Windows Server 2016 End of Life: 12 January 2027, and What to Do With the App on It

In short: Windows Server 2016 reaches end of life on 12 January 2027, with its last security update that day. Its desktop siblings, Windows 10 Enterprise LTSB 2016 and IoT Enterprise 2016 LTSB, already reached end of support on 13 October 2026. After January, every new vulnerability stays open unless you pay Microsoft for Extended Security Updates, whose price for Server 2016 is not published yet. For many small and mid-sized companies, the server itself is the easy part. The hard part is the business application on it: an ERP, a quoting tool, an intranet or an Access database that someone built years ago. This post covers the dates, what ESU does and does not buy you, and the three ways out.

---

The dates

Mainstream support for Windows Server 2016 ended on 11 January 2022. Since then it has received security fixes only. On 12 January 2027 those stop too.

What Extended Security Updates buy you

Microsoft sells Extended Security Updates (ESU) for up to three years after end of support. In the words of its product manager, ESU does "not include new features, quality fixes, or design change requests", and it does not extend technical support either. It is critical and important security patches, and nothing else.

The price for Windows Server 2016 had not been published when we wrote this. The only firm 2016 figures are for the desktop LTSB edition: $61 per device for the first year, $45 if the device is managed through Intune or Windows Autopatch, doubling every year, and cumulative, so starting in year two means paying for year one as well. Expect server pricing to follow the same doubling logic.

ESU is worth buying when you have a dated plan to leave. Bought instead of a plan, it is a rent that doubles every year on a server that gets no better.

First, find out what the server actually does

Before choosing, list what runs on it. In the small companies we work with, a "2016 server" is usually one of two things, and they have different answers.

Windows infrastructure: Active Directory, file shares, print, Exchange, Remote Desktop. That is a Windows upgrade or a move to Microsoft 365, and it is the job of your IT provider or managed service provider. It is not what we do, and we will tell you so.

A business application: a .NET or PHP web app on IIS, a SQL Server database, a scheduled job that sends invoices, an Access front end used by three people every day. That is where the risk sits, because:

• it often runs on old versions of its own stack (.NET Framework, SQL Server, PHP) that are out of support on their own schedule;
• the person who wrote it has often left, and nobody knows what an operating system upgrade will break;
• it is often reachable from the internet, to serve a customer portal or a field team, so an unpatched server is directly exposed.

Your three options for the application

1. Upgrade in place to Windows Server 2022 or 2025. Least change, and right when the app is healthy, documented and Windows-bound. You need new licences, a test environment, and someone who can tell whether the app still works after the upgrade. Risk: you inherit every other old component as-is.

2. Buy ESU and plan the move. Right when the app is critical and the migration cannot be done before January. Set an exit date before you sign: ESU year two costs double, and year three double again.

3. Move the application off the server. Put the app in a container, the database on a managed service, and the server out of the picture. This is what we do: we take over the code, audit it, and move it to hosting we run, where the operating system, patches and backups are our problem rather than yours. Our applications run on Google Cloud in containers, with no administration interface reachable from the internet, dependencies watched by Dependabot, and the infrastructure described in code. Details are on our security page.

It is more work than an upgrade the first time. After that there is no "2016 server" left to reach end of life, because nobody owns a server any more.

How to decide this week

1. List what runs on each 2016 server. If the answer is "nobody is sure", that is the first finding.
2. Check what is reachable from the internet. An unpatched server behind a public portal is the urgent case.
3. Check the versions under the application: .NET, SQL Server, PHP, the framework. Some will have their own end of support before or after January.
4. Find who can change the code. If nobody can, an operating system upgrade is a gamble, and so is staying.
5. Pick an option and a date. If that date is after 12 January 2027, budget ESU until it.

If steps 3 and 4 have no answer, a short audit is the right start: you get the list of what runs, what is exposed and what is out of support, with an order of work.

Related: should your software agency host your app?, the supermarket fridge hack and admin interfaces on the internet, and our security page.

Read next: AWS outages in 2025 and 2026, remote access security.

Also: .NET 8 end of life on 10 November 2026.