Windows Server 2016 end of support: what to do before 12 January 2027

What end of support means

Windows Server 2016 is in its last phase, called extended support. Microsoft's ESU pages give 12 January 2027 as the end of support. The lifecycle page shows the time stamp 13 January 2027, 06:59, and says its times are Pacific time.

Microsoft states that end of support also means the end of security updates and bulletins. A server that keeps running does not stop working. It stops getting new security fixes through the normal channel.

Containers released with Windows Server 2016 follow the same lifecycle dates. If you run Windows containers on 2016 images, they are part of this work.

Option 1: upgrade in place

An in-place upgrade installs a newer Windows Server over the old one. It keeps settings, roles, features and data. With installation media, Microsoft lists three supported targets from Windows Server 2016: 2019, 2022 and 2025.

The target matters. The lifecycle pages list the end of extended support as January 2029 for 2019, October 2031 for 2022 and November 2034 for 2025.

These limits apply:

• The Windows Update method for 2025 starts from 2019 or 2022 only. From 2016 you use installation media.
• Not every role supports in-place upgrade. Check Microsoft's role and feature table first.
• Do not use it for domain controllers. Microsoft says to install a clean OS, promote new domain controllers and demote the old ones.
• For clustered servers, check the upgrade procedure that the workload supports. Microsoft's cluster OS rolling upgrade guide covers Hyper-V and Scale-out File Server workloads. It moves one OS version at a time. Migration to a new cluster is another option.
• Switching between Server Core and Server with Desktop Experience is not supported. In-place upgrades are not supported on servers configured to boot from VHD. Turn off NIC Teaming first.
• Each Windows Server upgrade needs its own licence and activation method for the new version.

Get-ComputerInfo -Property WindowsBuildLabEx,WindowsEditionID | Out-File -FilePath .\computerinfo.txt
systeminfo.exe | Out-File -FilePath systeminfo.txt
ipconfig /all | Out-File -FilePath ipconfig.txt

Option 2: build new servers

Microsoft names a second on-premises path: build new servers with a supported version of Windows Server, then migrate the applications and data. A migration moves roles or features from a source server to a different destination server.

Choose this when you move to new hardware, when a role does not support in-place upgrade, or when you want a clean start. Domain controllers follow this path too.

If an application does not run on a newer Windows Server, it has to change before the old server can go. In that case rebuild or redeploy the application on a newer OS. For Windows containers, rebuild the image on a newer Windows Server base image.

Option 3: move to Azure

Microsoft says Azure Migrate can upgrade the OS version while you migrate. Moving a server as it is keeps it on Windows Server 2016.

Microsoft also says you can get Windows Server ESU for three more years in Azure. It names Azure Virtual Machines, Azure Dedicated Host, Azure VMware Solution and the Azure Stack portfolio.

Cost needs care. For Windows Server 2012 and 2012 R2, Microsoft states that ESU on Azure VMs is free of charge. For Windows Server 2016, the Microsoft pages we read give no price and no cost condition for Azure. Ask Microsoft or your partner and get the answer in writing before you plan on it.

Microsoft names Azure Hybrid Benefit as a way to get discounts on the licence of Azure VMs. It is available to customers with active Software Assurance or a server subscription.

Option 4: Extended Security Updates as a bridge

Microsoft calls ESU a temporary bridge to a supported platform, not a long-term solution. For servers outside Azure, Windows Server 2016 ESU is available through Azure Arc. This is what Microsoft states:

• Scope: Critical and Important security updates for up to three years, through 2030. No new features, no nonsecurity hotfixes, no design changes.
• Editions: Standard and Datacenter.
• Setup: connect the server to Azure Arc with the Connected Machine agent, version 1.62 or higher. Then enable ESU in the Azure portal.
• Licence: you need Software Assurance through a volume licensing programme. With SPLA or a server subscription you do not need Software Assurance.
• Size: you provision a licence with the edition and the number of cores. The minimum is 16 physical cores per machine or 8 virtual cores per VM.
• Billing: monthly through Azure, starting 13 January 2027. We did not find a price on the pages we read.
• No free dev/test or disaster recovery benefit exists for Windows Server 2016 ESU.
• When a server moves to 2019 or higher, billing does not stop on its own. You change or deactivate the licence.

A practical order

On 31 October 2026, about ten weeks remain until 12 January 2027. Work in this order.

• Inventory. List every server and container image on 2016: edition, roles, physical or virtual, host, cluster, domain controller, application, owner.
• Check compatibility. Use Microsoft's role table and its server application compatibility page. Ask each non-Microsoft vendor which Windows Server versions it supports. Check the hardware requirements of the target.
• Choose an option per server. Domain controller: new server. Cluster: check the workload's supported rolling upgrade or migration procedure. Role and application support a newer version: in-place upgrade. Application does not: rebuild it, or bridge with ESU. Leaving your own hardware: Azure.
• Test. Take a full backup and test the restore. Rehearse on a copy where you can. Book a maintenance window, because the upgrade needs downtime.
• Switch. Run the upgrade, then check the version with Get-ComputerInfo -Property WindowsProductName. Check that all applications run and clients connect. If Setup fails, read the logs in C:\Windows\Panther and use the SetupDiag tool.
• Clean up. Update the inventory and remove ESU licences for servers that no longer need them.