On January 12, 2027, Windows Server 2016 reaches the end of its extended support. After that day, Microsoft stops shipping security fixes for it unless you pay for them separately. That is about eight weeks away, in the same stretch of the year when most mid-market companies are locking budgets, closing the books and hoping the holidays stay quiet.
That is about eight weeks away, in the same stretch of the year when most mid-market companies are locking budgets, closing the books and hoping the holidays stay quiet.
The part that catches people is in Microsoft’s own extended security updates FAQ, last updated November 11. For the older Windows Server 2012 family, Microsoft offered free security updates to companies that moved those servers into Azure. For 2016 it says plainly: “Free ESUs on Azure aren’t available for Windows Server 2016.” The shortcut some companies used last time is not on the table this time, and the paid version is the only version Microsoft describes.
This piece is for the CEO or CFO who has been told that the server estate is fine and wants to know what to ask before January. It is not a technical migration guide. It is a way to turn a vague worry into a list, a decision for each server, and a budget line you can defend.
What Actually Happens on January 12
Nothing dramatic happens that morning. Your servers keep running, your applications keep working, and no one sees a warning screen. What changes is that Microsoft stops publishing fixes for newly discovered security flaws in Windows Server 2016. Each month after that, the gap between what is known about the software and what is protected in your environment widens.
This is the quiet kind of risk, and it is the reason these deadlines slip. Nothing breaks, so nothing feels urgent until an auditor, an insurer or an incident makes it urgent. Our view is that the fixes Microsoft keeps shipping for newer versions of Windows Server also tell a patient attacker where to look in an older one. That is our judgment, not a Microsoft statement, but it is the reason we do not treat an unsupported server as simply a server that is a little behind.
What Microsoft Is Offering, and What It Is Not
Microsoft’s FAQ says extended security updates are available for the Standard and Datacenter editions of Windows Server 2016, and that they cover fixes rated critical and important for up to three years. Its table shows the first year running to January 11, 2028, the second to January 9, 2029, and the third to January 8, 2030. For servers that are not in Azure, the FAQ points to volume licensing programs or to Azure Arc, which lets you enroll an on-premises server and pay by the core. It lists a 16-core minimum per server when you license by physical cores, and an 8-core minimum per virtual machine when you license by virtual cores.
What the FAQ does not give is a price for 2016 on-premises coverage. It does give one for the older Windows Server 2012: for on-premises and hosted servers, each of the three years was priced at 100 percent of the full license price. We would not budget 2016 from that precedent, because Microsoft says availability and pricing vary by product version. We would treat it as a reason not to assume the extension is cheap, and a reason to get a written quote from your Microsoft partner before the year ends.
Picture a $70 Million Distributor
Picture a distributor with $70 million in revenue and a server closet nobody has opened since the last office move. It runs fourteen servers, nine of them on Windows Server 2016. Three of the nine run things the whole company knows about: the file shares, the domain controllers and the accounting database. Four run things the IT manager knows about, such as a print server and an old reporting tool. Two run an inventory interface that a developer wrote for a warehouse scanner vendor and then left the company, and nobody is sure what stops working if they are switched off. The numbers are illustrative, but we have seen the shape of this closet often enough to call it ordinary.
The company does not have one problem. It has nine small problems, and they do not have the same answer. If the CEO asks for a single plan to cover all nine, the plan will be either too expensive for the three that matter least or too thin for the two that matter most.
Four Choices for Every Server
Our judgment is that every Windows Server 2016 machine should be assigned to exactly one of four choices, in this order of preference.
The first choice is to retire it. Some of those nine servers exist only because nobody asked whether anyone still uses them. If the last user left two years ago, the best patch is a shutdown, with the data archived first and a named person signing off.
The second choice is to replace the workload with a service someone else keeps patched. A print server, a file share or a reporting tool can often move to a cloud service that you rent. This is usually the cheapest long-term answer, and it takes longer than people expect, which is why it has to start now rather than in January.
The third choice is to upgrade, which means rebuilding the workload on a currently supported version of Windows Server. This is the right answer for the domain controllers and the accounting database, where the software is staying and the operating system underneath it has to change. Ask the application vendor in writing whether they support the newer version before you start, because the application, not the operating system, is often what blocks the move.
The fourth choice is to bridge it. For the two inventory servers that cannot move by January 12, you can pay for extended updates, and you should pair that with isolating them from the rest of the network, limiting who can reach them and writing down an exit date. The three-year ceiling in Microsoft’s table is a useful forcing function: a bridge that has no exit date is just a more expensive version of ignoring the problem.
The Inventory Is the Hard Part
Most of the work in the picture above is not technical. It is knowing what you have and who owns it. We saw the same pattern in oil and gas, where the modems and vendor connections at field sites sat between IT and operations with no named owner, which we described in Who Owns the Modem on Your Well Pad. A server nobody owns will not be retired, replaced or upgraded, because no one has the authority to say what it does.
A server nobody owns will not be retired, replaced or upgraded, because no one has the authority to say what it does.
So ask for a single list this week. For every Windows Server 2016 machine, it should show what it runs, who in the business depends on it, who in IT or at a vendor is responsible for it, what connects to it, and whether it could be rebuilt from scratch if it failed tomorrow. If that list takes more than a week to produce, that is your first finding. We made a similar point in our piece on hidden technical debt, where we asked what share of the critical stack is nearing end of support.
What to Tell Your Budget and Your Board
Two things belong in next year’s budget, and they are different kinds of money. Extended updates, if you buy them, are an operating cost that repeats and is likely to rise. Migration and replacement are projects with a start and an end. If the plan funds only the first, you have chosen to pay a recurring fee to stay in the same place.
If the plan funds only the first, you have chosen to pay a recurring fee to stay in the same place.
This fits the questions we suggested in Before You Approve Next Year’s IT Budget, where we asked for a list of every system with an end-of-support date in the next three years. It also connects to the argument in Your ERP Vendor Set Your Deadline: the useful deadline is the date you must decide, not the date the vendor stops helping.
One more question is worth asking your insurance broker. Ask whether running an operating system that is out of support changes your cyber coverage questionnaire or your premium. We have not verified how any particular carrier treats this, and it varies, which is exactly why the answer should come from your broker rather than from us.
What This Will Not Do
This piece will not tell you which of your servers belong in which choice. That takes an inventory and a conversation with the people who use the software. It will not give you a price for extended updates, because Microsoft’s FAQ does not publish one for Windows Server 2016 on-premises. The distributor is a picture, not a client, and the number of servers in it is illustrative. Other software from the same era, such as database and desktop products, has its own dates, and each one should be checked against Microsoft’s lifecycle pages. This is not licensing or legal advice, and the licensing terms should be confirmed with Microsoft or your reseller.
Where to Start
This week, ask your IT lead or your managed service provider for the list described above, and name one person who owns the answer for each server. Then sort the list into the four choices and put a date next to every item. If you would like help doing that, our assessments start with exactly this kind of inventory, and an experienced CIO through CIO IQ can review your plan at $1k per week. Unpatched servers are also a cybersecurity question, and we are glad to talk through yours. Reach us through the contact form on our About page.
