Windows Server 2016 stops getting security updates on January 12, 2027. After that date, any server still running it becomes a standing hole in your network: unpatched, and increasingly the first thing attackers look for. If you've got a 2016 box doing real work, the deadline is the problem, not the hardware.
Microsoft has confirmed the date, and it's closer than it looks once you account for how long a real migration takes.
What does end of support actually mean?
It means Microsoft stops shipping security patches, bug fixes, and technical support for Windows Server 2016. The server keeps running. But every new vulnerability found after January 12, 2027 stays open on that machine forever, and compliance frameworks and cyber insurers treat unsupported software as a failed control.
When exactly does Windows Server 2016 lose support?
January 12, 2027. That's the end of extended support, the second and final phase of Microsoft's lifecycle. There's no third extension coming. Mainstream support ended years ago; this is the hard stop. The deadline applies to every edition, Standard, Datacenter, and Essentials alike.
What are your options?
Three real paths, in rough order of how most small businesses should think about them:
- Migrate to a current Windows Server. Move the roles to Windows Server 2022 or 2025, usually on new hardware. This is the clean answer if you genuinely need an on-premises server.
- Move the workload to the cloud. Plenty of what small businesses still keep on a local server, file shares, apps, line-of-business databases, runs better in Azure or Microsoft 365. Often you retire the box instead of replacing it.
- Buy Extended Security Updates. Microsoft is offering ESU for Windows Server 2016, delivered through Azure Arc. It buys you security-only patches past the deadline for a fee. Treat it as a stopgap while you plan the real move, not a destination.
Why not just wait until 2027?
Because migrations take longer than owners expect, and the deadline doesn't move. You have to inventory what the server does, confirm your line-of-business apps run on a newer OS, schedule the cutover around your actual work, and leave room for the thing that always goes sideways. Start that in December and you'll be running unsupported in January.
There's also the money side you don't see until something breaks. Cyber insurers increasingly ask whether your software is supported, and an unsupported server can be the line that voids a claim or spikes your premium. Attackers watch end-of-life dates too, because they know which businesses drag their feet.
What should you do now?
Find out what you're actually running. Inventory every server, note which ones are on 2016, and write down what each one does and which apps depend on it. That list is the whole planning problem. Once you know the roles, the decision, migrate, move to cloud, or bridge with ESU, gets a lot clearer.
This is the same pressure that hit Windows 10 at its end of support, and for many businesses the answer overlaps with a cloud migration they were already weighing.
If you'd rather not map this out alone, our managed IT team inventories your servers and builds the migration plan around your deadline and budget.
By Joe Laboy. Joe leads systems, networking, and managed IT operations at The NetSys Group, which has delivered managed IT, cybersecurity, and cloud services since 1998 to businesses across NY, NJ, CT, PA, and Southwest Florida.
Frequently asked questions
Can I keep running Windows Server 2016 after January 2027?
The server will still boot and run. But it stops receiving security updates, so every vulnerability found after that date stays open. For most businesses that's a compliance problem and an insurance problem, not just a security one. Running it unsupported is a risk you're choosing to carry.
What are Extended Security Updates?
ESU are paid, security-only patches Microsoft offers past the end-of-support date, delivered for Windows Server 2016 through Azure Arc. They buy time to finish a migration. They cost money, they don't add features or fixes, and they run out, so they're a bridge, not a plan.
How long does a server migration take?
Anywhere from a few weeks to several months, depending on how many roles the server holds and how picky your line-of-business apps are. The testing and app-compatibility work usually takes longer than the actual move, which is why starting early matters.
Should I move to the cloud instead of buying a new server?
Often, yes. Many small business workloads that once needed a local server now run cleanly in Azure or Microsoft 365, which drops the hardware refresh cycle entirely. It depends on your specific apps, internet reliability, and data, so it's worth costing out both before you commit.
Not sure which of your servers are on borrowed time? Contact The NetSys Group for a complimentary IT assessment and we'll map your migration before the deadline does it for you.
Turn insight into action.
Take a free cybersecurity or AI readiness assessment, or book a call with a NetSys engineer — no obligation, no runaround.