2027 comes quickly for critical servers
Windows Server 2016 is still present in many small and medium-sized businesses. According to Microsoft, its extended support ends on 12 January 2027. Servers will keep running after that date, but the absence of standard patches will increase security, compliance and insurance risk.
The subject is more sensitive than a workstation migration: a server often hosts critical roles, line-of-business applications, file shares, authentication or invisible dependencies, which is why preparation matters more than speed of execution.
The hidden cost of endless postponement
Putting off a server migration year after year has a cost that does not show up immediately on an invoice: each postponement means continuing to run a system without the latest security protections, with a cumulative risk that grows without any internal indicator clearly flagging it. Conversely, a migration planned on a regular rhythm (every 5 to 7 years in line with the LTSC cycle) becomes a recurring, controlled project, budgeted in advance rather than endured in a rush when support actually ends.
What to inventory
Active Directory: domain controllers, functional levels, replication, integrated DNS, service accounts.
DNS and DHCP: zones, reservations, options, network dependencies.
Files: shares, NTFS permissions, quotas, mapped paths, scripts.
Line-of-business applications: versions, databases, licences, vendor compatibility.
Backups: ability to restore the server and the data.
Scheduled tasks and scripts: processes often forgotten during migrations.
The inventory avoids nasty surprises at cutover time.
The possible scenarios
Migrate to Windows Server 2025. This makes sense to start again on a current LTSC release, with long support and recent features.
Migrate to Windows Server 2022. This choice may be preferred if the application ecosystem or internal standards make it the more prudent option in the short term.
Replace the role. Some old servers exist only because a service was never rethought. End of support is the opportunity to move a share, outsource an application or modernise a component.
Isolate temporarily. If a line-of-business application cannot migrate immediately, reduce its exposure: segmentation, backup, restricted accounts, monitoring and a replacement plan.
The recommended method
Start with the most critical roles, then set up a pilot. Test restores, application compatibility, permissions, printing, scripts and user access. Document the rollback plan before the cutover, not during the incident.
A successful migration is prepared with realistic maintenance windows, clear communication and business sign-off. The aim is not only to change version: it is to reduce the technical debt accumulated around the server.
Windows Server 2016 is not an isolated case
Server migration delays are not specific to any one company: estate analyses carried out in 2024 showed that more than a third of mid-sized companies were still using Windows Server 2016, while around a quarter of the networks scanned were still running Windows Server 2012 or 2012 R2, out of mainstream and extended support since October 2023. These figures, although focused on one particular market, illustrate a widely shared reality: server migrations structurally lag behind end-of-support dates announced years in advance.
Two other deadlines fall in autumn 2026. On 13 October 2026, the third and final year of paid Extended Security Updates (ESU) for Windows Server 2012 and 2012 R2 comes to an end: their extended support already ended on 10 October 2023, and after that date no more patches will be released for these versions, even for a fee. The same day, mainstream support for Windows Server 2022 ends; it moves into extended support until 14 October 2031, with security fixes still provided but no further functional changes. Companies managing several generations of servers at once must therefore juggle overlapping deadlines, which strengthens the case for an overall inventory rather than handling servers one by one.
The Windows 10 precedent
The Windows 10 migrations on the workstation side offer a useful insight: despite an end-of-support date known long in advance (October 2025), a significant share of the global installed base was still running the old version months after the deadline, often for lack of planning early enough. The same risk exists on the server side, with greater severity: an unsupported server hosting Active Directory or a critical business application exposes the entire information system, not just an isolated workstation.
Less than four months to go: the priorities
At the end of September 2026, fewer than four months remain before 12 January 2027. For an estate of several servers, a full project (detailed inventory, pilot, role-by-role migration) no longer fits entirely into that time. The aim therefore changes: deal first with what matters most, and cover the rest properly rather than migrating everything in a rush.
In the next two weeks: a quick inventory of Windows Server 2016 machines, the roles they host and their exposure, with a tested backup restore for each one.
In October and November: domain controllers first, by adding controllers on a recent version and then retiring the old ones, followed by servers exposed to the internet or holding sensitive data.
In December and early January: few heavy cutovers, because year-end closing and holidays shrink maintenance windows and the availability of business teams to sign off. Use this period for simple roles and checks.
For every server that cannot migrate in time: temporary security coverage, stronger isolation and a written replacement date.
ESU: a safety net, not a strategy
For Windows Server 2016, Microsoft offers paid Extended Security Updates (ESU) for up to three years after end of support, that is until January 2030. They have been available since August 2026 through Azure Arc: servers, even those hosted on premises, are connected to the Azure portal, enrolled in the programme and billed monthly, so coverage can be stopped as soon as a server is migrated. As a rule they require Software Assurance under a volume licensing agreement, a point to check before relying on them.
ESU only deliver critical and important security fixes, with no new features, no functional fixes and no technical support. Microsoft itself presents them as a temporary bridge to a supported version. Used well, they give you time to migrate calmly the few servers that cannot be moved before January; used for the whole estate, they merely push the deadline back while making it more expensive.
Which server to start with
When several servers reach end of life at the same time, the order of migration matters. The first criterion is how critical the hosted role is. A server carrying Active Directory and structural roles such as DNS or DHCP must go before a simple file server: its compromise or unavailability immediately affects every user and every application connected to the domain, whereas a file share out of service only disrupts a localised use.
The second criterion is the degree of exposure. A server accessible from outside, or hosting an application that handles sensitive data, deserves priority over a purely internal, isolated server. Combining these two criteria, criticality and exposure, gives a rational migration order rather than handling servers in whatever order they come to mind.
Migrate, or rethink the need
End of support does not automatically require recreating exactly what existed. It is often the right time to ask whether each role still deserves to exist in that form. Some old servers survive only out of habit: a share that could move to a modern collaboration space, an application whose vendor now offers a hosted version, a service that has become useless but was never switched off.
Approaching the migration with this question in mind avoids carrying technical debt over onto new hardware. Rather than rebuilding a 2016 server as a 2025 server feature for feature, you can consolidate several machines on a virtualised platform, outsource what lends itself to it and keep in-house only what has a real reason to be there. The end-of-support constraint then becomes an opportunity to slim down and modernise, not just to stay up to date.
January 2027: decide now, without haste
12 January 2027 is now close on the scale of an infrastructure project, but there is no reason for alarm: a server does not stop on that date, it stops receiving patches. What matters is that critical servers are migrated or covered by the deadline, and that every remaining server has an exit date. Starting the inventory now keeps every option open; waiting until December narrows them down to ESU bought in a hurry, from providers in demand on all sides.
We can take on your Windows Server migration and your Active Directory audit, remotely or on site on quote. Contact us to assess the complexity of your estate.
Sources: Microsoft Lifecycle, Windows Server 2016 · Microsoft Lifecycle, Windows Server 2025 · Microsoft Lifecycle, Windows Server 2022 · Microsoft Lifecycle FAQ, Extended Security Updates · Microsoft Tech Community, Windows Server 2016 ESU enabled by Azure Arc