The One Server You Cannot Replace: Keeping a Legacy Application on Windows Server 2016 or Windows 10 Supported with ESU Through Arc, Windows IoT Enterprise LTSC, or Isolation

Four paths keep a legacy application supported, and the right one turns on one question for the vendor: is the application supported on a client edition of Windows? If yes, a rebuild on Windows 10 IoT Enterprise LTSC 2021 or Windows 11 IoT Enterprise LTSC 2024 buys a perpetual $295 license supported until 13 January 2032 or 10 October 2034 (Microsoft list price, October 2026 price list). If not, Windows Server 2016 Extended Security Updates (ESU) buy up to three years from 12 January 2027, monthly per core through Azure Arc or annually through volume licensing. If neither is possible, isolation behind written controls with an exit date. Replacement is the only permanent path.

Windows Server 2016 ESU delivers the updates Microsoft rates Critical and Important for up to three years after 12 January 2027, through January 2030. It needs Software Assurance, a Server Subscription or SPLA licensing and comes through two channels.

Through Azure Arc, the server runs the Connected Machine agent and you provision an ESU license in the Azure portal by edition and core count. Billing starts on 13 January 2027 and runs monthly per core; a license provisioned later is back-billed to the end-of-support date, and a deactivated one bills for up to five more days. For one box the appeal is the exit: drop the cores and the meter stops.

Through volume licensing, ESU is an annual key per core. At the time of writing, Microsoft's lifecycle FAQ prices each of the three years at the full license price, and years two and three are sold only to customers who bought the earlier years. On the October 2026 price list, Windows Server Standard ESU is $124 per 2-core pack and $496 per 8-core pack; Datacenter is $720 and $2,880; the list carries the same figures for all three years. Moving from volume licensing to Arc is not supported for 2016. The ESU calculator prices both channels per year; our Windows Server 2016 end-of-support article covers eligibility.

Microsoft describes Windows IoT Enterprise as a binary equivalent of Windows Enterprise for fixed-function devices: ATMs, point-of-sale terminals, industrial automation, medical devices and digital signage. Each Long-Term Servicing Channel release is supported for ten years with security updates and no feature updates. It is licensed for fixed-function use, not as a general desktop, and is sold pre-installed by an OEM or as an upgrade license through volume licensing and the Cloud Solution Provider program.

Windows 10 IoT Enterprise LTSC 2021 is supported until 13 January 2032. Windows 11 IoT Enterprise LTSC 2024 has mainstream support until 9 October 2029 and extended support until 10 October 2034. Both are $295 per device, perpetual, Microsoft list price, October 2026 price list.

The non-IoT Windows 10 Enterprise LTSC 2021 ends on 12 January 2027 with no extended phase; its Extended Security Updates are $61 per device for year one, $122 for year two and $244 for year three (October 2026 price list), cumulative, so three years of ESU cost more than one IoT LTSC license. Windows 10 Enterprise LTSB 2016 left support on 13 October 2026. A vendor accepts the LTSC path when its support statement names a client edition and the application has no server role.

Isolation is for a machine that cannot take ESU, cannot be rebuilt and cannot yet be replaced. The documentation is most of the work.

1. Network. Its own VLAN or host, no inbound connections from the user network, administrators through a jump host with multifactor authentication.
2. Outbound. Only to the destinations and ports the application needs; no general internet access.
3. Identity. No domain membership where the application allows it; otherwise its own organizational unit with no domain administrator logons. Local accounts with unique passwords in a vault.
4. Detection. Microsoft Defender for Servers through Defender for Cloud, or the EDR you already run, with alerts routed to a named person.
5. Backup. A nightly image, with a restore tested and dated each quarter.
6. Exit. A written retirement date and an owner, reviewed each quarter until the machine is gone.

The sentence an auditor wants to read, in your register: "This system runs an operating system that no longer receives vendor security updates. It is isolated with no inbound access from the user network, monitored by EDR, backed up and restore-tested, owned by a named manager, and scheduled for retirement on a stated date." Insurers ask whether every system receives vendor updates; that sentence answers the question after the "no". Our Windows Server 2012 R2 post-ESU plan applies the same controls.

A medical practice of about 200 users is being acquired by a hospital group, with a possession date about four weeks out and an acquirer's checklist requiring central management of every server. About a dozen servers are being rebuilt on Windows Server 2022 and connected to Azure Arc. One machine does not fit: a digital-signage system on a Windows Server 2016 virtual machine the vendor will not move to a newer server release.

The plan treats it as a device rather than a server. The vendor's support statement names Windows 10 Enterprise and the application has no server role, so the practice orders one Windows 10 IoT Enterprise LTSC 2021 license at $295 (October 2026 list price) instead of ESU, once the licensing desk confirms the upgrade and virtual-use terms. The signage player is rebuilt on a fresh LTSC 2021 virtual machine; the 2016 machine stays off for ninety days. On the acquirer's inventory it is a fixed-function device supported until 13 January 2032, on its own VLAN with outbound only to the vendor's content service, EDR and nightly backup.

ESU stays on the plan as the fallback: if the rebuild slips past 12 January 2027, the 2016 machine is enrolled through Arc for the months it needs.

Unsupported in production with "we'll get to it". A server with no security updates and no written controls is not an accepted risk but an undocumented one, and an assessor records it as a finding.

Moving the server to Azure for ESU at no additional charge. That entitlement applied to Windows Server 2012 and 2012 R2 and ended on 13 October 2026. Microsoft's pricing-consistency notice of 27 March 2026 states that ESU offerings released from 1 April 2026, Windows Server 2016 among them, carry the same list price regardless of deployment location or purchasing channel.

A consumer or general-purpose edition. Windows 10 Home and Pro left support on 14 October 2025, and Microsoft excludes organization-managed devices from the consumer ESU program. Windows 10 Enterprise LTSC 2021 ends on 12 January 2027 and is not a rebuild target either.

An annual volume-licensing key for a server retiring mid-year. The key is paid for the year; the Arc meter stops when cores are removed.

Microsoft's charges (the ESU meter, the IoT license, Arc add-ons and Azure consumption) are billed to you by Microsoft.

• Windows Server ESU Enrollment through Azure Arc: $35 per server plus a $1,450 tenant fee, one week: Arc onboarding, the license linked before 12 January 2027, and activation evidence for your register.
• Windows Server 2012 R2 Post-ESU Isolation and Exit Plan: $3,950 per project, two weeks, for an estate with several machines that cannot move: the controls above, a one-page record per host and a dated exit for each.
• Managed ESU and Legacy Server Lifecycle Service: $18 per server plus a $250 tenant fee, monthly: the patch and ESU compliance report, Arc agent health, and licenses reconciled against the servers that still exist.
• For the LTSC path and the estate around it: Windows 11 Migration and Windows 10 ESU Transition at $25 per device plus a $1,950 tenant fee, and Azure Arc Hybrid Server Management at $25 per server plus a $1,950 tenant fee, the usual answer to the central-management row in our audit-requirement article.

We have an old system on Windows Server 2016 that the vendor won't move; what is the cheapest supported way to keep it?

Ask whether the application is supported on Windows 10 or Windows 11 Enterprise. If yes, a Windows IoT Enterprise LTSC rebuild at $295 per device, perpetual and supported to 2032 or 2034, costs the least. If no, Windows Server 2016 ESU through Azure Arc, monthly per core from 13 January 2027, costs the least for a box retiring within the year.

What does Windows 10 IoT Enterprise LTSC cost and when can we use it?

Windows 10 IoT Enterprise LTSC 2021 and Windows 11 IoT Enterprise LTSC 2024 are each $295 per device, perpetual, Microsoft list price, October 2026 price list, for fixed-function devices such as signage players and kiosks. LTSC 2021 is supported until 13 January 2032, LTSC 2024 until 10 October 2034.

What does "supported" mean to an auditor or an insurer?

That the operating system still receives vendor security updates, or, when it does not, that a written exception names the owner, the compensating controls and the exit date. ESU and an LTSC rebuild pass the first test; isolation passes the second only with the paperwork.

Can we just isolate it?

Yes, for a defined period, if the application works with no inbound connections from the user network. It needs its own VLAN or host, outbound limited to named destinations, local accounts in a vault, EDR, tested backups and a dated exit, all written down.

Can we move the server to Azure and get ESU at no additional charge?

Not for Windows Server 2016. ESU at no extra charge in Azure applied to Windows Server 2012 and 2012 R2 and ended on 13 October 2026. Since 1 April 2026 Microsoft prices new ESU offerings the same wherever the server runs.