Windows Server 2016 extended support ends January 12, 2027

Windows Server 2016 reaches the end of extended support on January 12, 2027. After that date, Microsoft stops releasing security updates for it, unless you pay for Extended Security Updates. Many web servers, file servers, and application servers installed around 2017 to 2019 still run it, often hosting IIS sites, line-of-business applications, or SQL Server. With the deadline weeks away, the practical question is which servers can move in time, and which need a bridge.

Find affected servers

Get-ComputerInfo | Select-Object WindowsProductName, OsVersion
winver

Windows Server 2016 reports version 10.0.14393. Check every server, including domain controllers, management servers, and vendor appliances. Your cloud provider's inventory (AWS Systems Manager, Azure Arc, or Azure Update Manager) can list operating systems across many servers.

Your options

Extended Security Updates are included at no extra charge for servers running in Azure, and available through Azure Arc for servers elsewhere; check Microsoft's current terms for your licensing.

What to check before upgrading

• Applications: confirm each vendor supports the target Windows Server version.
• IIS sites: export configuration, certificates, and URL rewrite rules; see IIS TLS, bindings, and rewrite rules.
• .NET versions: confirm the runtimes your applications need; see .NET runtime support dates.
• SQL Server: often older too; see SQL Server 2016 end of support.
• Domain controllers: follow Microsoft's guidance for adding new controllers and retiring old ones rather than upgrading in place.
• Backups and monitoring agents must support the new version.

A plan for the next weeks

1. Inventory every 2016 server with its role, owner, and applications.
2. Mark which can be retired, rebuilt, or upgraded before January 12.
3. Buy ESU for the rest, with a target move date for each.
4. Rebuild internet-facing servers first; they carry the most risk.
5. Test each moved application before switching traffic.

Common questions

Will the servers stop working on January 12? No; they keep running, but every vulnerability found afterwards stays open unless you have ESU.

Should we go to 2022 or 2025? Windows Server 2025 has the longest support ahead; choose 2022 only if an application is not yet supported on 2025; see Windows Server 2025 for hosting.

Can we upgrade in place safely? For simple, well-understood servers, often yes, with a full backup first. For servers with years of changes, rebuilding is safer.

What about Windows 10 desktops? They are a separate deadline that has already passed; see Windows 10 to 11 upgrades.

Do auditors accept ESU? Usually, with a documented move date.

Rebuilding a web server: the steps

1. Document the old server: IIS sites and bindings, application pools, certificates, scheduled tasks, installed software, firewall rules, and service accounts.
2. Build the new server on Windows Server 2022 or 2025 from a hardened image.
3. Install runtimes and applications; import certificates; recreate sites and rewrite rules.
4. Test on a temporary address: pages, sign-in, forms, uploads, scheduled tasks, and integrations.
5. Switch traffic at the load balancer or DNS, with the old server kept as the rollback.
6. Decommission the old server once the new one has run cleanly through a normal business cycle.

How long does a rebuild take? For a well-documented web server, days including testing; for an undocumented one, discovery takes most of the time, which is why starting now matters.

What about servers we cannot touch until after a busy period? Buy ESU for them, set the move date for after the period, and keep them tightly restricted meanwhile.

Can a 2016 domain controller stay? Replace it; domain controllers are high-value targets.

How eWay handles Windows Server upgrades

On servers eWay manages, operating system versions are moved in step with what applications support, rebuilt from hardened images through infrastructure as code where possible, and validated in a test environment first. Changes are applied in an agreed low-traffic window with a tested rollback, and behind a load balancer servers are moved one at a time while the others carry traffic.

What to include in a support ticket

• The servers, their roles, and the applications on them
• Vendor support statements for the target version
• Whether ESU should be purchased for any server

eWay customers can open a ticket in the support portal or email support@ewaycorp.com.