Windows Server 2016 End of Support: The Three Options Before 12 January 2027
Windows Server 2016 reaches end of support on 12 January 2027. Upgrade in place, buy Extended Security Updates, or move the servers as-is onto hosted hardware: what each one costs you in risk, money and weekends, told through a freight carrier that has been through two of these cycles.
On this page
Every business running Windows has at least one server it would rather not think about. It has been fine for years, the application on it is the one the business actually runs on, and it says Windows Server 2016 in the corner of the login screen.
On 12 January 2027, that server stops getting security updates. Microsoft confirmed the date on its Windows Server blog in February 2026, and announced a paid Extended Security Updates programme in the same breath, which tells you how many businesses they expect to miss it.
This is a practical guide to the three ways through, with a fourth that buys time. It is written from two cycles of doing exactly this for Armellini Express Lines, a refrigerated freight carrier whose dispatch and EDI systems cannot have a bad weekend, and from the smaller businesses who call us in November asking what to do about January.
First, what “end of support” actually means
Nothing happens on 13 January. The server boots, the application runs, staff log in. That is why so many businesses sail past the date.
What changes is that every vulnerability discovered in Windows Server 2016 after that date stays open on your machine forever. Patch Tuesday skips you. The first exploit that matters usually arrives within months, not years, and it arrives at the same time for every unsupported server on the internet.
Two groups notice before you do. Your cyber insurer, whose questionnaire now asks whether you run unsupported operating systems, and treats “yes” as a reason to raise the premium or decline the claim. Your auditor or regulator, if you have one, for whom an out-of-support server is a finding, not a detail. If you are in insurance, finance, healthcare or logistics with EDI partners, that finding has a cost before any attacker shows up.
Option 1: Upgrade in place
Run Windows Setup on the existing server and move it to Windows Server 2019, 2022 or 2025. Microsoft supports the in-place path from 2016 to all three.
When it works: a server doing one well-understood job, with a current, supported application on it, on hardware with a few years left. Domain controllers, file servers and print servers upgrade cleanly most of the time.
Where it goes wrong: the application. The server that has been “fine for years” is often fine because nobody has touched it. A line-of-business system installed in 2017, a custom Windows service someone wrote and left, an ODBC driver, a licence tied to a hardware fingerprint. Setup does not know about any of that. The upgrade succeeds and the application does not start on Monday.
What we do before any in-place upgrade: copy the server, run the upgrade on the copy, and have the people who use the application try it. If it survives, the real upgrade is a rehearsal. If it does not, you have found out on a Tuesday afternoon instead of at 7 a.m. with the phones ringing. And the old server stays exactly as it was, powered off, as a rollback that takes minutes.
Cost shape: a Windows Server licence for the new version, an engineer for a day or two per server, a maintenance window. Cheapest option if it works, most expensive if it fails in production.
Option 2: Move it as-is onto hosted hardware
Copy the server, exactly as it is, onto dedicated hardware in a data center, and then do the upgrade there, on our schedule, with the original left untouched in your closet as the rollback.
This is what Armellini did, twice. Ten years ago its third-party host was closing and told the company to come and collect its hardware. The Windows and SQL workloads moved as-is into a dedicated private cloud. Since then the environment has been carried through Windows Server generation upgrades inside that cluster, with the carrier’s nine terminals across Florida, Georgia and California connected over fiber the whole time. Nobody in dispatch noticed an upgrade happen, which is the standard.
Why “as-is” matters: same server names, same IP addresses, same domain, same logins. Staff do not retrain. Applications that bind to an IP keep working. The move itself is not a migration project in the way the word usually frightens people; it is a copy over a fiber link while you keep working, then one planned evening to switch over.
What it changes about the 2016 problem: the upgrade stops being an all-or-nothing event in your server room. The copied VM gets upgraded, tested and rolled back on hardware with capacity to spare, by people who do it every month, while the original stays on. And the server you were worried about is now on hardware that is patched, backed up, replicated to a second site and someone else’s job to keep alive.
Cost shape: a fixed monthly number for a two- or three-year term, covering hosting, the fiber to each office, patching, backup and on-call. What is inside that number is on the managed hosting page. More per month than an in-place upgrade’s one-off cost; much less than a failed upgrade, a ransomware weekend, or a second server closet you have to refresh in another five years.
Option 3: Rebuild on new servers (or in Azure)
Build fresh Windows Server 2025 machines, install the applications clean, migrate the data. The same path, in Azure, is Microsoft’s preferred answer and comes with migration credits.
When it is the right call: the application vendor has a supported new version that does not upgrade in place anyway, the data is in a database that migrates cleanly, and you want to shed ten years of accumulated configuration. Also when the hardware under the 2016 server is as old as the operating system and would need replacing regardless.
Where it hurts: every undocumented dependency. Scheduled tasks, mapped drives in login scripts, a printer driver, the Excel macro that calls a UNC path. Rebuilds surface all of it, usually on go-live day. Azure adds a second variable, a usage-metered bill, which for a workload that runs flat all day is paying for elasticity you will not use. We wrote about that trade-off in private cloud vs public cloud.
Cost shape: the most engineering hours of the three, plus hardware or a cloud bill. Highest ceiling on the outcome and the longest project.
The fourth option: buy time with Extended Security Updates
Microsoft’s ESU programme for Windows Server 2016 delivers critical and important security updates for up to three years after January 2027, through Azure Arc, which works for servers on premises or in a data center. Billing starts on 13 January 2027 and is per core; licences bought late are back-billed to the deadline.
It is the honest answer for a server running an application you genuinely cannot move yet. It is not a plan. ESUs carry no new features, no non-security fixes, and a bill that is designed to make upgrading look cheaper every year. If you are reading this in October 2026 with one or two servers, you have time to do one of the three real options before the deadline. ESU is for the business with forty servers and a vendor who has not shipped a 2022-compatible version.
How to decide in one afternoon
For each Windows Server 2016 machine, answer four questions:
- What application runs on it, and does the vendor support it on Windows Server 2022 or 2025? If no, you are choosing between ESU and a vendor conversation, not between upgrade paths.
- How old is the hardware under it? Past five years, an in-place upgrade on that box is a short-term fix.
- Can you afford a bad Monday? If the honest answer is no, do the upgrade on a copy, somewhere with a rollback, not on the production server in your closet.
- Does anyone ask you to prove things about this server? An insurer, an auditor, a trading partner. If yes, the deadline is also a paperwork problem, and moving the server onto hardware whose patching and backups are documented solves two findings at once.
Most of our clients end up with a mix: domain controllers upgraded in place, the application server copied onto hosted hardware and upgraded there, and one stubborn box on ESU with a vendor ticket open.
Phoenix has carried Armellini Express Lines through two Windows Server generation upgrades inside its private cloud, and runs Sigma Underwriting Managers’ entire environment under the same model. If you have Windows Server 2016 machines and a January deadline, book a thirty-minute review: tell us what runs on each one, and you leave with a written option per server, whether or not you hire us. Fort Lauderdale and Broward County: managed IT. Sonoma, Marin and Napa: IT consulting from Rohnert Park.