Windows Server 2016 End of Support (January 12, 2027): ESU vs. Upgrade vs. Cloud

Updated October 13, 2026

Windows Server 2016 reaches end of extended support on January 12, 2027. Your servers will keep running that day, but Microsoft will stop releasing security updates for them.

If you still run Windows Server 2016, you have three realistic paths: buy Extended Security Updates (ESU) as a bridge, upgrade to a current version of Windows Server, or move the workload to the cloud. This guide compares all three, explains who qualifies for ESU, and gives you a plan you can start this week.

What Windows Server 2016 End of Support Means

Windows Server 2016 follows Microsoft's Fixed Lifecycle Policy, as listed on its official lifecycle page: five years of mainstream support, which ended in January 2022, followed by five years of extended support. When extended support ends on January 12, 2027, Microsoft stops releasing security updates and closes standard support cases for the operating system. The policy covers the Standard, Datacenter, Essentials, and MultiPoint Premium editions.

The servers do not shut off. The risk is quieter: every vulnerability discovered after that date stays open. Attackers know which systems are unpatched, and an unsupported server tends to be the one that is also holding important data or running a critical application.

It can also create business problems beyond security. Auditors, cyber insurers, and software vendors increasingly expect supported operating systems, so an unsupported server can turn into a compliance finding or a vendor compatibility issue.

Servers are rarely the only unsupported systems. If your desktops are also behind, see what you are actually risking by still running Windows 10, since the two deadlines often land on the same budget.

Your Three Options Compared

Many organizations use a mix. Move what is easy first, keep an ESU bridge for the one application that cannot move yet, and set a date to retire it.

Option 1: Upgrade to Windows Server 2025

In its February 2026 announcement, Microsoft positions Windows Server 2025 as its most secure and cloud-connected release, with hotpatching and centralized hybrid management for on-premises servers. It is the destination Microsoft recommends for 2016 workloads.

You have two ways to get there. You can build a new server on a supported version and migrate your applications and data to it, or you can upgrade in place. Starting with Windows Server 2025, non-clustered in-place upgrades can skip up to four versions at a time (see Microsoft's upgrade and migration guidance), so a 2016 server can move straight to 2025 without stopping at 2019 or 2022.

In-place upgrades are faster when the server is healthy and the applications are well understood. For older, heavily modified servers, a clean build and migration is often safer, because you leave years of accumulated configuration behind. Either way, test the applications first.

Option 2: Extended Security Updates (ESU) for Windows Server 2016

Microsoft announced ESU for Windows Server 2016 in February 2026. Microsoft describes ESU as a last-resort program for customers who must run legacy products past end of support, and it comes with real limits.

What ESU includes

• Critical and Important security updates for up to three years, through 2030
• Support for the Standard and Datacenter editions
• No new features, no customer-requested non-security hotfixes, and no design changes

Who qualifies

For on-premises servers, Microsoft requires Software Assurance through a volume licensing program such as an Enterprise Agreement, Server and Cloud Enrollment, or Open Value, or an equivalent server subscription. The Services Provider License Agreement (SPLA) is not available for Windows Server 2016 ESU.

This matters for small and mid-sized businesses. Servers bought with an OEM or retail license generally do not include Software Assurance, which means ESU may not be an option for them at all. Check your licensing before you plan around ESU.

How you get it and what it costs

The main route is Azure Arc. You install the Azure Connected Machine agent (version 1.62 or higher for Windows Server 2016), enroll servers in the Azure portal, and pay monthly. Microsoft opened portal configuration on August 3, 2026, and billing for Arc-delivered ESU begins January 13, 2027, according to its Azure Arc documentation. Microsoft has also announced general availability of ESU delivery through Azure Arc. Eligible customers can alternatively buy ESU through volume licensing in annual increments.

Reported Azure Arc rates are about $5.21 per core per month for Standard and about $29.98 for Datacenter, with a minimum of 16 physical cores per server or 8 virtual cores per VM. At those rates, a single minimum-size Standard host costs roughly $1,000 a year. Rates and agreements vary, so confirm current pricing on Microsoft's Azure Arc pricing page or with your Microsoft partner.

Option 3: Move Windows Server 2016 Workloads to the Cloud

Microsoft promotes Azure as an ESU destination, including Azure Virtual Machines, Azure Dedicated Host, Azure VMware Solution, and the Azure Stack portfolio. Its Azure Arc documentation also notes that Azure VMware Solution machines and virtual machines on Azure Local are eligible for free ESU, so they should not enroll through Arc.

Whether a standard Azure VM gets Windows Server 2016 ESU at no extra charge is where published sources disagree. Microsoft included it for Windows Server 2012, but some analysts say that benefit does not carry over to 2016. Confirm the current terms with Microsoft or your cloud partner before you budget around free ESU.

The cloud move is also a chance to modernize. Microsoft points to Azure App Service and Azure SQL Managed Instance as ways to avoid operating system end of support entirely, and Azure Migrate can help upgrade the operating system while you migrate. If you already own Windows Server licenses with Software Assurance, Azure Hybrid Benefit can reduce the cost.

How to Choose the Right Path

• The application can run on a newer OS: upgrade. It is the cleanest fix and ends the problem for good.
• The vendor will not certify a newer OS before January: use ESU as a bridge, and set a retirement date for the server.
• The hardware is old or near end of life: migrate to new hardware or the cloud instead of upgrading in place.
• You have no Software Assurance: plan to upgrade or migrate, because ESU may not be available to you.
• The server holds regulated or sensitive data: prioritize it first, since an unpatched server there carries the most risk.

Your Windows Server 2016 Action Plan

1. Inventory every Windows Server 2016 system. Include virtual machines, branch offices, and forgotten servers. You cannot plan for what you have not found.
2. Map what runs on each one. Note the application, who depends on it, and whether the vendor supports a newer OS.
3. Check your licensing. Find out which servers have Software Assurance or a subscription, since that decides whether ESU is possible.
4. Choose a path for each server. Upgrade, ESU bridge, or cloud, with a target date for each.
5. Test before you cut over. Run the application on the new platform and have a rollback plan.
6. Finish the highest-risk moves before January 12. If you need ESU, configure it ahead of time so coverage is in place when support ends.

Windows Server 2016 End of Support FAQ

ITGuys provides managed IT and cybersecurity services to businesses across Colorado's Front Range and nationwide. Dates and requirements in this article were checked against Microsoft's documentation in October 2026.