Windows Server 2016 reaches end of life on January 12, 2027. That is the date on Microsoft's lifecycle page, and it is the last day Microsoft ships regular security updates for a system that still runs file shares, domain controllers, and business databases in offices that bought their servers around 2017 or 2018. The server will not shut off that morning. It will keep working exactly as it does today, and that is the problem. Every weakness found after that date stays open, with nothing on screen to warn you.
As of late October 2026, that leaves about twelve weeks, and the holidays take a big bite out of them. For a business owner, this is less a technical decision than a set of questions about money, timing, and risk: which machines are affected, whether paid extended updates are worth it, which version to move to, and whether the work can finish in time. This guide takes those questions in order, using Microsoft's published dates and requirements.
What end of life means for Windows Server 2016
Microsoft supports Windows Server under its Fixed Lifecycle Policy: a period of mainstream support followed by extended support, which delivers security updates only. For Windows Server 2016, mainstream support ended on January 11, 2022, and extended support ends on January 12, 2027. The lifecycle page lists the Standard, Datacenter, Essentials, and MultiPoint Premium editions. After that date, Microsoft stops releasing security fixes for the product.
None of that stops the server itself. Files still open, logins still work, and the accounting database still answers. That is exactly why this kind of deadline gets missed: the risk stays invisible until someone uses it.
Why an unpatched server becomes a target
Microsoft keeps publishing monthly fixes for Windows Server 2019, 2022, and 2025, and many flaws sit in code those versions share with 2016. Each month's fixes can therefore point attackers toward weaknesses that stay open on every 2016 machine that no longer receives patches. An old server that controls logins for the whole office is worth more to an attacker than any single laptop.
The exposure grows over time. Unless the server is enrolled in paid extended updates, your patch management process has nothing left to install on it. Meanwhile, vendors of security, backup, and remote management tools tend to drop support for retired systems, so the server loses its protective layers along with its patches.
Other products from the same era are already past due
Windows Server 2016 rarely retires alone. SQL Server 2016, the database behind many practice management, accounting, and line of business programs, left extended support on July 14, 2026. Exchange Server 2016 left support in October 2025. If your 2016 server also runs one of these, the plan has to cover both layers, because a new operating system under an unsupported database solves only half the problem.
Offices that went through the Windows 10 end of support deadline in October 2025 will recognize the pattern. The difference is scale. A retired laptop affects one desk, while a retired server can take down logins, shared files, and the core business application for everyone at once.
Find every Windows Server 2016 machine before you plan
The server in the closet is often not the only one. Look at domain controllers that handle logins and group policy, file servers behind the mapped drives everyone uses, and Remote Desktop servers that host shared desktops. Check the database servers behind practice management, accounting, or case management software, and the virtualization hosts, where the host itself may run 2016 even if its virtual machines are newer. Do not forget systems vendors installed for phones, cameras, door access, or imaging equipment, which sometimes run Windows Server underneath, or the machine that runs your backup console.
To check a single machine, type winver into the Start menu. Windows Server 2016 reports itself as version 1607, OS build 14393. Your IT provider's monitoring platform should be able to produce the full list in minutes, including physical hosts, virtual machines, and anything a vendor installed and never documented.
Then, for each server, write down what runs on it and who supports that software, and check each vendor's current requirements for Windows Server 2025. A software vendor that only certifies older versions will shape your timeline more than Microsoft will.
Extended Security Updates: a paid bridge with conditions
Microsoft now offers Extended Security Updates for Windows Server 2016 through Azure Arc, its service for managing servers in your office from the Azure portal. According to Microsoft's Azure Arc preparation guide, these updates provide Critical and Important security fixes for up to three years, through 2030, and nothing else: no new features and no fixes for problems that are not security related. Customers have been able to configure them in the Azure portal since August 3, 2026, and billing begins January 13, 2027.
The conditions matter more to a small office than the price. Microsoft lists support for the Standard and Datacenter editions only, so an office on the Essentials edition is not covered by this offer. To buy the updates, you need Software Assurance through a volume licensing program, unless the server is licensed through a service provider agreement or a Windows Server subscription. Many small offices bought Windows Server bundled with the hardware and never had Software Assurance, which can rule them out. Each server also needs the Azure Connected Machine agent, version 1.62 or later, and outbound access to a set of Microsoft addresses.
Extended updates make sense for one specific server with one specific reason to wait, such as an application whose vendor has not certified Windows Server 2025 yet, or a hardware replacement already scheduled for early next year. Treat enrollment as a dated exception with an exit date, not as permission to run 2016 until 2030.
Choosing the next version: why Windows Server 2025 usually wins
The next version up is not automatically the safest choice. Windows Server 2019 is already in extended support, with security updates ending January 9, 2029, so an upgrade to 2019 buys about two years before the same project starts again. Windows Server 2022 left mainstream support on October 13, 2026, and receives security updates until October 14, 2031, which means a server built on it now spends its whole service life in maintenance mode.
Windows Server 2025 stays in mainstream support until November 13, 2029, with security updates through November 14, 2034. It is the version that avoids a second migration in a few years.
The catch for shared Remote Desktop servers
If staff run Office on a shared Remote Desktop server, the version choice matters even more. Microsoft supports Microsoft 365 Apps on Windows Server only while that server version is in mainstream support. Support on Windows Server 2016 and 2019 ended in October 2025, and support on 2022 ended with its mainstream phase in October 2026. Microsoft is still sending security updates to Microsoft 365 Apps on those three versions until October 10, 2028, but feature updates have stopped. Windows Server 2025 is supported through October 2029. For shared desktops, the realistic choices are Windows Server 2025 or moving those desktops to a cloud service such as hosted virtual desktops.
Compatibility checks before you commit
Windows Server 2025 changes a few defaults that can surprise an older office. Microsoft's guidance says it requires SMB signing on outbound connections, and requiring signing also blocks guest access to shares. Mapped drives on an older network storage box that cannot sign, or that relies on guest access, may stop working until the device is updated. Older storage controllers and network cards may also lack drivers, so confirm hardware support before booking a weekend for the switch.
Licensing needs its own line in the budget. Microsoft notes that each Windows Server upgrade requires a separate license, and client access licenses bought for an older version may not cover a new one, so confirm your licensing with your provider before you order.
Four ways forward, and how to choose yours
Every 2016 server ends up on one of four paths, depending on the age of the hardware, what the server does, and how much downtime the business can absorb. If you are still deciding between replacing the server and moving to the cloud, our guide to server versus cloud will help you settle that first.
The first path is an upgrade in place. Microsoft's upgrade guide says you can upgrade directly from Windows Server 2016 to 2019, 2022, or 2025, and by default the upgrade keeps the same edition. It suits a simple server on healthy hardware, such as a file server only a few years old. The tradeoff is that years of old settings come along, so a verified image backup and a tested rollback plan are essential.
The second path is new hardware and a migration. A server bought when 2016 was current is now roughly eight to ten years old, which is a reliability risk on its own. Building a new server on Windows Server 2025 and moving roles, data, and applications across gives you a clean system and a fallback, because the old machine stays untouched until the new one is proven. Timing can help the budget: equipment placed in service by December 31 may qualify for the Section 179 deduction on this year's return, and IRS Publication 946 explains the rules, though your tax advisor should confirm how they apply to you.
The third path is the cloud. Shared files often fit better in SharePoint and OneDrive, and for many small offices, logins and device management can move to Microsoft Entra ID and Intune with no domain controller in the closet. An application that still needs Windows Server can run as a virtual machine on managed cloud infrastructure, which ends the hardware cycle for that workload.
The fourth path is retirement. Some 2016 servers exist for a job the business stopped doing years ago, such as an old accounting system kept for lookups. Retiring them is the cheapest option, as long as any data you must keep is first exported to a supported, searchable location and the drives are wiped properly before the machine leaves the building.
In practice, many businesses combine paths: a new domain controller on Windows Server 2025, shared files in SharePoint, and one legacy application kept in the office in a hybrid cloud design while its vendor catches up.
What an unsupported server means for HIPAA, PCI, and insurance
Compliance rules rarely name an operating system, but they do require you to manage known risks. The HIPAA Security Rule requires risk analysis and risk management for systems holding electronic patient information, and a server that no longer receives security fixes is exactly the kind of risk that analysis must document and address.
Payment card rules are more explicit. Requirement 12.3.4 of PCI DSS version 4.0.1, available from the PCI Security Standards Council and mandatory since March 31, 2025, requires businesses in scope to review their hardware and software at least once every 12 months, track vendor end of life announcements, and keep a plan approved by senior management to replace outdated technology.
For insurance, read your next renewal application and your policy for any question or exclusion about unsupported systems, and answer accurately. The honest answer next year depends on the work you finish this quarter.
A realistic schedule for the weeks left
Use the rest of October and early November to finish the inventory and application list, confirm vendor support for Windows Server 2025, and pick a path for each server. As soon as the paths are set, order hardware and licenses, since lead times can stretch without warning. Spend the weeks before the holidays building, migrating in stages, and testing a restore before each switch. Freeze changes over the holidays and keep the old servers available as a fallback. By January 12, every remaining 2016 machine should be retired, disconnected, or enrolled in extended updates, with the decision written down for each one. A technology planning engagement should produce exactly that: dates, owners, and a decision per machine.
If a server truly cannot make the date, shrink what it can reach and what can reach it. Move it to its own network segment, block its direct internet access, limit who can log in, and watch it closely until the replacement is ready.
Getting this done before January
The cheapest version of this project is the planned one. Migrations squeezed into early January cost more in overtime, rushed hardware, and mistakes, and a breach that starts on an unpatched server can cost more than all of those combined.
GlobeVM has supported businesses for 30 years and currently looks after more than 75 organizations across Southern California. We provide 24/7 monitoring, and when you call, a person in Los Angeles answers in under 15 minutes, often George or Nazy, the owners, in English or Farsi. If you are not sure which servers are affected or which path fits each one, start with a free IT and security assessment or call (818) 405-9930.