Home › Blog › Windows Server 2016 end of support
Security · 24 September 2026 · 9 min read
The most common Windows Server in the estates we manage is still 2016: it was the version that ran on the hardware bought in 2017 and 2018, and it never gave anyone a reason to touch it. On 12 January 2027 Microsoft stops issuing security updates for it. Fifteen weeks from the day this is written. The options are known, priced and not equally good; the only bad one is doing nothing.
Windows Server 2016, in one table
| Question | Answer |
|---|---|
| End of support | 12 January 2027. After it, no security updates, no fixes, no support — unless ESU is bought. |
| Extended Security Updates | Offered from that date for up to three years, per two-core pack with a sixteen-core minimum per server, one year at a time, price rising each year; free on Azure virtual machines; monthly through Azure Arc. |
| Upgrade target | Windows Server 2025; Standard sixteen cores €1,259 on our September list, two-core pack €157, Datacenter sixteen cores €7,247, user CAL €54. |
| Also ending | Windows Server 2012 and 2012 R2 ESU on 13 October 2026, with no further year; SQL Server 2016 left support on 14 July 2026 and has ESU to 2029. |
| What to do this month | Inventory every 2016 host, sort into the four options below, and book the moves that need a maintenance window before Christmas. |
Windows Server 2016 was released in October 2016 and has been in extended support since January 2022. End of extended support means the last Patch Tuesday for it is in December 2026. From 12 January 2027 a vulnerability found in it is public, exploitable and never fixed, and an auditor, an insurer or a customer’s procurement team will classify every host still running it as unsupported. This is the same cliff Windows Server 2012 went over in October 2023; the difference is that 2016 is far more widely deployed, and that the three-year bridge Microsoft built for 2012 is about to close, which tells you how long the bridge for 2016 will last.
The number of 2016 hosts is rarely the point; what runs on them is. The inventory to make this month has four columns: the host, the workload, who owns the workload, and whether the vendor of that workload supports Windows Server 2025. Domain controllers, file servers and print servers move easily. An ERP, a line-of-business application, a warehouse or laboratory system depends on the vendor’s answer, and that answer takes weeks to get in writing, which is why the inventory is a September job and not a December one.
The right answer for most hosts. A domain controller is promoted fresh on 2025 and the old one demoted; a file server is migrated with its permissions; an application is installed on a new host and cut over on a weekend with a tested rollback. Licensing is per core with a sixteen-core minimum per host: Standard is €1,259 for sixteen cores and covers two virtual machines, Datacenter €7,247 for unlimited virtual machines on the host, and every user or device that touches the server needs a CAL at €54 or €42. The calculator works the Standard-against-Datacenter crossover for your host density. If you hold Software Assurance on the 2016 licences, the upgrade rights are already paid for.
A Windows Server 2016 virtual machine on Azure receives Extended Security Updates at no charge, and a server on your own hardware connected through Azure Arc receives them on a monthly meter instead of an annual purchase. This is the answer for the workload that cannot be upgraded yet and cannot be isolated: it buys the same three years as ESU with less commitment and a cleaner exit, and lifting a virtual machine into Azure is a smaller project than most people expect. It is not the answer for a host that talks to a warehouse full of devices on a local network.
The purchased bridge: Critical and Important updates for another year at a time, up to three years, licensed per two-core pack with a sixteen-core minimum per server, and priced by Microsoft to rise each year. It is for the host whose application vendor has not certified 2025 and whose migration is planned but not yet possible. It is not a plan; it is time to execute one. Microsoft publishes the list price closer to January and we quote from it the day it appears; the structure will be the same as it was for 2012, where the third year cost more than the licence it protected.
The fallback when nothing else is possible by January: the host goes into a network segment with no route to the internet or to the user network, management only from a jump host, a written exception with an owner and a date, and the compensating controls documented for the auditor. This is defensible for a laboratory instrument controller; it is not defensible for a file server everyone uses.
The four options against each other
| Option | Who it is for | Cost driver | What it buys |
|---|---|---|---|
| Upgrade to 2025 | Domain controllers, file and print, any application the vendor supports | Licences, if no Software Assurance; a weekend per host | Ten more years |
| Azure or Azure Arc | A workload that cannot be upgraded yet and can be lifted | Azure consumption; ESU free on Azure, metered through Arc | Three years, with an exit |
| ESU on your hardware | A host that must stay where it is while the vendor catches up | Per two-core pack, rising each year | One year at a time, three at most |
| Isolate | The one host nothing else fits | Network work and a document | A defensible exception, not a fix |
The whole of that is a project we run: inventory, vendor correspondence, the licensing in your currency, the migrations on your nights, and the ESU on the day. If you have Windows Server 2016 anywhere, the inventory is the call to make this week.
Only if the 2016 licences have no Software Assurance; with it, the upgrade rights are included. Without it, Windows Server 2025 Standard is €1,259 per sixteen cores plus CALs on our list.
It becomes available from 12 January 2027. Microsoft publishes the price list closer to the date; the structure matches 2012's — per two-core pack, sixteen-core minimum, a year at a time, three years at most.
Ask for the certification roadmap in writing. If 2025 is coming, ESU or Azure Arc bridges the gap; if it is not, the year is for changing vendor, and isolation covers the meantime.
Yes: an Azure virtual machine on 2016 gets ESU free, but it still needs enabling, and it is still an unsupported operating system for an auditor. Plan the upgrade; use the free ESU as the buffer.