Windows Server 2016 Support Ends January 12, 2027: A Step-by-Step Plan for the Apps Running on It

Windows Server 2016 gets its final security update on January 12, 2027. If business apps still run on it, you have about ten weeks to decide what happens to them.

The problem is rarely the server. It is what runs on it.

Most companies that still run Windows Server 2016 do not do it by choice. They do it because an order system, a quoting tool, a reporting database or an internal portal was built years ago for that server, and nobody wants to be the person who touches it.

Microsoft has been clear about the calendar. Its Windows Server team states that "extended support for Windows Server 2016 will end on January 12, 2027" (Microsoft Windows Server Blog, Feb 2026). Microsoft's lifecycle table shows mainstream support for the product already ended in January 2022 (Microsoft Lifecycle). What remains now is the last stretch of security patches, and that stretch is nearly over.

What actually happens on January 12

Microsoft's Windows IT Pro team puts it plainly: devices will receive "a final monthly security update" on the end-of-support date, and after that they "will no longer receive Windows security updates, non-security updates, bug fixes" (Microsoft Windows IT Pro Blog).

For a non-technical leader, three things follow:

• •Nothing breaks on the day. Your servers keep running and your apps keep working.
• •The risk starts quietly. Every vulnerability found after that date stays open on your machines. Attackers read the same patch notes everyone else does.
• •Other people start asking questions. Cyber insurers, auditors and customers who send security questionnaires tend to ask whether your systems are supported. An unsupported server is an awkward answer.

The practical danger is not a dramatic failure in January. It is a slow build-up of exposure on systems that hold your data.

Two honest options, and one you should avoid

Microsoft describes two routes for organizations that cannot finish in time.

1. Upgrade. Microsoft recommends moving servers to Windows Server 2025 (Microsoft Windows IT Pro Blog). Its lifecycle table lists extended support for that version running to November 2034 (Microsoft Lifecycle), so this is a long-lived choice.

2. Buy time with Extended Security Updates (ESU). Microsoft says the program is "available for purchase for up to three years after the end of the mainstream support date," and that it "offers critical and important security updates only" (Microsoft Windows IT Pro Blog). The Windows Server team describes ESU for this version as delivered through Azure Arc, and itself frames it as a bridge: a chance to upgrade or migrate rather than a place to stay (Microsoft Windows Server Blog).

ESU is a safety net, not a plan. It covers security fixes only, not new features or bug fixes. We have deliberately not quoted a price here, because we could not confirm one on Microsoft's own pages today. Check Microsoft's current ESU documentation or your reseller before budgeting.

The option to avoid: doing nothing and hoping. It is the most common choice and the most expensive one over time.

A step-by-step plan for the next ten weeks

Step 1: Find every server and every app (week 1-2)

Ask IT for a simple list: which servers run Windows Server 2016, what business function each one supports, and who in the company depends on it. Include the "forgotten" ones, such as a file server in a branch office or a test machine that quietly became production.

Step 2: Rank by business risk, not by technical age (week 2)

Sort the list into three groups:

• •Holds sensitive or regulated data (customer records, financial data, health data). Fix first.
• •Customer-facing or revenue-critical. Fix next.
• •Internal convenience tools. Fix last, or retire.

Be ready to retire things. A surprising number of systems turn out to have no owner and no users.

Step 3: Decide per app: move, rebuild or retire (week 2-4)

For each app, ask one question: can it run unchanged on a newer server?

• •Yes, it can. A server upgrade or move is enough. This is the simplest path.
• •Only with changes. The app depends on old components, old database versions or old libraries. It needs targeted modernization before it moves.
• •No, and it is a poor fit anyway. If the app already limps along, moving it to new infrastructure just preserves the problem. This is where a rebuild can be cheaper than a rescue. Our earlier post on 5 signs your business has outgrown its software can help you judge which apps fall into this group.

Step 4: Protect the gap with ESU where you must (week 4-6)

If an important app cannot be ready by January 12, plan ESU coverage for that app alone. Treat it as a dated, budgeted bridge with an owner and an end date, not an open-ended extension.

Step 5: Migrate in a safe order, with a way back (week 6 and on)

Move the least critical apps first to prove the process. Take full backups. Test with real users before cutover. Keep the old server available for a short rollback window.

Step 6: Put the next deadline on the calendar

This will not be the last end-of-support date. Add an owner and an annual review so that the next one is a routine task instead of a scramble. Maintenance obligations are worth settling in your vendor agreements too; we covered why in why maintenance is the most important part of any software contract.

Where this connects to AI plans

Many leaders ask about AI while their core systems sit on aging infrastructure. The two issues are linked. Current platforms are what modern cloud services and AI tools are built to work with, and old servers tend to be the place where data is stuck. Modernizing the app, not just the operating system, is what makes later integration possible.

What this guidance does not cover

This post summarizes Microsoft's published guidance as of today. It does not cover your licensing terms, your contracts or your regulatory obligations, and it is not legal or compliance advice. ESU pricing and enrollment details can change, so confirm them with Microsoft or your reseller. Your IT team or partner should validate each app's compatibility before any move.

Teams that want a second pair of eyes on which apps to move, rebuild or retire can look at how we approach digital modernisation at Ontoborn.

FAQ

What happens if we keep running Windows Server 2016 after January 12, 2027?

Your servers and apps will keep working, but Microsoft will stop issuing security updates, bug fixes and non-security updates for them. Any new vulnerability stays open on those machines, which raises risk and can complicate insurance, audits and customer security reviews.

Is Extended Security Updates a good long-term solution?

No. Microsoft offers ESU for up to three years and limits it to critical and important security updates. It is useful for apps that truly cannot move by the deadline, but it should come with a firm exit date.

Do we have to upgrade the server and the app at the same time?

Not always. Some apps run unchanged on a newer server, while others rely on old components and need modernization first. An app-by-app review in the first two weeks will tell you which group each one belongs to.