Windows Server 2016 end of support: your checklist before 13 January 2027
Windows Server 2016 end of support hits 13 January 2027 in Australia. Compare your four options, the ESU catch, and the SQL Server 2016 and Exchange deadlines.
Windows Server 2016 end of support lands on 13 January 2027 in Australia. Microsoft's last regular security update for it is due in Melbourne early that Wednesday morning, and extended support formally closes at 1:59am the next day. From then on, a 2016 server gets no security fixes unless it's covered by Extended Security Updates. Here's the plan, plus the SQL Server and Exchange deadlines already biting.
In many small offices, that's the comms-cupboard box handling sign-in, shared files, Remote Desktop and the practice or accounting database.
When exactly does Windows Server 2016 support end?
Microsoft's Windows Server 2016 lifecycle page lists the end of extended support as 13 January 2027 at 6:59:59am Pacific Time, for every edition, Essentials included. In Melbourne daylight saving time, that's 1:59am on Thursday 14 January 2027.
In practice, the final patch matters more. Monthly security updates are published on the second Tuesday, typically at 10am Pacific Time, so the January 2027 release goes out on Tuesday 12 January in the US, about 5am on Wednesday 13 January in Melbourne. Microsoft's planning announcement uses that US Patch Tuesday, 12 January 2027, as the end date.
What happens to a Windows Server 2016 machine after that?
The server keeps running; what stops is the flow of fixes, so every vulnerability found after January stays open.
Extended Security Updates (ESU) restore Critical and Important security patches and nothing else. Microsoft's ESU FAQ calls the program a last-resort paid option and a temporary bridge that doesn't extend the product's lifecycle or add technical support.
One more catch for Remote Desktop servers: Microsoft ended support for Microsoft 365 Apps on Windows Server 2016 on 14 October 2025. Security updates for those apps continue until 10 October 2028, but feature updates froze at Version 2602; Microsoft points customers to Windows 365 or Azure Virtual Desktop. If the server runs Office LTSC 2021 or Office 2021 instead, Office 2021 support has just ended too.
Which other on-premises Microsoft deadlines should you check?
As at 15 October 2026, here's where the usual small-business server products stand.
| Product | Key date (Melbourne time) | What's left |
|---|---|---|
| Windows Server 2012 and 2012 R2 | Final ESU update arrived 14 October 2026 | Nothing: no further security updates of any kind |
| Exchange Server 2016 and 2019 | Out of support since October 2025; paid ESU ends with October 2026 | No further extension; move to Exchange Online or Exchange Server SE |
| SQL Server 2016 (every edition, Express included) | Extended support ended 15 July 2026 | Paid ESU to July 2029 for Standard and Enterprise only; none for Express |
| SharePoint Server 2016 and 2019 | Extended support ended 15 July 2026 | Move to SharePoint in Microsoft 365 or SharePoint Server Subscription Edition |
| Windows Server 2016 | Last regular patch 13 January 2027; support ends 1:59am, 14 January 2027 | Paid ESU through Azure Arc, for up to three years |
Microsoft's Azure Arc ESU guidance confirms October 2026 brought the final Windows Server 2012 and 2012 R2 update, so move those first. The SharePoint dates are on Microsoft's SharePoint Server 2016 lifecycle page; 2019's end date matches.
Exchange is the most urgent. Exchange 2016 and 2019 left support in October 2025, and the Exchange team has said there will be no further extension of the paid ESU program. Exchange 2019 on CU14 or CU15 can be upgraded in place to Exchange Server SE, but Exchange 2016 needs a legacy upgrade onto new servers. For most small businesses, Exchange Online inside Microsoft 365 removes the mail server altogether.
What are your four options for a Windows Server 2016 machine?
Whether you replace the office server or retire it, each 2016 machine takes one of four paths; most offices mix them.
| Option | Best for | Watch for |
|---|---|---|
| Retire it into Microsoft 365 (SharePoint, Teams, Entra ID, Intune) | Servers that mainly handle sign-in, shared files and email | Very large files, apps that expect a domain, and mapped-drive habits |
| Move workloads to Azure virtual machines or Azure Virtual Desktop | Applications that still need Windows Server or SQL Server; remote staff | Ongoing monthly cost and reliance on your internet link |
| Replace it on-site with Windows Server 2025 | Workloads that must stay local, such as factory equipment or large datasets | Server and client licensing, and ageing hardware if you upgrade in place |
| Buy time with ESU through Azure Arc | A server that genuinely can't move before January | Licensing prerequisites, listed editions, and security patches only |
Retiring the server is often the cleanest answer when it's mostly a file share and a domain controller. Our file server to SharePoint migration checklist covers the file side.
Moving to Azure suits the application that needs a Windows server underneath it. Rebuild on a current Windows Server version rather than lifting 2016 across, and don't count on free ESUs: Microsoft has already dropped them for SQL Server 2016 on Azure virtual machines. Key IT runs server to cloud migration in stages, then manages the Azure environment.
Replacing on-site fits workloads that can't leave the building. Windows Server 2025 is supported into November 2034, and Microsoft's upgrade guidance allows non-clustered in-place upgrades across up to four versions, so 2016 can jump straight to 2025. But hardware that shipped with a 2016 licence is probably as old as the operating system; our IT procurement team can source a replacement.
ESU through Azure Arc is a bridge, not a destination. Microsoft's Arc guidance says setup in the Azure portal opened on 3 August 2026, billing starts on 13 January 2027, and coverage runs for up to three years, through 2030. You need Software Assurance through volume licensing, a Server Subscription or a hoster's SPLA licence, and only Standard and Datacenter are listed. If your licence simply came with the hardware, check eligibility first.
How do you plan backwards from January?
List every server: physical boxes, virtual machines and the desktop PC that quietly became a server, with version, edition, role and who relies on it. An internal vulnerability scan flags unsupported operating systems nobody remembered.
Ask each software vendor in writing which Windows Server and SQL Server versions their product supports, whether it needs upgrading first, and how much notice they need.
Work out how you're licensed.
Hardware-bundled licences, volume licences with Software Assurance or subscriptions decide whether ESU is available and what a replacement costs.
Back up, then test the restore, keeping a copy that can't be altered, before anyone touches the server. Our disaster recovery and business continuity service builds that safety net in.
Pilot one workload with real staff, keeping the old server untouched until sign-off.
Cut over, then decommission: remove the old server from the network and domain, and wipe its disks.
Make the ESU call early.
Anything that can't move before 13 January needs an ESU decision, with a written exit date, before the Christmas shutdown.
Mind the calendar: the deadline falls in the January holiday period, when many businesses and software vendors run on skeleton staff.
What about practice software running on SQL Server 2016?
This is often the hardest server to move, because the software vendor decides which database versions it supports. Microsoft's SQL Server 2016 lifecycle page applies the July 2026 end date to every edition, including the free Express edition bundled with some line-of-business software. Look for Microsoft SQL Server 2016 in the server's installed programs, or ask the vendor to confirm.
The edition decides your options. Microsoft's SQL Server ESU FAQ says only Standard and Enterprise can get ESUs. Express can't, so an Express database stays unpatched until it moves to a newer SQL Server version your vendor supports. Standard and Enterprise servers can join Azure Arc and pay as you go without Software Assurance, according to Microsoft's SQL Server ESU documentation, but those ESUs ship only for Critical-rated vulnerabilities and exclude general product support.
For the medical and dental practices Key IT supports, we run Best Practice's own backup alongside our own immutable copy and keep an immutable copy of Dental4Windows servers, so the practice database can be restored whatever happens during a move.
Does an unsupported server affect cyber insurance and the Essential Eight?
Yes, on both counts. At Maturity Level One, ASD's Essential Eight maturity model requires operating systems no longer supported by vendors to be replaced, and expects operating system patches on internet-facing servers within 48 hours when a vulnerability is critical or a working exploit exists. A server Microsoft no longer patches can't meet that, and ASD's Information Security Manual asks for compensating controls while an unsupported system can't yet be replaced. ESU keeps patches flowing but doesn't extend the lifecycle, so treat an ESU server as a dated exception in your Essential Eight plan.
That still holds after ASD's 15 October 2026 launch of ASD Essentials: iTnews reports the Essential Eight will stay on ASD's website alongside its successor while the transition runs.
Insurers watch the same risk. In 2023, Australian law firm Allens noted that many market-standard cyber insurance wordings limit cover where the software or hardware had reached end of life before it was first exploited. Answer renewal questions about unsupported systems accurately; here are the controls cyber insurers expect in 2026.
Frequently asked questions
Is Windows Server 2016 end of support on 12 or 13 January 2027?
Both, depending on where you read it. Microsoft's announcement says 12 January 2027 and its lifecycle page lists 13 January at 6:59:59am Pacific Time. In Melbourne, the final regular security update arrives around 5am on Wednesday 13 January, and support formally ends at 1:59am on Thursday 14 January. Plan around 13 January.
Will Windows Server 2016 stop working after January 2027?
No. It keeps running and your applications keep working. Security updates and Microsoft's standard support stop, so every newly discovered vulnerability stays open, and software vendors may stop supporting their products on it. The longer it runs past January, the bigger the risk for security, insurance and Essential Eight compliance.
How much do Windows Server 2016 Extended Security Updates cost?
It depends on your core count and licensing. For Windows Server 2012, Microsoft licensed ESUs per core, and volume-licensing ESUs cost the full licence price each year. Azure Arc ESUs for 2016 are billed monthly from 13 January 2027. Get a quote for your actual servers and compare it with the one-off cost of moving.
Is Windows Server 2016 Essentials covered by Extended Security Updates?
Don't assume so. Microsoft's Azure Arc guidance names Standard and Datacenter as the Windows Server 2016 editions ESU supports, and Essentials isn't listed. If your office runs Essentials, plan to retire, migrate or replace that server before January, and confirm eligibility with your licensing provider before relying on ESU.
What should we do about Exchange 2016 or 2019 right now?
Move it. Exchange 2016 and 2019 left support in October 2025, and the paid ESU program ends with October 2026, with no extension. Exchange Online in Microsoft 365 suits most small businesses. To stay on-premises, upgrade Exchange 2019 (CU14 or CU15) in place to Exchange Server SE; Exchange 2016 needs new servers.
More insights
Windows 10 end of life
Windows 10 end of life was 14 October 2025, and business ESU year one ended 13 October 2026. The…
Read article →Windows 10Office 2021 end of support
Office 2021 end of support hit on 13 October 2026 with no extended updates. What it means, what to…
Read article →Microsoft 365Secure Boot certificate expiry
Secure Boot certificate expiry 2026: Windows Production PCA 2011 lapses on 19 October. What it…
Read article →Book your free IT & Cyber Security Review
See exactly where your IT and security stand, and what to fix first. No jargon, no obligation.