Windows Server 2016 End of Life (EOL): Your Options Before January 12, 2027

Windows Server 2016 has been the quiet workhorse in a lot of server closets: the file server, the domain controller, the box that runs the accounting database. Its end of support has crept up with far less noise than Windows 10 got. On January 12, 2027, about 11 weeks from this review, Microsoft ships its last free security update for it.

This guide covers the three ways out and how to choose between them for each server: upgrading in place, moving to new hardware or Azure, and buying Extended Security Updates as a bridge. It includes what changed in Microsoft’s pricing this year, the upgrade rules that catch people out, and an 11-week plan that still fits before the deadline.

Nothing switches off. A 2016 server keeps booting, sharing files and running its applications on January 13 exactly as it did the day before. What stops is the patching. Every vulnerability discovered after the deadline stays open on that server for good, and attackers go looking for software that will never be fixed. Mainstream support already ended in January 2022, so for almost five years these servers have received security fixes and nothing else.

The date also lands right behind another one. Microsoft’s Azure Arc documentation confirms that the third and final year of Extended Security Updates for Windows Server 2012 and 2012 R2 ended on October 13, 2026. If any 2012 servers are still on the network, they are already unpatched and belong at the top of the list.

Why it matters beyond the server itself

An unsupported operating system is a finding in almost every security review, and it can be a contract problem. Defense contractors working toward CMMC Level 1 already have to identify, report and correct system flaws in a timely manner under FAR 52.204-21, and a server that can no longer be patched makes that requirement impossible to meet on that machine. The same logic applies to any security questionnaire that asks whether all systems receive vendor security updates.

The right path is decided server by server, so the work starts with a list. Record these details for every machine running Windows Server 2016 (and 2012, if any remain):

For our managed IT clients, the first pass comes from the monitoring console rather than a walk around the building: our RMM already reports the operating system of every server it watches. The slower part is the conversation with each application owner and vendor, so start it this week.

What usually holds a 2016 server back

Most of the time it is the application vendor, not Windows. The pattern we see most is a legacy line-of-business application, such as an ERP, CRM, warehouse management (WMS), quality control or inventory system, that has collected years of data in its own silo and runs on a SQL Server version that only the vendor’s newest release moves past. Getting to that release often carries a large upgrade price the business never budgeted for. In other cases the vendor has stopped developing the on-premises product altogether and now sells only a cloud version, which leaves the server stuck until someone decides what happens to the data.

Most internal IT teams know what they have. The surprises we have run into come from turnover and acquisitions. A primary IT person leaves, and a less technical executive later finds out that even older equipment is still in production. Mergers do the same thing in bulk: the acquired company’s servers arrive with the same gaps and are harder to fold into the existing environment.

Microsoft’s upgrade documentation states that starting with Windows Server 2025, non-clustered servers can upgrade up to four versions at a time, which means a 2016 server can go straight to 2025 without a stop at 2019 or 2022. Failover clusters are different: a cluster OS rolling upgrade still moves one version at a time.

Read the last two columns before choosing a target. An upgrade to 2019 buys about two years. Windows Server 2022 left mainstream support on October 13, 2026, so it is already in security-only support. On support dates alone, 2025 is the target worth the downtime. The application vendor still gets the final say: some vendors have told our clients to step through 2019 and then to 2022 or 2025, with a compatibility check at each stage.

Why we rarely upgrade in place

In practice, in-place upgrades are the exception for us. We do one only after the data and the applications on that server have been vetted for compatibility. More often we run a parallel upgrade: a new Windows Server 2025 machine goes in alongside the 2016 server, roles and data move across, and the old server is retired once everything checks out. Until then, the 2016 server stays in place.

The rules that trip up in-place upgrades

Microsoft lists the restrictions in the same document. These are the ones we see matter most on small business servers:

• The edition carries over. Standard can move up to Datacenter during the upgrade, but Datacenter cannot move down to Standard.
• Each Windows Server version needs its own license. Unlike Windows on a desktop, an upgrade does not bring the new license with it.
• Domain controllers have their own procedure. Many teams add a new 2025 domain controller and retire the old one instead of upgrading it in place.
• NIC Teaming has to be turned off before the upgrade and back on afterward.
• You cannot switch between Server Core and the Desktop Experience during an upgrade.
• Take a full backup and prove a restore works before you start. Image-based backup turns a failed upgrade into an afternoon instead of a rebuild.

When the hardware is as old as the operating system, an in-place upgrade puts a new OS on a box that is closer to its end than its beginning. A clean install of Windows Server 2025 on new hardware, followed by a role-by-role migration, usually carries less risk and leaves you with a warranty again. Hardware is the hard part this year. Over the past six to nine months, the prices we see in quotes have climbed sharply: memory roughly 300 to 500 percent and storage roughly 200 to 300 percent. Even older-generation memory modules have spiked, because so many businesses are holding onto existing servers longer than usual. Lead times add to it: standard servers from the major manufacturers have often taken six weeks or more to arrive in 2026, so a server ordered in mid-November may not land until January. Decide now which servers are being replaced and get them on order through IT hardware procurement this week.

When the math says wait

Those prices have changed some plans. Some of our clients have chosen to extend the warranty on existing hardware, add RAM or storage to get through the next stretch, and buy Extended Security Updates to keep the 2016 server patched for now. That route depends on licensing: some clients could not take it because their servers came with OEM licenses and no Software Assurance.

Virtualized 2016 servers bring their own problem. Clients running VMware have faced steep renewals since the Broadcom acquisition, some as high as 1,500 percent above the previous renewal, so where the replacement virtual machines land is now part of the same decision.

Azure is no longer a free pass

For earlier versions, a common shortcut was to lift the server into an Azure virtual machine and receive Extended Security Updates at no extra charge. That shortcut is gone for 2016. In a pricing notice dated March 27, 2026, Microsoft said that Extended Security Updates released on or after April 1, 2026 cost the same list price whether you buy in Azure or outside it. Microsoft’s Azure Local documentation names Windows Server 2016 as covered by that pricing, so running the server on Azure Local does not make the updates free either. Budget for them as paid wherever the server runs.

Azure still makes sense when you were going to move the workload anyway, ideally onto Windows Server 2025 rather than as a 2016 copy. If that is the direction, our managed cloud infrastructure service covers the Azure side.

Clients who move to Azure usually start with a hybrid setup and migrate the remaining on-premises resources over time. The traffic has not been one way this year, though. A handful of our clients with workloads already in the cloud moved some of them back on-premises.

Extended Security Updates (ESUs) give a 2016 server Critical and Important security fixes for up to three years, through 2030. They include no new features and no non-security fixes. Here is how the program works, per Microsoft’s Azure Arc documentation:

What ESUs cost

Azure Arc bills ESUs per core, on your monthly Azure bill. As of October 2026, Azure’s Retail Prices API lists rates that work out to about $5.20 per core per month for Standard and about $30 for Datacenter, with a minimum of 16 physical cores per server or 8 virtual cores per virtual machine. A single 16-core Standard host comes to about $83 a month, roughly $1,000 a year. The same host on Datacenter is about $480 a month. Check the current rate in the Azure pricing calculator before you budget.

ESUs are the right call for a server that genuinely cannot move in time: an application the vendor has not certified on a newer version, a replacement still waiting on hardware, or hardware you are deliberately stretching while prices are high. They are the wrong call as the whole plan. Three years of fees on a server you still have to upgrade only moves the same project to a later date.

Windows Server 2016 hosts often run SQL Server 2016, and SQL Server 2016 reached the end of its extended support on July 14, 2026. It has its own Extended Security Updates, enrolled per SQL Server instance through Azure Arc, so covering the operating system does not cover the database.

This is usually where the legacy application problem from the server inventory shows up. When the application vendor supports a newer SQL Server only in its newest release, the database upgrade and the application upgrade become one project with one price tag, and that conversation with the vendor should start now.

If a server runs both, plan them in the same maintenance window. Moving the database to a supported SQL Server version, or to Azure SQL, at the same time as the operating system upgrade means one outage instead of two. Our managed database services team handles SQL Server and Azure SQL.

If AI is on the roadmap, choose the database for it

There is a newer reason to look hard at the database during this project. Some of our clients now run internal AI models and keep the data those models need in Azure databases, where the models can reach it efficiently. That changes what the SQL Server 2016 upgrade is for: the database may end up feeding AI, not only the line-of-business applications.

SQL Server 2025 is the first SQL Server release with a built-in vector data type and vector functions, both generally available, so embeddings can sit next to the business data they describe. Its vector indexes are still a preview feature in SQL Server 2025. These are the main places to keep that data in Microsoft’s stack as of October 2026:

We have been through this ourselves. Our first PostgreSQL vector database on Azure grounds an internal AI agent in our own data, as one part of a multi-agent setup that automates internal operations.

If AI is anywhere on the roadmap, decide where that data will live before you pick the target for the 2016 database. Keep preview services like HorizonDB to evaluation until they are generally available, and do not run a compliance-bound production workload on one.

January 12 is a cutoff for a group of Microsoft products, not only the server operating system. These are the ones most likely to sit on, or next to, a 2016 server, taken from Microsoft’s list of products ending support in 2027:

Add these to the same inventory. A server that is ready for 2025 can still be held back by the management or backup software that runs beside it.

From late October there is still time to do this properly, but not to start in December. This is the order we would follow:

1. 1
   This week: inventory every Windows Server 2016 and 2012 machine with edition, role, hardware age, application vendor support, SQL Server version and licensing, and order hardware for any server you already know is being replaced.
2. 2
   Early November: decide the path for each server (upgrade, replace or ESU), confirm application support with each vendor, and order any remaining replacement hardware.
3. 3
   November: build the first Windows Server 2025 server alongside its 2016 counterpart, or run a compatibility test before any in-place upgrade, and prove that backups restore before touching anything important.
4. 4
   December: upgrade or migrate the remaining servers in scheduled maintenance windows. Bring new domain controllers online before retiring old ones.
5. 5
   Before January 12: connect any server that will miss the deadline to Azure Arc and enroll it in ESUs, so it is covered when billing begins on January 13.
6. 6
   After the move: retire the old hardware, remove the old servers from Active Directory and monitoring, and update your documentation.

How long each server takes depends on the data. Smaller data sets have moved in a single business day for our clients. Larger data sets spread across clusters have taken weeks or months, which is the main reason not to leave the big ones for December.

If you want a second set of eyes on the list, we can review it with you and sort each server into one of the three paths. For ongoing coverage, this kind of planning is part of how we run managed IT services.