# Windows Server 2016 End of Support on 12 January 2027: Upgrade, Migrate or Buy ESU

> Windows Server 2016 loses support on 12 January 2027. What stops, how ESU works now Azure is no longer free for it, and how to plan the upgrade.

Canonical: https://o365hq.com/blog/windows-server-2016-end-of-support-january-2027
Provider: IT Partner LLC — US Microsoft partner since 2006. Book: https://o365hq.com/book

Published: 2026-09-06 · IT Partner

Windows Server 2016 stops getting security updates on 12 January 2027. The comfortable old answer, move it to Azure and let Microsoft patch it for free, no longer applies to this generation. Here is what changes, what ESU costs you, and the order to work in.

## What actually changes on 12 January 2027

Windows Server 2016 reaches the end of extended support on 12 January 2027. Microsoft's Azure Arc documentation names that date twice — as the end-of-support date, and as the anchor for back-billing anyone who enrolls in Extended Security Updates late. Mainstream support ended in January 2022; this is the outer edge of the ten-year lifecycle.

Nothing switches off that morning. The servers boot, the shares serve, the domain authenticates. What stops is the monthly security update. From the first Patch Tuesday after the date, every new operating-system vulnerability stays open on that host unless you have paid for Extended Security Updates. Microsoft technical support ends with it.

The second-order effects usually arrive before an attacker does. Cyber insurers ask on renewal whether your estate runs supported software. PCI DSS, HIPAA and CMMC assessors treat an unsupported operating system as a finding, not a risk to accept. Backup, EDR and monitoring vendors stop certifying their agents against it. Anything running on top inherits the problem.

## The ESU rule that changed on 1 April 2026

Most guidance written before this year says the same thing: move the server to an Azure virtual machine and Microsoft hands you Extended Security Updates at no extra charge on top of the VM. That was true for Windows Server 2012 and 2012 R2. It is not true for Windows Server 2016.

Microsoft published a pricing-consistency notice dated 27 March 2026. From 1 April 2026, any new Extended Security Updates offering carries the same list price regardless of deployment location — Azure, on-premises or another public cloud — and regardless of purchasing channel. Microsoft names Windows Server 2016 and Windows 10 Enterprise 2016 LTSB among the offerings the change covers, and states that it does not apply to existing offerings: Windows 10 version 22H2 and SQL Server 2014 keep the older treatment, ESU at no additional charge on Azure, and Windows Server 2012 and 2012 R2 kept it until their ESU program ended on 13 October 2026.

Microsoft's Azure Local documentation says the same thing from the other side — ESUs for editions that went out of support before 1 April 2026 remain free there, while ESUs released after that date, Windows Server 2016 included, fall under the new pricing guidelines. The SQL Server documentation is blunter still: SQL Server 2016 instances on Azure VMs can subscribe to ESUs but are not eligible for free ones.

The practical consequence is simple. Lifting a 2016 VM into Azure no longer makes the ESU bill disappear. Azure is still often the right answer — for the hardware, the resilience and what comes next — but model it as an Azure bill plus an ESU bill for as long as the guest stays on 2016. A [datacenter discovery and assessment](/services/azure-migration-discovery-assessment) gets you the core counts and dependency map that decision needs.

## How Windows Server 2016 ESU actually works

ESU for Windows Server 2016 covers Critical and Important security updates for up to three years, through 2030 — no new features, no non-security hotfixes, no design change requests.

There are two channels: volume licensing, or monthly billing through Azure Arc. Microsoft's Arc dates are firm — Windows Server 2016 ESU licenses have been configurable in the Azure portal since 3 August 2026, and billing begins on 13 January 2027, the day after end of support. The machines need the Azure Connected Machine agent at version 1.62 or higher, so [Azure Arc onboarding](/services/azure-arc-hybrid-server-management) is better done before the winter than during it. Transitioning from volume licensing to Arc is not supported for 2016, so the channel you pick is the channel you keep.

Eligibility is a licensing question before it is a technical one. You must attest to Software Assurance through a volume licensing program such as an Enterprise Agreement, Enterprise Agreement Subscription, Server and Cloud Enrollment, Enrollment for Education Solutions or Open Value, or to an equivalent Server Subscription or Services Provider License Agreement: Microsoft's Azure Arc pages for Windows Server 2016 state that machines licensed through SPLA or with a Server Subscription do not need Software Assurance to buy ESU, the same rule that applied to 2012 R2. What 2016 does not carry over is the Visual Studio dev/test exemption and the no-cost disaster-recovery benefit; those cores are paid cores. A [volume licensing review](/services/microsoft-volume-licensing-consulting) settles what you hold.

Sizing follows Microsoft's minimums: at least 16 physical cores per machine if you license by physical core, or at least 8 virtual cores per VM if you license by virtual core. A Standard physical-core license covers up to two VMs on that host, Datacenter has no VM limit, and Datacenter virtual cores are not a valid combination.

Waiting does not save money. Licenses provisioned after 12 January 2027 are back-billed to that date, and Microsoft's billing documentation states back-billing is never waived, including after deleting and recreating a license. Microsoft's per-core ESU pricing for Windows Server 2016 is on the price list: year one is $124 per two-core pack for [Standard](/software/extended-security-updates-for-windows-server-standard-core) and $720 per two-core pack for [Datacenter](/software/extended-security-updates-for-windows-server-dc-core), Microsoft list price, October 2026 price list, sold in two-core and eight-core packs against the minimums above. It is Microsoft's charge on your Microsoft bill, not ours. Enrolled servers do get Azure Update Manager, Change Tracking and Inventory, and Azure Policy guest configuration at no extra cost.

## What Windows Server 2016 ESU costs

ESU for Windows Server 2016 is sold per 2-core pack, one year at a time, and the price is the same in each of the three years. Microsoft list price, October 2026 price list:

| Edition | Per 2-core pack, per year | A 16-core host, per year | A 16-core host, all three years |
|---|---|---|---|
| Standard | $124 | $992 | $2,976 |
| Datacenter | $720 | $5,760 | $17,280 |

Nonprofit pricing is $31 and $180 per pack. Education has no ESU SKU on the list. Two rules decide the real bill: every physical core on the host is licensed (a minimum of 16 per host, 8 per processor), and the years are cumulative, so a server enrolled in year two buys year one as well. The [ESU calculator](/tools/esu-calculator?product=ws2016&edition=standard&cores=16&years=3) prices your own host count and edition against the same list, next to the upgrade and the Azure move.

Decide by the end of November 2026 if the answer is an upgrade or a migration: a 2016 estate of any size needs the pilot, the vendor checks and a change window before 12 January 2027. ESU can be bought in the last week; a migration cannot.

## A multi-site domain controller estate is its own project

Most of this article treats a server as the unit of work. Domain controllers are not: they are one system spread across every site, and when all of them run Windows Server 2016, replacing them is one project with one order of operations, not ten separate upgrades. The sequence is in [replacing Windows Server 2016 domain controllers with Windows Server 2025: the order of operations](/blog/replacing-windows-server-2016-domain-controllers-with-windows-server-2025-order-of-operations); the short version follows, with one plan in progress as the example.

A hardware manufacturer with six sites on three continents runs one forest and one domain on about ten Windows Server 2016 domain controllers, with Entra Connect on one of them and an ERP and factory equipment authenticating against Active Directory. Its plan starts with the schema: the forest sits at the Windows Server 2019 level and Windows Server 2025 domain controllers need a newer one, so adprep /forestprep and /domainprep run against the schema master as the first gated production change, after a verified backup, in a dedicated window, with replication confirmed to every DC before anything else moves. Entra Connect moves off the retiring domain controller next. Then, site by site: promote the new 2025 DC, demote the old one, and move the retired DC's IP address and DNS registration onto the replacement so anything still pointing at the old address keeps working.

The Windows Server 2025 defaults for SMB signing, NTLM, Kerberos and certificate mapping are the part most plans miss. They are expected to break an older NAS, scan-to-folder printers, Linux hosts on SSSD or Winbind and some production equipment, so the plan adds a compatibility-testing stage before any site cuts over; [what breaks when domain controllers move to Windows Server 2025](/blog/what-breaks-when-domain-controllers-move-to-windows-server-2025-smb-signing-ntlm-kerberos-equipment) lists the equipment and the tests. The cutovers run in three overnight windows across the time zones, each closing with replication, DNS and sign-in checks before the next site starts.

Licensing is the line item that surprises. Twelve to fourteen Windows Server 2025 licenses at the 16-core minimum, once the two new sites get their pair of DCs, is the expected part; the CAL question is not. CALs must match or exceed the server version, so 2016-era CALs without Software Assurance mean a CAL refresh for every user or device, which can cost more than the migration services. [Licensing a domain controller refresh](/blog/licensing-a-domain-controller-refresh-windows-server-2025-cores-and-the-cal-version-rule) walks through that choice. For an estate of this shape we scope the work as one engagement, [Multi-Site Domain Controller Migration to Windows Server 2025](/services/multi-site-domain-controller-migration-windows-server-2025): one forest, up to six sites and fourteen domain controllers, eight weeks, from $12,500, with the schema step, the Entra Connect move, the compatibility testing and the per-site windows in the standard scope.

## Two phases, with ESU as the safety valve rather than the plan

Only the Windows Server 2016 servers face the 12 January 2027 date. That is what turns the manufacturer's year-end target into two phases. Phase 1 replaces the 2016 domain controllers before 12 January 2027 and nothing else. Phase 2 carries the growth work, the two new sites, the site-link redesign and the hypervisor hosts, into the first quarter of 2027, where it no longer competes with the date for the same overnight windows.

If Phase 1 slips, year-one Extended Security Updates for the servers that miss the date are a paid safety valve, not a plan: enrolled before 12 January 2027 so the first invoice is not a back-bill, and covering only the servers that need it. The [ESU calculator](/tools/esu-calculator) prices that year for the servers you name, through Azure Arc or volume licensing, at Microsoft's list price. A plan that assumes ESU from the start moves the same project to January 2028 and adds a year of Microsoft's charges to it.

## Upgrading to Windows Server 2025: what the path allows

From Windows Server 2016, an in-place upgrade straight to Windows Server 2025 is supported — from installation media. It is not offered as a feature update through Windows Update; only 2019 and 2022 get that. The single hop works because, starting with Windows Server 2025, non-clustered systems can move up to four versions at once. Everything older was capped at two.

Failover clusters are the exception that catches people out. A cluster OS rolling upgrade advances one version at a time, full stop. A 2016 Hyper-V or Scale-Out File Server cluster cannot roll to 2025 in one pass; it goes 2016 to 2019 to 2022 to 2025, or you build the new cluster alongside and move the workloads across. Budget for that before promising a date.

Domain controllers get their own rule. Microsoft's guidance is to clean install a new server, promote it and demote the old one, rather than upgrade the operating system underneath a live DC — and if you do upgrade in place, adprep /forestprep and /domainprep have to be run by hand. In practice that makes domain controller work a [role migration](/services/active-directory-domain-controller-migration), not an upgrade.

Hardware is the other quiet blocker. Windows Server 2025 adds two processor requirements 2016 never had: support for the SSE4.2 instruction set and for POPCNT. Older machines may not have them, and Microsoft's Coreinfo tool answers the question in a minute.

Often, though, the operating system is not what holds the server back. It is the application on it, and a vendor who never certified anything past 2016 — a [modernization](/services/legacy-application-modernization-azure) conversation, not a patching one. SQL Server is the frequent passenger: SQL Server 2016 left extended support in July 2026, so a 2016 host running SQL 2016 is two end-of-support problems on one box and worth [assessing together](/services/sql-server-azure-migration-assessment). Where the answer is Azure rather than new hardware, a single physical box moves with a [server migration to Azure](/services/windows-server-migration-to-azure-from-physical-server).

## Windows Server 2022 mainstream support ended 13 October 2026

On 13 October 2026, Windows Server 2022 left mainstream support. Extended support runs on until 14 October 2031.

This is a much smaller event than the 2016 one. Through extended support, Windows Server 2022 keeps receiving monthly security updates at no extra cost until 14 October 2031. What stops is everything else: new features, non-security bug fixes and design change requests. There is no ESU decision, no patch cliff and no compliance finding waiting for you.

Two things follow. First, the 2022 date needs no project of its own; keep the attention on the 2016 work. Second, when you rebuild or replace a 2016 host, build it on Windows Server 2025 rather than 2022 and buy the client access licenses once: a 2025 CAL covers access to 2025 and earlier releases, an older CAL does not cover 2025.

That same 13 October date was a busy one. Extended Security Updates for Windows Server 2012 and 2012 R2 ended for good that day — the third and final year, with no fourth year at any price, in Azure or anywhere else. Any 2012 R2 still running has had no security updates since then, which puts it ahead of 2016 in the queue; [what to do after Windows Server 2012 R2 ESU ended](/blog/windows-server-2012-r2-esu-ends-october-2026) covers isolation and exit. The other dates worth having on one screen are on our [Microsoft deadlines](/deadlines) page.

## The order of work before 12 January 2027

October to January is enough time if the sequence is right, and not enough if the inventory arrives in December.

October: find every 2016 host. Not the list in the CMDB — the list the network agrees with. Physical, virtual, in the branch offices, on the hypervisor nobody logs into, and the appliance a vendor installed years ago as a Windows VM. Record edition, core counts and licensing position: those are the numbers both an ESU quote and an Azure model need.

Early November: map the dependency and the constraint for each host. What talks to it, what breaks if it stops, which vendor supports which target, and whether it is a domain controller, a cluster node or a standalone box. This is where most estates find their real blockers.

By the end of November: decide per group rather than per server, and write each decision down with a cost next to it. Upgrade in place, rebuild, migrate to Azure, bridge on ESU, or retire. Most estates use three of the five. For a mixed estate of about twenty servers, [the cost table for upgrade in place, Azure and ESU](/blog/getting-a-20-server-estate-off-windows-server-2016-upgrade-in-place-vs-azure-vs-esu-the-cost-table) puts the three paths side by side at Microsoft list prices. For the one server nobody can touch because the vendor will not move it, [the one server you cannot replace](/blog/the-one-server-you-cannot-replace-esu-through-arc-windows-iot-ltsc-or-isolation) compares ESU through Arc, a Windows IoT Enterprise LTSC rebuild and isolation.

December into the first days of January: execute in order of blast radius. The easy standalone servers first, to prove the runbook. Domain controllers and clusters with more room around them, which for a multi-site estate means starting in November rather than December. ESU enrollment for whatever genuinely cannot move, provisioned before 12 January 2027 so the first invoice is not a back-bill.

If none of this has started, do the inventory first and let the rest fall out of it.

| Path | Fits when | What it costs you | Do it by |
|---|---|---|---|
| In-place upgrade to Windows Server 2025 | Standalone server, vendor supports 2025, CPU has SSE4.2 and POPCNT | Windows Server 2025 licenses and CALs, a maintenance window, a restore-tested backup | Maintenance windows booked before December |
| Rebuild on 2025 and migrate the role | Domain controllers, cluster nodes, servers carrying years of configuration drift | New build plus role-migration effort; two servers running in parallel briefly | Start in October or November — DCs need coexistence time before 12 January 2027 |
| Move the workload to Azure | Hardware is due for refresh, or a datacenter exit is already planned | Azure consumption, plus ESU for as long as the guest stays on 2016 | Discovery in October, cutovers through December 2026 |
| Buy Extended Security Updates | The application cannot move before January and the vendor will not certify a newer OS | Microsoft's ESU charge, per core, minimum 16 physical or 8 virtual cores; Software Assurance, Server Subscription or SPLA required | Provision before 12 January 2027 to avoid back-billing |
| Retire the server | Nobody can name what still depends on it | Decommissioning effort only | Power off, keep it recoverable for 90 days |
| Do nothing | — | Unpatched OS, insurance and audit exposure, vendor support gaps | Not a plan |

## Sources

- Microsoft Learn, "Prepare to deliver Extended Security Updates for Windows Server through Azure Arc" (azure-arc/servers/prepare-extended-security-updates), "License provisioning guidelines for Extended Security Updates for Windows Server" (azure-arc/servers/license-extended-security-updates) and "Billing service for Extended Security Updates for Windows Server through Azure Arc" (azure-arc/servers/billing-extended-security-updates), retrieved October 2026
- Microsoft, "Microsoft Services: Pricing Consistency Update" (microsoft.com/licensing/news/services-pricing-consistency-update), 27 March 2026, retrieved October 2026
- Microsoft Learn, "Extended Security Updates for SQL Server" (sql/sql-server/end-of-support/sql-server-extended-security-updates), retrieved October 2026
- Microsoft Learn, "Plan your Windows Server upgrade path" (windows-server/get-started/install-upgrade-migrate) and "Cluster OS rolling upgrade" (windows-server/failover-clustering/cluster-operating-system-rolling-upgrade), retrieved October 2026
- Microsoft Learn, "Upgrade domain controllers to a newer version of Windows Server" (windows-server/identity/ad-ds/deploy/upgrade-domain-controllers), retrieved October 2026
- Microsoft, "Windows Server 2025 Licensing Guidance" (microsoft.com/licensing/guidance/Windows-Server-2025), the CAL version rule, retrieved October 2026
- Microsoft NCE Software price list (US), October 2026, Commercial segment: the ESU per-core prices quoted
- IT Partner Microsoft deadlines page: Windows Server 2016 end of extended support (12 January 2027), Windows Server 2012/2012 R2 ESU end (13 October 2026), Windows Server 2022 mainstream support end (13 October 2026), SQL Server 2016 extended support end (14 July 2026)

## Key takeaways

- Windows Server 2016 leaves extended support on 12 January 2027. Servers keep running; security updates and Microsoft support stop.
- Since 1 April 2026 Microsoft charges the same ESU list price wherever the server runs, so moving a 2016 VM to Azure no longer removes the ESU charge. The older programs were the exception: Windows Server 2012 R2 had ESU at no additional charge on Azure until 13 October 2026, and SQL Server 2014 still does.
- ESU for 2016 runs up to three years, through 2030, via volume licensing or monthly through Azure Arc — portal configuration open since 3 August 2026, billing from 13 January 2027. Software Assurance, an equivalent Server Subscription or SPLA licensing is required, as for 2012 R2.
- Enrolling late does not save money: licenses provisioned after 12 January 2027 are back-billed to that date, and Microsoft states back-billing is never waived.
- 2016 to 2025 in place is supported from installation media for non-clustered systems only; clusters advance one version at a time, and domain controllers should be clean-installed and promoted rather than upgraded.
- A multi-site domain controller estate is one project, not ten upgrades: schema first, Entra Connect off the retiring DC, then per-site promote, demote and re-IP, with compatibility testing for the Windows Server 2025 defaults and the CAL version checked before the licenses are bought.
- Windows Server 2022 mainstream support ended 13 October 2026 with extended support to 14 October 2031 — no ESU decision follows, but build 2016 replacements on Windows Server 2025.

---

Not sure how many Windows Server 2016 hosts you have, or what each would cost to upgrade, move or cover? Start with the [Windows Server 2016 End of Support Assessment](/services/windows-server-2016-end-of-support-assessment): every host inventoried, a path and a price for each, in writing. If the hardware is due as well, the [refresh, ESU or Azure decision assessment](/services/server-refresh-esu-or-azure-decision-assessment) answers both questions at once. Or [book a 30-minute review](https://o365hq.com/book) and bring the server list — the sequence and a fixed price, before 12 January 2027 decides for you.