Windows Server 2016 End of Life: Dates, ESU & Options

For teams that run Windows Server in production, the Windows Server 2016 end of life date is January 12, 2027. That is when extended support closes. After that date Microsoft issues no further security updates for the operating system outside the Extended Security Updates program, and standard Microsoft support for the product ends. This page lists the verified dates, what stops, how ESU applies to 2016, and the four realistic options: in-place upgrade, migration to new hardware or VMs, a move to Azure, or staying on 2016 with ESU.

Windows Server 2016 end of life: the dates

Windows Server 2016 follows the Microsoft Fixed Lifecycle Policy: five years of mainstream support followed by five years of extended support, applied to the Datacenter, Standard, Essentials, and MultiPoint Premium editions. The dates below are taken from the Microsoft Lifecycle page for Windows Server 2016.

Container base images released with Windows Server 2016 follow the same dates. Windows Server 2016 is currently in the last stretch of its extended support phase: security updates continue to ship on the normal Patch Tuesday cadence until January 12, 2027, but non-security fixes ended in 2022.

What server 2016 end of support means in practice

Servers do not shut down on the end-of-support date. What changes is the risk and compliance position:

• No security patches. Vulnerabilities found in Windows Server 2016 after January 12, 2027 will not be fixed by Microsoft unless the server is covered by ESU. Because Windows Server versions share large amounts of code, patches shipped for 2019, 2022, and 2025 effectively document which components are likely vulnerable on an unpatched 2016 host.
• No Microsoft support cases. Standard support paths close. If a domain controller fails to replicate or a storage driver misbehaves, there is no vendor escalation for the operating system itself.
• Compliance exposure. PCI DSS requires that system components be protected from known vulnerabilities via vendor patches; an OS that can no longer receive them needs documented compensating controls at minimum. The HIPAA Security Rule requires protection against reasonably anticipated threats to ePHI, and unsupported operating systems are difficult to defend in a risk analysis. Cyber-insurance questionnaires ask directly about unsupported operating systems.
• Software certification drift. Application and agent vendors (backup, EDR, monitoring) drop support for out-of-lifecycle Windows Server versions on their own schedules, often before Microsoft's date.

What commonly still runs on Windows Server 2016

Inventories from this era tend to surface the same roles: Active Directory domain controllers built during 2017–2019 domain upgrades, file and print servers, RDS session hosts, and application servers for line-of-business software. Two patterns deserve specific attention. Domain controllers on 2016 should be replaced by promoting new DCs on a supported version and demoting the old ones rather than upgrading in place; that is the standard AD DS practice and it also clears the way to raise domain and forest functional levels. Servers with Exchange co-located or Exchange 2016 running on Windows Server 2016 are a compound problem: Exchange 2016 itself reached end of support in October 2025, so those machines carry two unsupported products and belong at the top of the migration list.

ESU: windows server 2016 extended support beyond 2027

The Extended Security Updates program is Microsoft's paid bridge for products past end of support. Per the Lifecycle FAQ for Extended Security Updates, ESU delivers security updates rated Critical and Important for up to three years after a product's end-of-support date. Applied to Windows Server 2016, that means coverage can run to roughly January 2030. Microsoft's Windows IT Pro blog post on planning for Windows Server 2016 end of support confirms ESU availability for 2016; note that Microsoft has not yet published the 2016 row in its ESU duration table, so verify final dates and pricing against the official pages before budgeting.

The structure, based on how the program has operated for Windows Server 2012/2012 R2 and the current Extended Security Updates for Windows Server overview:

• On-premises: ESU is purchased annually through volume licensing or through Azure Arc-enabled servers. Historically the price rises each year of the three-year window, which is intentional: ESU is priced as a bridge, not a destination.
• On Azure: ESU is free. Windows Server VMs running in Azure (including Azure VMware Solution, Azure Local, Azure Dedicated Host, and the Azure Stack portfolio) are automatically enabled for ESU at no extra charge, provided the VM is configured to receive updates. One caution: the equivalent free-ESU benefit was removed for SQL Server 2016 on Azure VMs, so a host running both products needs the SQL side priced separately.
• Scope: ESU covers Critical and Important security updates only. No new features, no non-security hotfixes, no design changes.

Option 1: in-place upgrade

Windows Server 2016 has direct in-place upgrade paths to 2019, 2022, and 2025 using installation media, per the supported upgrade paths documentation. The two-version limit that applied through Windows Server 2022 was relaxed for 2025, which accepts upgrades from 2012 R2 onward on nonclustered systems.

• Target version. An upgrade performed in 2026 should go to Windows Server 2025, or 2022 if an application vendor has not certified 2025 yet. Windows Server 2019 left mainstream support in January 2024 and is not a sensible target. The trade-offs between versions are covered in our Windows Server versions reference and the Windows Server 2025 overview.
• Restrictions. No Server Core to Desktop Experience switches during upgrade, no edition downgrades, and clusters advance one version at a time via cluster OS rolling upgrade. Not every role supports in-place upgrade; check the role migration matrix first.
• Licensing. Each Windows Server version upgrade requires a license for the target version. Without Software Assurance, that is a new purchase.

Option 2: migrate to new hardware or new VMs

The cleaner pattern for most roles: build new servers on a supported version, move the roles, decommission the 2016 machines. Hardware bought for 2016 deployments is now eight to ten years old and typically out of its own vendor support, which makes migration the default rather than the exception. For domain controllers this is the only recommended pattern. For file servers, Storage Migration Service transfers shares, data, and identity. For application servers, a fresh install avoids carrying forward a decade of configuration drift.

Option 3: lift to Azure

Moving 2016 VMs to Azure as-is buys the free ESU coverage described above while the workload is modernized or retired on Azure's clock instead of the January 2027 deadline. This is the documented Microsoft path for workloads that cannot be upgraded in time. The economics depend on runtime: a server that must live another 12–18 months can be cheaper on Azure with free ESU than on-premises with paid ESU, while a server staying five more years should be upgraded, not bridged.

Option 4: stay on-premises with ESU

Paid ESU is the correct choice for a narrow set: servers running applications that cannot be recertified in time, with a funded upgrade or retirement project already scheduled inside the ESU window. It is a way to keep a known-terminal system patched while the exit executes. It is the wrong choice as a standing posture, because the price escalates yearly and the coverage still excludes everything except Critical and Important security fixes. Medha Cloud provides Windows Server support across all four paths: upgrade projects, role migrations, Azure moves, and managed operation of servers riding out an ESU window.

Timeline

A Windows Server migration involving domain controllers, file servers, and line-of-business applications takes months, not weeks: inventory and dependency mapping, application compatibility testing, procurement or Azure landing zone build, phased cutover, then decommissioning. Counting backward from January 12, 2027, a project starting in late 2026 will not finish inside the support window for any estate larger than a handful of servers. Projects should be in the execution phase now; anything still unplanned by Q4 2026 should assume ESU costs in its budget.

Decision table

FAQ

When is Windows Server 2016 end of life?

Extended support ends January 12, 2027. Mainstream support already ended on January 11, 2022. After January 2027, security updates are available only through the Extended Security Updates program.

Does Windows Server 2016 stop working after end of support?

No. The operating system runs unchanged. What ends is the supply of security patches and Microsoft support, which shifts the risk and compliance position rather than the functionality.

Is there an ESU program for Windows Server 2016?

Yes. Microsoft's Windows Server ESU program provides Critical and Important security updates for up to three years past end of support, purchasable for on-premises servers and included free for servers running in Azure. Microsoft has confirmed ESU availability for 2016; final published dates should be checked on the Microsoft lifecycle and ESU pages.

Can I upgrade Windows Server 2016 directly to 2025?

Yes. Nonclustered systems upgrade in place from 2016 to 2019, 2022, or 2025 using installation media. Clusters advance one version at a time via cluster OS rolling upgrade. Domain controllers should be replaced with new DCs rather than upgraded in place.