Windows Server 2016 End of Support on 12 January 2027: Upgrade, Migrate or Buy ESU

Windows Server 2016 reaches the end of extended support on 12 January 2027. Microsoft's Azure Arc documentation names that date twice — as the end-of-support date, and as the anchor for back-billing anyone who enrolls in Extended Security Updates late. Mainstream support ended in January 2022; this is the outer edge of the ten-year lifecycle.

Nothing switches off that morning. The servers boot, the shares serve, the domain authenticates. What stops is the monthly security update. From the first Patch Tuesday after the date, every new operating-system vulnerability stays open on that host unless you have paid for Extended Security Updates. Microsoft technical support ends with it.

The second-order effects usually arrive before an attacker does. Cyber insurers ask on renewal whether your estate runs supported software. PCI DSS, HIPAA and CMMC assessors treat an unsupported operating system as a finding, not a risk to accept. Backup, EDR and monitoring vendors stop certifying their agents against it. Anything running on top inherits the problem.

Most guidance written before this year says the same thing: move the server to an Azure virtual machine and Microsoft hands you Extended Security Updates at no extra charge on top of the VM. That was true for Windows Server 2012 and 2012 R2. It is not true for Windows Server 2016.

Microsoft published a pricing-consistency notice dated 27 March 2026. From 1 April 2026, any new Extended Security Updates offering carries the same list price regardless of deployment location — Azure, on-premises or another public cloud — and regardless of purchasing channel. Microsoft names Windows Server 2016 and Windows 10 Enterprise 2016 LTSB among the offerings the change covers, and states that it does not apply to existing offerings: Windows Server 2012 and 2012 R2, Windows 10 version 22H2 and SQL Server 2014 keep the older, free-on-Azure treatment.

Microsoft's Azure Local documentation says the same thing from the other side — ESUs for editions that went out of support before 1 April 2026 remain free there, while ESUs released after that date, Windows Server 2016 included, fall under the new pricing guidelines. The SQL Server documentation is blunter still: SQL Server 2016 instances on Azure VMs can subscribe to ESUs but are not eligible for free ones.

The practical consequence is simple. Lifting a 2016 VM into Azure no longer makes the ESU bill disappear. Azure is still often the right answer — for the hardware, the resilience and what comes next — but model it as an Azure bill plus an ESU bill for as long as the guest stays on 2016. A datacenter discovery and assessment gets you the core counts and dependency map that decision needs.

ESU for Windows Server 2016 covers Critical and Important security updates for up to three years, through 2030 — no new features, no non-security hotfixes, no design change requests.

There are two channels: volume licensing, or monthly billing through Azure Arc. Microsoft's Arc dates are firm — you can configure Windows Server 2016 ESU licenses in the Azure portal from 3 August 2026, and billing begins on 13 January 2027, the day after end of support. The machines need the Azure Connected Machine agent at version 1.62 or higher, so Azure Arc onboarding is better done before the winter than during it. Transitioning from volume licensing to Arc is not supported for 2016, so the channel you pick is the channel you keep.

Eligibility is a licensing question before it is a technical one. You must attest to Software Assurance through an Enterprise Agreement, Enterprise Agreement Subscription, Server and Cloud Enrollment or Enrollment for Education Solutions, or to an equivalent Server Subscription. Software Assurance is required for on-premises workloads, and the Services Provider License Agreement route that existed for 2012 R2 is not available for 2016. A volume licensing review settles what you hold.

Sizing follows Microsoft's minimums: at least 16 physical cores per machine if you license by physical core, or at least 8 virtual cores per VM if you license by virtual core. A Standard physical-core license covers up to two VMs on that host, Datacenter has no VM limit, and Datacenter virtual cores are not a valid combination.

Waiting does not save money. Licenses provisioned after 12 January 2027 are back-billed to that date, and Microsoft's billing documentation states back-billing is never waived, including after deleting and recreating a license. Microsoft had not published per-core ESU pricing for Windows Server 2016 at the time of writing; whatever it turns out to be, it is Microsoft's charge on your Microsoft bill, not ours. Enrolled servers do get Azure Update Manager, Change Tracking and Inventory, and Azure Policy guest configuration at no extra cost.

From Windows Server 2016, an in-place upgrade straight to Windows Server 2025 is supported — from installation media. It is not offered as a feature update through Windows Update; only 2019 and 2022 get that. The single hop works because, starting with Windows Server 2025, non-clustered systems can move up to four versions at once. Everything older was capped at two.

Failover clusters are the exception that catches people out. A cluster OS rolling upgrade advances one version at a time, full stop. A 2016 Hyper-V or Scale-Out File Server cluster cannot roll to 2025 in one pass; it goes 2016 to 2019 to 2022 to 2025, or you build the new cluster alongside and move the workloads across. Budget for that before promising a date.

Domain controllers get their own rule. Microsoft's guidance is to clean install a new server, promote it and demote the old one, rather than upgrade the operating system underneath a live DC — and if you do upgrade in place, adprep /forestprep and /domainprep have to be run by hand. In practice that makes domain controller work a role migration, not an upgrade.

Hardware is the other quiet blocker. Windows Server 2025 adds two processor requirements 2016 never had: support for the SSE4.2 instruction set and for POPCNT. Older machines may not have them, and Microsoft's Coreinfo tool answers the question in a minute.

Often, though, the operating system is not what holds the server back. It is the application on it, and a vendor who never certified anything past 2016 — a modernization conversation, not a patching one. SQL Server is the frequent passenger: SQL Server 2016 left extended support in July 2026, so a 2016 host running SQL 2016 is two end-of-support problems on one box and worth assessing together. Where the answer is Azure rather than new hardware, a single physical box moves with a server migration to Azure.

About five weeks from now, on 13 October 2026, Windows Server 2022 leaves mainstream support. Extended support runs on until 14 October 2031.

This is a much smaller event than the 2016 one. Through extended support, Windows Server 2022 keeps receiving monthly security updates at no extra cost for five more years. What stops is everything else: new features, non-security bug fixes and design change requests. There is no ESU decision, no patch cliff and no compliance finding waiting for you.

Two things follow. First, do not let 2022 crowd the 2016 work this autumn. Second, when you rebuild or replace a 2016 host, build it on Windows Server 2025 rather than 2022 and buy the client access licenses once: a 2025 CAL covers access to 2025 and earlier releases, an older CAL does not cover 2025.

That same 13 October date is a busy one. Extended Security Updates for Windows Server 2012 and 2012 R2 end for good that day — the third and final year, with no fourth year at any price and no free continuation in Azure. If any 2012 R2 is still running, it is the more urgent problem on this page. The other dates worth having on one screen are on our Microsoft deadlines page.

Eighteen weeks is enough time if the sequence is right, and not enough if the inventory arrives in December.

Weeks one to three: find every 2016 host. Not the list in the CMDB — the list the network agrees with. Physical, virtual, in the branch offices, on the hypervisor nobody logs into, and the appliance a vendor installed years ago as a Windows VM. Record edition, core counts and licensing position: those are the numbers both an ESU quote and an Azure model need.

Weeks three to six: map the dependency and the constraint for each host. What talks to it, what breaks if it stops, which vendor supports which target, and whether it is a domain controller, a cluster node or a standalone box. This is where most estates find their real blockers.

Weeks six to ten: decide per group rather than per server, and write each decision down with a cost next to it. Upgrade in place, rebuild, migrate to Azure, bridge on ESU, or retire. Most estates use three of the five.

Weeks ten to eighteen: execute in order of blast radius. The easy standalone servers first, to prove the runbook. Domain controllers and clusters with more room around them. ESU enrolment for whatever genuinely cannot move, provisioned before 12 January so the first invoice is not a back-bill.

If none of this has started, do the inventory this month and let the rest fall out of it.