Windows Server 2016 end of support: what to do

There is a server in a cupboard in a lot of East London offices. It holds the shared drive, it runs the accounts package, and nobody has signed into it on purpose since about 2019. It has been fine.

On 12 January 2027, Microsoft writes its last security update for Windows Server 2016 and then stops. That is a Tuesday, sixteen weeks from now, and it is the second Tuesday of the month, so it is a Patch Tuesday. The last one.

The date, and what it does not mean

Windows Server 2016 came out on 15 October 2016. Mainstream support for it ended on 12 January 2022, which most people did not notice and mostly did not need to. Extended support ends on 12 January 2027. Those are Microsoft's own dates off its lifecycle page, which also notes that everything on it is shown in Pacific time, so a UK reader is looking at the evening rather than the morning. It does not matter. Treat it as the 12th.

Here is what does not happen on the 13th. The server does not stop booting. No licence expires. No service quietly refuses to start, nothing phones home and disables itself, and your staff notice nothing at all. That is exactly the problem. An unsupported server looks identical to a supported one from the inside, and it will carry on looking identical for years.

What ends is Microsoft writing fixes. The NCSC describes the result as two problems that compound each other in its guidance on obsolete products: the product stops getting security updates, so exploitable flaws found after that date stay open, and the product also lacks the newer mitigations that make exploitation harder in the first place. Put together, they say, this makes high-impact incidents more likely, including malware exploiting remotely reachable vulnerabilities across an entire organisation.

Their summary is one sentence long and worth quoting rather than softening. The only fully effective way to reduce the risk is to stop using the obsolete product.

There is no paid bridge this time

This is the part that makes Windows Server 2016 different from the Windows 10 deadline we wrote about last year, and it is why the advice is not the same advice with the nouns swapped.

Windows 10 had Extended Security Updates. A published programme, a published price, three named years. Plenty of small businesses bought a year of it to buy themselves a sane replacement schedule, and that was a reasonable thing to do.

We read Microsoft's Lifecycle FAQ for Extended Security Updates this morning before writing this. Its availability table has two rows on it: Windows Server 2012/R2 and Windows 10. Windows Server 2016 is not there. There is no start date, no end date and no price, because there is no programme.

Could Microsoft add one? Yes, and we would not be at all surprised. The FAQ describes ESU in general terms as a last resort paid option for customers who need to run certain legacy products past the end of support, offering critical and important security updates for up to three years, and it is explicit that it is a temporary bridge rather than a long-term solution and comes with no troubleshooting or technical guidance attached. All of that machinery exists. Microsoft just has not pointed it at this product.

So you can plan for the date, or you can plan for an announcement that has not been made. One of those is a plan.

While we are in that table, there is a sharper deadline sitting in it for some readers. If your server is Windows Server 2012 R2, extended support ended on 10 October 2023 and the third and final ESU year ends on 13 October 2026. That is three weeks away. After it, there is nothing left to buy at any price.

Find out what the box is doing, not just what it is

The version is the easy half. Sign in, run winver, and it tells you. On a domain you almost certainly have a list already, and if you are on a managed plan with anybody competent, they have one too. An asset register earns its keep on exactly this kind of morning.

The hard half is what the server is for. Because that, not the operating system, decides how much work January is.

In our experience the contents fall into three piles. There are the things that are easy to move and that nobody would build on a server today: file shares, print queues, a folder full of scanned invoices. There are the things with a vendor sitting behind them, which is usually the accounts package, the CAD licence server or a practice management system, and which cannot be moved until that vendor says which operating systems it supports. And there are the structural things, a domain controller most often, where the server is not hosting a service so much as being part of how the network knows who anybody is.

Those three piles have completely different answers, and a quote that does not distinguish between them is a guess.

The four ways out

Upgrade it where it stands. Microsoft's supported path is one major version at a time, so 2016 to 2019 to 2022. Two upgrades, on a machine that has been running untouched for eight years, with whatever has accumulated on it. It is the cheapest option written down and the one most likely to go sideways at half past nine on a Sunday. If you go this way, take a full image first and test that the image restores somewhere else before you start. A backup nobody has restored is a belief, which is a point we have made at length about disaster recovery and which applies with force here.

Build a new one alongside it. Windows Server 2022 is supported to 14 October 2031. Windows Server 2025 came out on 1 November 2024 and its mainstream support runs to 13 November 2029, with extended support beyond that. Building fresh and moving the roles across costs more in labour and far less in anxiety, because the old server is still sitting there working while you do it. For most small businesses with one server and no spare capacity, this is the option we recommend.

Move the work and retire the box. If the three piles turn out to be file shares and a print queue, you may not need a server at all after January. That is a good outcome and it happens more often than people expect. It is also not free and not instant, and anybody who tells you a file share moves to the cloud over a weekend has not moved one with fifteen years of folder permissions on it.

Keep it and contain it. The NCSC's obsolete products guidance is written for organisations that genuinely cannot migrate in time, and it is practical rather than preachy. Reduce the routes by which untrusted data can reach the machine. Cut the services it offers down to the ones it actually needs. Use a discrete network firewall to limit the data flows to it. Their guidance says plainly that obsolete servers should not be used to provide remote app services or other remote desktop facilities, which rules out the single most common way a small business exposes an old server. Read it as a bridge with a date written on it, not a destination.

Cyber Essentials will not let you leave it there

If you certify, or you are thinking about it because a customer asked, this is where the date turns from a security question into a commercial one.

The Cyber Essentials requirements for IT infrastructure, now at version 3.3 and dated April 2026, put servers in scope as devices. The security update management control then says that all software on in-scope devices must be licensed and supported, and that software must be removed from devices when it becomes unsupported, or removed from scope by using a defined sub-set that prevents all traffic to or from the internet.

Read that second clause carefully, because it is the escape hatch and it is narrower than people assume. Not firewalled. Not "only reachable internally". No traffic to or from the internet, in either direction, in a defined sub-set. A server that still pulls its own updates, or that a supplier dials into, does not qualify.

The same control is where the scheme's 14-day rule lives, for vulnerability fixes the vendor rates critical or high risk, or that carry a CVSS v3 base score of 7 or above. That is the scheme's requirement rather than a promise from us, and it is worth noticing what it means for an unsupported server. There will be no fix to apply inside 14 days. There will be no fix.

We prepare clients for assessment and we run the evidence side of it as a managed add-on, which is on the Cyber Essentials page at 99 pounds per client per month. We do not certify anybody, and nor can anyone who is not an IASME-licensed certification body. The IASME fee is separate and it is theirs, not ours.

Insurance is the other place it lands. Every renewal form we have seen in the last two years asks whether you run unsupported software, and answering that question inaccurately is a much more expensive mistake than answering it honestly. We went through what those forms actually ask in the piece on cyber insurance requirements.

Windows Server 2022's October date is not the same thing

One more date, because it is about to cause confusion and somebody will try to sell on the back of it.

Mainstream support for Windows Server 2022 ends on 13 October 2026, three weeks from now. Extended support runs to 14 October 2031. Security updates continue for the whole of that period. What you lose in October is non-security fixes and design change requests, which for a small business is close to nothing.

If a supplier rings in November suggesting you replace a Windows Server 2022 box because support has ended, they are either confused or hoping you are. The version with the real deadline is 2016. Windows Server 2019, for the record, runs to 9 January 2029.

What it costs with us

We will not quote a migration before looking at the server, and we would be suspicious of anyone who does. The work is decided by what is on it, and we do not know that yet.

What we can put in writing is everything on the pricing page, and none of it moves. Server management is 162 pounds per server per month, which covers monitoring, patching and verifying the backups actually restore. An on-site project day for a network or server install is 855 pounds, with hardware supplied at cost plus 20% and quoted before anything is ordered. If the answer turns out to be that the server goes away and the mail moves, Microsoft 365 migration is 77 pounds per mailbox. Managed IT for the people using all of it is 50, 77 or 108 pounds per user per month depending on tier. Work outside an agreement is 86 pounds an hour for contract clients, 126 with no agreement and 167 out of hours with a two-hour minimum. Everything there excludes VAT.

What we will not do is tell you that a 2016 server behind a good firewall is fine. It is not what the NCSC says, it is not what Cyber Essentials says, and we would rather lose the job than write it down.

What to do this week

Find out which Windows version every server in the building is running, including the one in the cupboard that nobody mentions. Write down what each one does, in the three piles above. Ring the vendor of whatever line-of-business application sits on it and ask which server operating systems they currently support, because that phone call decides your options and it takes twenty minutes. Then put a date in the calendar in November, not January, for the work itself.

Sixteen weeks is comfortable. Four would not be.