remain. Network rules, limited sign-in and monitoring can reduce exposure, but do not replace supported security updates.
- Application vendors move on. Many business software vendors stop certifying new releases on an operating system once Microsoft stops supporting it. The application's own update path can be blocked even when the server still works.
- Audit and contract questions. The Australian Signals Directorate's Essential Eight maturity model says, under patching operating systems, that Operating systems that are no longer supported by vendors are replaced. Customer security reviews and insurance questionnaires commonly ask similar questions. An unsupported server is hard to explain in any of them.
The same window affects databases. Microsoft's lifecycle page shows SQL Server 2016 extended support ending in July 2026. A business whose application runs on Windows Server 2016 with SQL Server 2016 now has two products to deal with, and it is often sensible to plan both moves together.
How it works
What ends, and what does not
End of extended support stops security updates and Microsoft technical support for the product. It does not deactivate the server, stop it from starting or remove any feature. That is why the date is easy to miss: the server behaves exactly as it did the day before.
Extended Security Updates: what you get and what you do not
ESU is a paid program. Microsoft describes it as a last resort option for customers who need to run certain legacy Microsoft products past the end of support. It provides security updates rated Critical and Important up to three years after the product's End of Extended Support date. For Windows Server 2016, the FAQ lists three ESU years ending in January 2028, January 2029 and January 2030.
What ESU does not do matters as much:
- It does not extend the product's lifecycle and does not provide technical support beyond the original support timeline.
- ESU don't include new features, customer-requested nonsecurity hotfixes, or design change requests. A reliability bug that is not a security issue will not be fixed.
- It is not free. For Windows Server 2016, ESUs are a paid offering in Azure and incur additional charge, unlike the earlier 2012 offer, which was free on Azure.
For on-premises or hosted servers, Microsoft's ESU eligibility criteria list three routes: active Software Assurance; active subscription licences through a program such as Cloud Solution Provider (CSP); or licence-included services acquired through a Service Provider License Agreement (SPLA) partner. Licence-included means the provider supplies the Windows licence, rather than the customer bringing their own. A customer-owned perpetual 2016 licence without Software Assurance does not by itself meet those criteria. A provider-included SPLA licence is a separate eligible route, not evidence that the customer owns a subscription. Confirm the applicable route, ESU supply and charges with the licensing partner before choosing ESU.
ESU licences come in annual periods. The FAQ says licences obtained through commercial licensing are valid for annual coverage periods, such as Year 1 ESU, Year 2 ESU, and Year 3 ESU. The two licensing routes it names are Azure Arc-enabled servers and commercial licensing through a Microsoft program.
ESU for servers at a hosting provider
If the server runs at a hosting provider, two FAQ statements matter.
- Bring your own licence. If you have brought your own licenses to a cloud hosting provider via your Outsourcing policy or License Mobility, you can cover your software with ESU licenses.
- Counting cores. On a virtual core basis you need an ESU license for each virtual core assigned to the VM, and the FAQ adds that Windows Server has an 8-core minimum per VM for vCore licensing. A two-vCPU application server still needs eight core licences on that basis.
If the hosting provider supplies the Windows licence as part of the service, ask the provider directly whether it can supply ESU for 2016 servers, at what price, and for how many years. Do not assume it can.
Supported in-place upgrade paths
An in-place upgrade installs the new Windows Server version over the existing one and keeps the applications, data and settings. Microsoft's upgrade overview says that Starting with Windows Server 2025, nonclustered systems can upgrade up to four versions at a time. It also says you can upgrade directly to Windows Server 2025 from Windows Server 2012 R2 and later. Its path table for installation media shows Windows Server 2016 upgrading directly to 2019, 2022 or 2025. Clusters are different: with a cluster OS rolling upgrade, you can only upgrade one version at a time.
The same page lists restrictions that rule out an in-place upgrade on some servers. These include:
- Upgrades from one language to another aren't supported.
- Switching from a Server Core installation to a Server with Desktop Experience installation (or vice versa) during an in-place upgrade isn't supported.
- The edition stays the same by default. You can move from Standard to Datacenter during an upgrade, but You can't downgrade from Datacenter to Standard.
- A new licence is needed. Microsoft notes that Unlike Windows client, each Windows Server upgrade requires a separate license.
- On hosted servers: Some public and private cloud providers support in-place upgrades. Check with your cloud provider for details.
Not every role should be upgraded in place
Microsoft's role matrix lists, for each server role, whether an in-place upgrade or migration is supported. Two entries surprise people:
- For Active Directory Domain Services, an in-place upgrade is marked Not recommended, with the advice to use a clean OS install to get AD performance and feature improvements. In practice that means building new domain controllers and retiring the old ones.
- For Print and Fax Services, in-place upgrade is marked "No"; migration is supported using Printbrm.exe.
The role matrix supports in-place upgrades for Remote Desktop Services sub-roles, but its mixed-mode warning needs the role-specific RDS migration guidance. Plan the whole deployment together; that does not require a single all-server cutover. Microsoft orders Connection Broker migration before session collections and permits a newer broker to serve older session hosts. Different Windows Server versions must not be mixed within a Connection Broker high-availability deployment or within a session-host collection. Stage the work according to those role and collection boundaries.
What to choose and why
Start with the application, not Windows.
- List every 2016 server and what it runs. Include the business application, its database, any reporting or integration services, scheduled tasks, printers and anything users connect to by name. A server described as running a single application often turns out to run several services.
- Ask the application vendor which Windows Server and SQL Server versions the current release supports. Microsoft's own in-place upgrade guide lists Any non-Microsoft application vendor support requirements as a prerequisite. If the vendor certifies only a newer application version, the application upgrade comes first and shapes everything else.
- Choose a path for each server.
| Situation | Usually the better path | Why |
|---|---|---|
| Vendor supports the current application on 2022 or 2025, server is in good health, no AD DS or print roles | In-place upgrade, after a tested backup | Keeps the configuration; Microsoft supports 2016 straight to 2025 for non-clustered servers |
| Server has years of accumulated changes, unknown software or a problematic history | New server, move the application | A clean build removes old drivers, agents and settings nobody can explain |
| Domain controller | New domain controllers, then retire the old ones | Microsoft marks in-place upgrade as not recommended for AD DS |
| Remote Desktop farm | Coordinate a staged, role-specific migration | Migrate brokers before collections; do not mix versions within broker high availability or a session-host collection |
| Application cannot move before January 2027 and has active SA, active subscription licences or eligible SPLA licence-included hosting | ESU for a defined period, with an end date | Buys time for security fixes only; no new fixes for anything else |
| Application cannot move and ESU is not available | Isolate and reduce exposure while the move is planned | No supported update route exists; treat it as a short-term risk to be closed |
- Test before the real change. The in-place upgrade guide asks for A full backup of your server, including the operating system, apps, data, and any VMs, plus a restore test to confirm the backup is valid. On a virtual server, the most useful rehearsal is to restore a copy into an isolated network, upgrade the copy, and have a real user try normal daily tasks on it. That tells you about the application, which is the part that usually fails.
- Plan SQL Server alongside Windows. If the database is SQL Server 2016, it is already past extended support. Check which SQL Server versions the application vendor supports and whether the database upgrade, the Windows upgrade or both should happen in one maintenance window.
Questions to ask a hosting provider
If your 2016 servers are hosted, the provider controls part of this. Ask in writing:
- Do you support in-place upgrades of hosted Windows Server 2016 virtual machines, or do you require a new server?
- Who supplies the Windows Server licence for the new version, and how is it priced?
- Can you supply Windows Server 2016 ESU, and for how many years?
- Who performs the upgrade, who tests the application, and who decides to roll back?
- Is a rollback copy of the server kept, and for how long?
Risks and limits
- Not legal or licensing advice. Licensing terms come from your agreement with Microsoft or your provider. The ESU FAQ and upgrade pages describe Microsoft's program as published in November 2026, and the details can change. Confirm eligibility and counts with your licensing partner.
- The application decides. Microsoft can say Windows supports an upgrade path. Only the software vendor can say the application is supported on the result.
- In-place upgrades can fail part way. Microsoft requires a backup and a restore test for good reason. A snapshot on a hypervisor is useful for a quick rollback, but it is not a backup and should not be kept for long.
- ESU has a hard end. For Windows Server 2016 the last ESU year ends in January 2030. ESU postpones a move; it does not replace one.
- Isolating an unpatched server is a stopgap. Firewall rules and restricted sign-in reduce the attack surface. They do not fix vulnerabilities in services the application itself needs.
- Dates. Microsoft shows support dates in US Pacific time. Treat the end date as a deadline to finish before, not a day to start.
Sources
Opened 14 November 2026.
- Microsoft Learn: Windows Server 2016 – Microsoft Lifecycle, updated 2026-11-11.
- Microsoft Learn: Product Lifecycle FAQ – Extended Security Updates, dated 2026-11-10.
- Microsoft Learn: Extended Security Updates for Windows Server overview, updated 2026-04-03 (written for 2012 and 2012 R2; used here for the general program description).
- Microsoft Learn: Plan your Windows Server upgrade path, dated 2026-04-14.
- Microsoft Learn: Upgrade Windows Server in place, dated 2026-04-14.
- Microsoft Learn: Upgrade and migrate roles and features in Windows Server, dated 2026-04-27.
- Microsoft Learn: Migrate Remote Desktop Services roles, role-specific migration and mixed-version limits, displayed date 2024-07-03.
- Microsoft Learn: SQL Server 2016 – Microsoft Lifecycle, updated 2025-10-23.
- Australian Signals Directorate: Essential Eight maturity model.
Related service: Windows application hosting.
Related future topics
- Upgrading SQL Server 2016 for a business application: supported version paths and compatibility level.
- Rebuilding domain controllers on a newer Windows Server without disturbing sign-in.
- Moving a Remote Desktop farm to a new Windows Server version.
Learning notes
- "End of support" means no more security fixes. The server keeps running, which is why the date is easy to miss.
- Extended Security Updates are paid, annual and limited to three years. They fix security problems only.
- ESU eligibility includes active Software Assurance, active subscription licences and licence-included SPLA hosting. A customer-owned perpetual licence alone does not qualify.
- Microsoft supports upgrading a non-clustered 2016 server straight to 2025, but not changing language or switching between Server Core and Desktop Experience during the upgrade.
- The application vendor's supported versions decide the plan. Check them before choosing a path.
This article was originally published on .