Windows Server 2016 End of Life: What to Do Before January 12, 2027

Windows Server 2016 end of life is January 12, 2027, the last day Microsoft ships security fixes for it. If your firm has a Windows Server 2016 box in a closet running files, software or logins, the clock is running. Microsoft confirmed the date in a February 2026 post on its Windows Server blog and on the product’s lifecycle page.

After that day, Microsoft says, the server gets no more security updates, bug fixes or technical support. The server itself keeps running after that. Nothing switches off, which is why firms miss it.

Put January 12, 2027 on the firm calendar today, and ask whoever runs your IT whether that server is one of yours.

If you keep running it, every new hole found in Windows Server 2016 stays open on your network, and only the paid extended updates covered below close the serious ones. The FBI logged more than 3,600 ransomware complaints in 2025 in its Internet Crime Report. CISA, the federal cyber agency, says in its 2023 guidance on updates that end-of-life software “poses consequential risk to your system.” Its list of bad practices for critical services puts unsupported software first.

Insurers’ ransomware forms ask about it. Beazley’s 2022 form asks whether you have “any end-of-life or end-of-support software on your network.” CapSpecialty’s form from 2021 asks about “legacy systems for which patches are no longer available.” From January 13, 2027, your answer to the first question is yes. Your answer to the second is also yes, unless you buy the extended updates.

Reread your cyber insurance renewal before you sign it.

Start now because server parts are short, your software vendor needs time to sign off, and your budget works best when the spend is planned. Dell told investors in 2026 that server memory is short and demand “continues to exceed supply,” as Supply Chain Dive reported.

Plan it this fall and you can split the cost between this year’s budget and next year’s.

Tell your IT provider this month that you want the migration planned, priced and scheduled before the holidays.

For most firms your size the answer is a new Windows Server 2025 plus Microsoft 365, and your provider works out the details. The shared files move into Microsoft 365. Your staff already use it for Outlook and Word, and most firms already pay for that storage. The practice software and the staff logins move to a new Windows Server 2025. If your software does not need a server, your logins can move to Microsoft 365 too, and you may not need a new server at all. Microsoft points to Windows Server 2025 as the upgrade and supports it into November 2034. You can keep it in the office, or rent it in Microsoft’s Azure cloud if your software vendor supports that.

What the 2016 server does	Where it goes
Shared files and folders	Microsoft 365, which is already in your plan
Your practice or accounting application	A new Windows Server 2025, in your office or rented in Azure
Staff logins	A new Windows Server 2025, or Microsoft 365 if nothing else needs a server

Our guide to cloud versus on-premises systems weighs the two.

Ask your provider to fill in this table for your server.

Extended Security Updates cost about $1,000 for the first year per server for the Standard edition at Microsoft’s 2026 rate, and they are worth it only for one program that cannot move by January. They run for up to three years and buy security fixes only.

Not every firm can buy them. They need a paid add-on to the server license, called Software Assurance. Your provider can check that from your licensing records. If you have it, the upgrade to Windows Server 2025 is already included, so the new license may cost nothing. If you do not, the Windows Server 2025 license lists at $1,176, plus a license for each user or device, and both are one-time costs. Hardware and labor come from a written quote, and you can set that quote against the $269,000 average ransomware claim the insurer Coalition reported for 2025.

Buy the updates only if one program truly cannot move in time, keep the project going, and have our managed cybersecurity team watch any server you keep on them.

Treat it as a planned project of a few months with one owner. Your provider does the technical work, and you make the decisions.

1. This month, your provider lists every server, its Windows version, what runs on it and who uses it. It also asks each software vendor in writing which Windows version and which cloud options it supports. Network Doctor clients see that inventory and each machine’s update status in their client dashboards.
2. In November, you sign the quote, and the order goes in while hardware can still arrive in time.
3. In December, the new server is built beside the old one and your own staff test the application. A full backup comes first through our business continuity service, and your provider tests it by restoring a file. If the hardware has arrived, the cutover happens on a weekend before the holidays.
4. Early January, before the 12th and before tax season opens, is the fallback weekend for the cutover. The old box is unplugged at cutover and wiped a few weeks later.

Our managed IT projects team runs work like this with a dedicated project manager, and our field technicians respond within four hours when a cutover needs hands.

“…they orchestrated and executed a system conversion without interrupting our workflow.”

Leslie Akst, Partner, Akst & Akst Law

Ask your current provider which of the four steps is done. If the answer is none, call us for a second opinion and a quote.

In short, the server keeps running after January 12, 2027, the security updates stop, and a planned move avoids paying for extended updates and rush hardware.

Does the server shut down on January 12, 2027?

No, it runs exactly as before. What stops is Microsoft’s stream of fixes for new security holes, so each hole found after that date stays open unless you pay for extended updates.

Can we upgrade Windows Server 2016 straight to Windows Server 2025?

Yes, though a new box is often the better buy, and your provider will say which. Microsoft supports a direct upgrade from 2016 to 2025 on the same box, and the server keeps its settings and files.

Do regulators care if we keep an old server?

Yes, if you prepare tax returns, broker mortgages or collect debts, because the FTC’s Safeguards Rule treats such firms as financial institutions. Firms with records on 5,000 or more people have extra duties under the Rule’s 2021 update, including a written risk assessment, a written incident plan, a yearly report to the owners and tests for weak spots at least twice a year unless they monitor continuously. Firms licensed by New York’s financial regulator must track each system’s support end date in their asset inventory. Under HIPAA, medical and dental practices must cover old systems like this one in their risk analysis, HHS says. Those twice-yearly scans will flag a server Microsoft no longer patches.

What else from 2016 is already out of support?

SQL Server 2016 left support on July 14, 2026. Exchange Server 2016 and Office 2016 left support on October 14, 2025.

For your IT person (skip this if that is not you)

In-place paths from 2016 are 2019, 2022 and 2025 by installation media, and AD DS gets new DCs by clean install. ESU needs active Software Assurance or an equivalent Server Subscription. Azure Arc bills it monthly from January 13, 2027, at Microsoft’s listed Standard rate of about $5.21 per core per month, so a 16-core server costs about $83 a month, or roughly $1,000 a year. The minimum is 16 cores per physical server or 8 per virtual machine. Microsoft’s March 2026 licensing update prices it the same in Azure. Its Arc licensing page still says Azure-hosted servers get ESU without Software Assurance and calls them free, so a firm without SA should get the Azure price in writing. The $1,176 Standard list price covers 16 cores and needs a CAL per user or device. Microsoft 365 Apps on Server 2016 lost support on October 14, 2025 and get security-only updates until October 10, 2028. The Datacenter ESU meter is about $30 per core per month.

Start this week by asking for the server list, because the date is fixed and vendors need weeks. Send the list to our IT consulting team and we will tell you which path fits each server and what it costs. If you have an IT person in-house, our co-managed IT service runs the project with them. Book a call or phone 201-735-7260. We provide managed IT and security to firms across New Jersey, New York and Pennsylvania from our Englewood Cliffs office.

Photo: Carl Lender, CC BY 2.0, via Wikimedia Commons