Windows Server 2016 End of Support: Your Options

Windows Server 2016 gets its last security update on 12 January 2027. Because Microsoft works on Pacific time, that's the morning of 13 January here. After that, every new vulnerability found in it stays open for good.

That date sounds comfortably far away. It isn't. Count the days from early October: about 100. Now take out the Christmas and New Year shutdown, when half your staff and most of your suppliers are at the beach. Realistically you have around 11 or 12 working weeks to plan, buy, build, migrate and test. For a server that's been quietly running your business since 2017, that's not long.

Why the deadline matters more for servers than PCs

A desktop PC with a security hole is bad. A server with one is much worse, for three reasons:

• It holds everything. Shared files, the accounting database, user accounts and often backups all live on or behind the server.
• It controls access. If the server runs Active Directory, compromising it means compromising every login in the business.
• Attackers know about the deadline too. Once Microsoft stops patching, each monthly fix for newer Windows Server versions points attackers at code that the 2016 version shares but will never get fixed.

There's also the paperwork side. Cyber insurance renewals routinely ask whether you run unsupported operating systems. The Essential Eight, the ASD's baseline for Australian organisations, expects unsupported operating systems to be replaced. And if you handle client data under contract, "our server was out of support" is a difficult conversation after an incident.

Step one: find out what the server actually does

Before choosing an option, take an honest inventory. Older servers tend to collect jobs over the years, and the one that "just does files" often turns out to be doing six things. Check for:

• File shares: how much data, how many shared folders, who uses them.
• Active Directory, DNS and DHCP: the logins and network plumbing for the office.
• Line-of-business applications: accounting, practice management, job costing, inventory. Ask each vendor which server and database versions they support.
• Databases: plenty of 2016 servers run SQL Server 2016, which reached the end of its own extended support on 14 July 2026. That's two deadlines, not one.
• Print, scanning and remote access: the small jobs that cause the biggest Monday morning complaints when they stop working.
• Backups: what's backed up, to where, and when anyone last tested a restore.

An IT audit does this methodically. Without one, at least make a list. You can't move what you haven't found.

Your five options

1. Upgrade in place to a newer Windows Server

Microsoft supports upgrading Windows Server 2016 directly to Windows Server 2025, keeping the roles and data where they are. It's the least disruptive path on paper.

The catch is the hardware. A server that shipped with 2016 is likely seven to nine years old in 2027. Its warranty has almost certainly expired, its disks have done years of continuous work, and a fresh operating system won't make the power supply any younger. Upgrading the software on ageing hardware can be reasonable as a short bridge, but rarely as a five-year plan.

2. Replace it with a new server

New hardware running Windows Server 2025 gives you a supported platform into the early 2030s, a fresh warranty and much faster storage than you had in 2017. This makes sense when you have workloads that genuinely belong on-site: large files used all day, applications that behave badly over the internet, or a site with unreliable connectivity.

It's also the moment to right-size. Many businesses bought a big server in 2016 for workloads that have since moved to Microsoft 365. The replacement might be much smaller, or virtualised alongside other jobs.

3. Move the workloads to the cloud

This is the option the deadline should make you think hardest about. Not "lift the whole server into Azure" by default, but asking where each job belongs now:

• File shares often move to SharePoint and OneDrive in Microsoft 365, which you may already be paying for.
• User accounts can move to Microsoft Entra ID, so logins work anywhere without a server in the office.
• Applications may have a cloud-hosted version from the vendor, or can run on a virtual server in Microsoft Azure in an Australian region.

The advantage is that you stop owning hardware that ages. The trade-off is ongoing monthly costs and total dependence on your internet connection, so cloud migrations should come with a backup link. For a fuller look at the trade-offs, read hybrid cloud versus cloud-only.

4. Buy Extended Security Updates as a bridge

Microsoft offers paid Extended Security Updates (ESUs) for Windows Server 2016, covering critical and important security fixes for up to three years after the deadline. They're available through volume licensing and, for servers connected to Azure Arc, billed monthly through Azure. Microsoft has opened Azure Arc enrolment ahead of the deadline, with billing starting the day after support ends.

ESUs buy time. They don't add features, they don't fix ageing hardware, and the price is designed to encourage you to move on. Use them when a specific system, usually a line-of-business application waiting on its vendor, genuinely can't move by January. Don't use them as a way to avoid deciding.

5. Retire it

Sometimes the right answer is to switch it off. If your files have already drifted into SharePoint and Teams, your accounting is in the cloud and the server mainly runs DHCP and a printer queue, the router and a cloud print service can take over. One less server is one less thing to patch, back up and insure.

A realistic timeline from here

Working back from 12 January 2027:

1. October: inventory and decide. Know what's on the server and choose an option for each workload. Talk to your application vendors now, because they're getting the same call from everyone.
2. November: order and build. Hardware lead times and cloud licensing both take time. Build the new environment alongside the old one.
3. Early December: migrate and test. Move data and applications, test with real users, and fix the surprises. There are always surprises.
4. Before the shutdown: verify backups. Make sure the new environment is fully covered by managed backup and a test restore has worked.
5. January: decommission. Securely wipe the old server's disks before it leaves the building.

Can it be done faster? Yes, for a simple server. But a rushed migration in the week before Christmas is how files go missing and the accounting system won't open on the first day back. Start early.

Use the deadline to plan properly

A forced upgrade is annoying, but it's also a rare chance to fix things that have bothered you for years: the VPN that drops out, the files that are slow from home, the backup nobody trusts. Our server and infrastructure team can help you choose between replacing, moving to the cloud or a mix of both. And if you'd like the bigger picture, our guide on building an IT refresh plan helps you avoid the next deadline turning into another scramble.

Frequently asked questions

When does Windows Server 2016 support end?

Extended support for Windows Server 2016 ends on 12 January 2027 (US Pacific time), which is 13 January in Australia. Mainstream support already ended in January 2022. After the deadline Microsoft releases no further security updates unless you buy Extended Security Updates.

Can I upgrade Windows Server 2016 to 2025?

Yes. Microsoft supports an in-place upgrade from Windows Server 2016 to Windows Server 2025. Check that your hardware, applications and their vendors support the new version first, and take a full, tested backup before you start.

Are there Extended Security Updates for Windows Server 2016?

Yes. Microsoft offers paid ESUs for up to three years after support ends, available through volume licensing or monthly billing via Azure Arc. They deliver critical and important security fixes only, so treat them as a bridge while you migrate.

What happens if I keep running Windows Server 2016 after January 2027?

It will keep working, but new vulnerabilities will never be patched, so the server becomes progressively easier to attack. It can also cause problems with cyber insurance, compliance obligations and software vendors who stop supporting their applications on it.

Local IT and cyber security support across NSW

Chewing IT runs managed IT and cyber security for small and mid-sized businesses from our Wyong and Hornsby offices, covering the Central Coast, Newcastle, Lake Macquarie and Hornsby.

Still running Windows Server 2016? Talk to us this month and we'll help you choose the right path before the January deadline.