Start a project

Guide · Windows Server

Windows Server 2016 support ends on 12 January 2027.

Microsoft’s extended support for Windows Server 2016 ends on 12 January 2027, for every edition, and the January 2027 security update is the last one it ships for servers without Extended Security Updates. Servers keep running, but flaws found after that stay open unless a Standard or Datacenter server is enrolled in those paid updates. The supported way out is an in-place upgrade to Windows Server 2019, 2022 or 2025, or a move to a new server.

Ends
12 Jan 2027
Product
Windows Server 2016
Editions
All four
Same day
.NET Framework 4.6.2
Verified
20 Oct 2026
What ends
Microsoft’s extended support for Windows Server 2016: its security updates and technical support, for every edition.
When
, the same day as .NET Framework 4.6.2. Mainstream support ended in January 2022.
Who it affects
Every server, physical or virtual, still on Windows Server 2016: Datacenter, Essentials, MultiPoint Premium or Standard, on your premises, at a host or in a cloud.
Move to
Windows Server 2019, 2022 or 2025. Microsoft supports an in-place upgrade from 2016 to each of them directly; 2025 has the longest runway.
Bridge
Extended Security Updates for Standard and Datacenter servers: paid, security fixes only, for up to three years.
First step
List every 2016 server and what runs on it, then choose for each: upgrade, migrate, move the workload, or bridge with Extended Security Updates.
Source
Microsoft’s Windows Server 2016 lifecycle, dates verified 20 October 2026.

Before you change anything. This guide is general information, not advice for your system. The dates and steps come from Microsoft’s published pages, checked on 20 October 2026, and Microsoft can change them, so confirm on the linked source before you plan around a date. Back up, test every change on a copy that isn’t in production, keep a way back, and follow your own change process. You follow these steps at your own risk (terms). SnowDriven isn’t affiliated with Microsoft (trademarks).

What ends, and what doesn’t

End of support is about updates and help from Microsoft. Nothing switches off.

From 12 January 2027, Microsoft no longer ships security updates for Windows Server 2016, and its support teams no longer help with it. The January 2027 security update is the last one. A server on 2016 keeps running. What changes is that any vulnerability found after that date stays open on it, unless the server is enrolled in Extended Security Updates.

Mainstream support, the phase with fixes beyond security, ended in January 2022. Since then 2016 has had security updates only, under extended support, and that is what ends.

It ends for every edition: Datacenter, Essentials, MultiPoint Premium and Standard. On Essentials, Microsoft’s support for the edition’s own features, such as Remote Web Access, ends the same day. Containers released with Windows Server 2016 follow the same dates.

The same day, Microsoft’s support for .NET Framework 4.6.2 ends: the version Windows Server 2016 shipped with. Installing 4.8 on a 2016 server doesn’t help for long: 4.8 is supported only as long as the Windows it runs on. See .NET Framework 4.6.2 end of support for the apps.

Who is affected

Anyone with a Windows Server 2016 machine in the estate, wherever it runs. For an MSP, each client’s estate is its own list.

Check what you run

Every command here only reads. None of them changes the server.

On one server

Run winver from the Start search or a command prompt: the window names the Windows version and build. Or, in PowerShell, any of these:

(Get-CimInstance Win32_OperatingSystem).Caption
Get-ComputerInfo -Property WindowsProductName, OsVersion
systeminfo | findstr /B /C:"OS Name" /B /C:"OS Version"

A Windows Server 2016 machine names itself as such, with its edition, and reports version 10.0.14393: OS build 14393, release 1607.

Across many servers

Start with Active Directory, which records the operating system each domain-joined computer last reported. This needs the ActiveDirectory PowerShell module:

Get-ADComputer -Filter 'OperatingSystem -like "*Server 2016*"' -Properties OperatingSystem, OperatingSystemVersion |
  Select-Object Name, OperatingSystem, OperatingSystemVersion | Sort-Object Name

That list can hold stale accounts and misses machines outside the domain. Confirm each server directly; this asks the servers themselves over Windows Remote Management:

Get-CimInstance -ClassName Win32_OperatingSystem -ComputerName SERVER01, SERVER02 |
  Select-Object CSName, Caption, Version, BuildNumber

Then reconcile with any other list you keep: your monitoring or RMM tool, your hypervisor’s inventory, your hosting or cloud console. A server that appears in only one of them is the one to look at first.

What to record for each

  • Edition, and whether it’s Server Core or has the Desktop Experience
  • Physical or virtual, and where it runs
  • Roles: domain controller, cluster node, Remote Desktop host, file server
  • What runs on it, with versions: SQL Server, .NET Framework apps, vendor software
  • Whether each app’s vendor supports 2019, 2022 or 2025
  • How it’s licensed: Software Assurance, SPLA or a Server Subscription, which decides whether Extended Security Updates are an option
  • Who owns it, and when it can be taken down

Your four options

An estate can need all four. The first three end with a supported Windows Server; the fourth buys time past January.

Versions to move to, from Microsoft’s lifecycle pages
VersionSupported toNote
Windows Server 2025November 2034The longest runway, and the only one of the three still in mainstream support (to November 2029).
Windows Server 2022October 2031Mainstream support has ended; security updates continue.
Windows Server 2019January 2029The shortest runway, and the only one of the three that supports SQL Server 2014 and 2016 (from Service Pack 3).

  1. Option 1 · Same server, newer Windows

    Upgrade in place

    Run Setup from the newer version’s installation media on the server and keep files, settings and apps. Microsoft supports this from 2016 directly to 2019, 2022 or 2025. The upgrade through Windows Update isn’t available from 2016: it starts from 2019 or 2022.

    Good
    Same server, name and address, with roles and data kept. The fewest moving parts for a healthy server whose roles and apps support the newer version.
    Watch
    Microsoft lists the prerequisites: a maintenance window, roles and features that support upgrading, vendor support for each app, and a licence for the new version. You can’t switch between Server Core and the Desktop Experience, change language, or move from Datacenter down to Standard during the upgrade, and NIC Teaming must be turned off first. Not for domain controllers, and clusters use a rolling upgrade instead. An Azure virtual machine follows Azure’s own procedure, and Microsoft says some Azure features, such as Update Manager and automatic guest patching, aren’t officially supported on it afterwards.
    Way back
    Take a full backup and test that it restores, as Microsoft asks, and snapshot a virtual machine (in Azure, its OS and data disks) before you start. Restoring that backup or snapshot is the way back if the upgrade fails or an app misbehaves.

  2. Option 2 · A clean start

    Migrate to a new server

    Build a new server or virtual machine on Windows Server 2022 or 2025, install the apps fresh and move roles and data across. For domain controllers this is Microsoft’s advice: promote new ones on a clean install, then demote the old.

    Good
    A clean operating system, new hardware if the old is ageing, and an old server that stays untouched until you’re done.
    Watch
    Each role and app moves on its own terms; Microsoft publishes which roles and features can be migrated. Plan names, addresses, certificates, scheduled tasks and service accounts, and a licence for the new server.
    Way back
    Keep the old server intact, switched off rather than wiped, until the business has signed off on the new one.

  3. Option 3 · No server to look after

    Move the workload

    Retire the server by moving what it does: a database to a managed database service, file shares to managed storage, an internal app to a platform service or a product that does the same job. It fits a server that exists for one job.

    Good
    No server operating system of your own to patch for that workload.
    Watch
    More change than an upgrade: data migration, sign-in, network paths and running costs. It rarely lands by January, so upgrade or bridge the server meanwhile. Moving a 2016 virtual machine unchanged into a cloud doesn’t change its support date.
    Way back
    Keep the server and a current backup until the new service has run in production and the data is confirmed complete.

  4. Option 4 · Time, not a destination

    Extended Security Updates

    Microsoft offers Extended Security Updates for Windows Server 2016 Standard and Datacenter: Critical and Important security updates for up to three years, through 2030. Microsoft calls the program a paid, last-resort bridge to a supported version, not a long-term answer.

    Who can buy
    Microsoft requires Software Assurance through a volume licensing program, or servers licensed through SPLA or a Server Subscription. Servers outside Azure can be enrolled through Azure Arc from the Azure portal, open since 3 August 2026, with agent version 1.62 or later; billing starts on 13 January 2027.
    In Azure
    Not free, unlike Windows Server 2012’s. Extended Security Updates released from 1 April 2026 have the same list price in Azure as outside it, and Microsoft’s Azure Local page names Windows Server 2016 among them. We don’t quote prices: ask your Microsoft licensing contact.
    Limits
    No new features, no other fixes and no technical support beyond the updates. Microsoft’s FAQ says the program’s scope doesn’t extend to other products on the server: SQL Server and your own apps need their own plan.
    Way back
    Installing the Azure Arc agent or an activation key is still a change to the server: back it up first and put it through your normal change process.

Which option fits

Decide server by server, from what runs on it and what it does.

IfThen
A domain controllerBuild a new domain controller on Windows Server 2022 or 2025, promote it, move the roles across, then demote and retire the 2016 one. Microsoft advises against in-place upgrades for domain controllers.
A healthy virtual machine running one app whose vendor supports a newer Windows ServerUpgrade a restored copy first. Then snapshot the server and upgrade it in place to 2025, or to 2022 if the vendor isn’t ready for 2025.
It also runs SQL Server 2014 or 2016Microsoft doesn’t support either on Windows Server 2022 or 2025. Upgrade SQL Server first, or go to 2019, which supports both (from Service Pack 3) but has the shortest runway.
A failover clusterA cluster OS rolling upgrade moves one version at a time, so 2016 goes to 2019 before 2022. Or build a new cluster and move the workloads across.
Old hardware, or a server nobody wants to touchA new server or virtual machine and a migration, with the old server kept intact as the way back.
A Remote Desktop host running Microsoft 365 AppsWindows Server 2025. Microsoft supports the apps on Windows Server only while that version is in mainstream support, and 2025 is the only one of the three still in it.
An app that can’t move by JanuaryExtended Security Updates, if the server runs Standard or Datacenter and its licensing qualifies, with a dated plan to upgrade. Microsoft doesn’t name Essentials or MultiPoint Premium for them: isolate those servers and move them first.

The weeks to 12 January

Starting late? Shorten the first two steps; don’t skip them.

  1. Now

    Take an inventory

    List every 2016 server with the details above, and choose an option for each. Order the work by risk: servers reachable from the internet, and those holding sensitive data, go first.

  2. Next

    Prove it on a copy

    Restore a backup of a representative server to an isolated network and upgrade or migrate that copy first. Test the apps the business depends on and write down every step. Line up licences: for the new versions, and for Extended Security Updates where you need them.

  3. Then

    Move in waves, before any freeze

    One server or group at a time, through your normal change process. Before each, take a full backup, test that it restores, and snapshot virtual machines. Replace domain controllers by promoting new ones. If your organization freezes changes over the holidays, finish this step before it starts.

  4. By 12 January

    Close out before the date

    Check that no 2016 server is left without an outcome: upgraded, retired, or enrolled in Extended Security Updates with an upgrade date. Isolate any that can’t be, and keep each old server until its replacement is signed off.

How we can help

If you’d rather not do the inventory and the plan alone, or the apps on those servers need work of their own.

Scoped and quoted on its own

Modernization audit

The code, dependencies, data, hosting and releases reviewed, the risks ranked in a written report, and a step-by-step plan. Nothing beyond the audit is committed until you decide to go further.

Start with an audit How a modernization runs See a sample report

No email needed

Modernization readiness check

Ten yes-or-no questions about the system, including whether it runs on a version that no longer gets updates, and the first step we’d suggest.

Take the readiness check See the runway on every runtime

Questions about Windows Server 2016 end of support

Will our servers stop working on 12 January 2027?

No. End of support doesn’t switch anything off. After that date Microsoft no longer ships security updates for Windows Server 2016, except to servers enrolled in Extended Security Updates, and no longer gives technical support for it. The risk grows with every vulnerability found after the date.

Does it apply to every edition?

Yes. Microsoft’s dates cover Datacenter, Essentials, MultiPoint Premium and Standard. On Essentials, Microsoft’s support for the edition’s own features, such as Remote Web Access, ends the same day. Extended Security Updates are offered for Standard and Datacenter only.

Can we upgrade straight from Windows Server 2016 to 2025?

Yes. Microsoft supports in-place upgrades from 2016 directly to 2019, 2022 or 2025, using the newer version’s installation media. The upgrade through Windows Update starts from 2019 or 2022, not 2016. Failover clusters move one version at a time, and Microsoft advises building new domain controllers rather than upgrading them in place.

Can we pay Microsoft for more time?

Yes, for Standard and Datacenter servers. Extended Security Updates give Critical and Important security updates for up to three years, through 2030, with no new features, no other fixes and no wider technical support. Microsoft requires Software Assurance through volume licensing, or servers licensed through SPLA or a Server Subscription. Servers outside Azure can be enrolled through Azure Arc, billed from 13 January 2027.

Are Extended Security Updates free if the server runs in Azure?

Not for Windows Server 2016, according to Microsoft’s pricing pages. Extended Security Updates released from 1 April 2026 have the same list price in Azure as outside it, and Microsoft’s Azure Local page names Windows Server 2016 among them. Earlier offerings, such as Windows Server 2012’s, were included in Azure at no extra charge. Ask your Microsoft licensing contact for the price.

Is this the same deadline as .NET Framework 4.6.2?

Yes. Microsoft’s support for .NET Framework 4.6.2, the version Windows Server 2016 shipped with, ends on 12 January 2027 too. Installing .NET Framework 4.8 on a 2016 server doesn’t help for long, since 4.8 is supported only as long as the Windows it runs on. On Windows Server 2022 you can install 4.8.1, and 2025 includes it.

Sources · support dates verified 20 October 2026

Part of SnowDriven Research: see this date in the deadline table beside every other date we track, and how we verify them.

General information, checked on 20 October 2026. Confirm dates with the vendor; follow at your own risk. Terms.

Start a project

Still on Windows Server 2016? Let’s plan the move.

Tell us what the servers run and what they do for the business. We reply within one business day, with questions or a time to talk.

Start a projectRequest a scoping call

Pittsburgh, PA · Since 2015 · First step: a 30-minute call