Windows Server 2016 end of support is on 12 January 2027. On that day Microsoft ships the last regular security update for it, and from 13 January 2027 a 2016 server gets no more patches unless its owner pays for Extended Security Updates (ESU). Counted from 16 October 2026, that is 88 days and three Patch Tuesdays away.
"End of support" here means the end of extended support, the last phase of Microsoft's product lifecycle, when a product gets security fixes only. Mainstream support, the earlier phase that also brought non-security fixes, ended on 11 January 2022. If your 2016 server is a rented VPS, the cleaner way out is usually a new Windows VPS with Windows Server 2022 or 2025: build it next to the old one, test it, switch DNS, and keep the old server running until everything checks out.
Key facts, checked on 16 October 2026:
- Microsoft's Windows Server 2016 lifecycle page lists the end of extended support for the Standard, Datacenter, Essentials and MultiPoint Premium editions as 12 January 2027.
- In February 2026 Microsoft confirmed a final monthly security update on that date, then no security updates, bug fixes or technical support, and offered ESU for up to three years (Windows IT Pro Blog, notice MC1235720).
- ESU for Windows Server 2016 through Azure Arc could be set up from 3 August 2026, and billing starts on 13 January 2027. Only Standard and Datacenter qualify (Microsoft Learn, Azure Arc ESU).
- A 2016 server can be upgraded in place to 2019, 2022 or 2025 from installation media. The Windows Update route to 2025 works only from 2019 or 2022 (Microsoft Learn, upgrade paths).
- SQL Server 2016, common on these servers, left extended support on 14 July 2026 (SQL Server 2016 lifecycle).
Windows Server 2016 end of support timeline: three Patch Tuesdays left
Microsoft releases security fixes on the second Tuesday of each month, which admins call Patch Tuesday. Windows Server 2016 has three left: 10 November 2026, 8 December 2026 and 12 January 2027. The right-hand column is the pace we would aim for on a single rented server with a handful of programs.
| Date | What happens | Where your move should be |
|---|---|---|
| 16 October 2026 | 88 days left | Inventory written down, new server ordered |
| 10 November 2026 | Patch Tuesday, two to go | Programs reinstalled on the new server, first data copy done |
| 8 December 2026 | Patch Tuesday, one to go | Users tested it, DNS switched, old server idle as a fallback |
| 12 January 2027 | Final security update for 2016 | Old server shut down and cancelled |
| 13 January 2027 | No updates without ESU; Azure Arc ESU billing begins | Nothing left on 2016 |
Many offices freeze changes over the holidays, and the vendor who would help you reinstall a program is on leave too. Finishing before mid-December leaves January for clean-up instead of a rushed move.
What are your options when Windows Server 2016 support ends?
There are five realistic routes. Each is explained further down; this table puts them side by side.
| Option | Security updates until | What it takes | Fits when |
|---|---|---|---|
| Keep running 2016 without ESU | 12 January 2027 | Nothing now; the risk grows every month | Never, for a server reachable from the internet |
| Buy ESU through Azure Arc | Up to three more years, paid monthly | Azure account, Arc agent, the right licence | The server needs months to replace |
| Move the 2016 VM into Azure | ESU at no extra charge while it runs in Azure | A migration into Azure | The company already runs in Azure |
| Upgrade in place to 2025 | 14 November 2034 | Media and licence from your host, a tested backup | One clean server on a host that supports it |
| New server with 2025, then migrate | 14 November 2034 | A few days of work, old server stays live | Most small businesses on one VPS |
What happens when Windows Server 2016 support ends?
Nothing switches off. A 2016 VPS will boot, share files and accept Remote Desktop logins exactly as the day before. What stops is the stream of fixes, and that hurts in three ways.
New security holes stay open
Every month Microsoft patches Windows Server 2019, 2022 and 2025, which share much of their code with 2016. Each of those fixes that also applied to 2016 marks a weakness that a 2016 server without ESU keeps for good, so the risk grows month by month.
Remote Desktop faces the internet
A VPS is not tucked behind an office router. Its Remote Desktop port (TCP 3389 by default) is reachable from anywhere unless you limit it, and automated password guessing against it never stops. Whatever you decide about 2016, lock RDP down today with our guide to securing RDP on Windows Server.
Compliance and software vendors move on
If the server touches card payments, PCI DSS v4.0.1 requirement 6.3.3 expects critical security patches within one month of release (PCI SSC document library), which an unpatched system cannot meet. Software vendors also stop certifying new releases on an operating system Microsoft has retired.
Windows Server 2016 Extended Security Updates: who qualifies
Extended Security Updates (ESU) is a paid subscription for critical and important security fixes after the end of support. It adds no features, no other fixes and no general support. Microsoft's ESU FAQ calls it a last-resort option and a temporary bridge.
A server outside Azure gets ESU through Azure Arc, Microsoft's service for managing servers in other data centres from the Azure portal. The Azure Arc ESU page sets these conditions for Windows Server 2016:
- The edition is Standard or Datacenter.
- The server has an Azure subscription and the Azure Connected Machine agent, version 1.62 or later.
- The licence has Software Assurance, is a Windows Server Subscription, or is licence-included Windows from your host.
- Enrollment opened on 3 August 2026, and monthly billing in Azure starts on 13 January 2027.
"Licence-included" means your host supplied Windows under Microsoft's Services Provider License Agreement (SPLA). Such servers don't need Software Assurance for ESU, but you still need your own Azure account and the agent. Virtual machines that run inside Azure get ESU at no extra charge, per the ESU FAQ.
The Learn pages we read print no 2016 ESU price, so get a quote from the Azure Arc pricing page or your Microsoft partner. Two rules from the Windows Server 2012 programme, written in the ESU FAQ, are worth asking about for 2016: a virtual machine licensed per virtual core was billed for at least 8 cores, so a 4 vCPU VPS paid for 8, and late sign-ups were back-billed to the end-of-support date.
Our plans offer Windows Server 2019, 2022 and 2025, not 2016, so ESU for an existing 2016 server is a question for its current host. If ESU would only buy time you don't need, the same budget goes further on a replacement from our Windows VPS plans.
Can you upgrade Windows Server 2016 to 2025 in place?
Yes. An in-place upgrade installs the new Windows over the old one and keeps settings, roles and data. Microsoft's upgrade path table allows it from 2016 to all three newer versions:
| From 2016 to | From installation media | Through Windows Update | Security updates until |
|---|---|---|---|
| Windows Server 2019 | Yes | No | 9 January 2029 |
| Windows Server 2022 | Yes | No | 14 October 2031 |
| Windows Server 2025 | Yes | No, only from 2019 or 2022 | 14 November 2034 |
The jump rule explains the table. Up to Windows Server 2022, a server outside a cluster can climb at most two versions at a time. Windows Server 2025 raised that to four, so 2016 can go straight to 2025.
The same page lists the limits: no change of language, no switch between Server Core and the desktop version, no move down from Datacenter to Standard, and NIC Teaming must be turned off first. Every upgrade needs a licence for the new version, and only some cloud providers support in-place upgrades, so you have to ask yours. The in-place upgrade guide adds a restore-tested backup and a maintenance window.
Why a clean build usually wins on a VPS
- The new version's media must be mounted inside the VM, with a valid key. On a rented server both come from the host, and a 2016 licence does not cover 2022 or 2025.
- A failed upgrade leaves one broken server and a restore against the clock. A server built next to the old one has no such moment.
- Ten years of old agents, drivers and scheduled tasks stay behind.
- Users can test for days before anything changes for them, and you pick the right size at the same time.
To be fair to the other route: for one carefully configured server, on a host that supplies the media and key, with a backup you have actually restored once, an in-place upgrade straight to 2025 can be quicker.
Which Windows Server 2025 VPS to move to: version, plan and city
Windows Server 2025 is the default answer, with security updates until 14 November 2034. Pick 2022 when a program's vendor supports 2022 but not yet 2025; it is covered until 14 October 2031, although its mainstream support ended on 13 October 2026. Skip 2019, which has about two years of updates left. You choose the version at the configure step of the order.
Windows runs on VPS Mini and all three VDS plans. VPS plans have shared vCPUs; VDS plans have dedicated vCPUs, meaning the cores are yours alone. Our comparison of VPS, VDS and dedicated servers explains when that difference matters. Microsoft's hardware requirements give Windows Server 2025 with the desktop 2 GB of memory as a minimum, 4 GB recommended, and 32 GB of disk as the absolute minimum. Never give the new server less memory than the old one actually used.
| Your 2016 server today | Plan | Specs | City |
|---|---|---|---|
| One or two RDP users and one accounting program, office in Ireland or the UK | VPS Mini | 4 shared vCPU, 4 GB RAM, 80 GB NVMe, 1 Gb/s | Dublin |
| A few MetaTrader terminals or a small IIS site, users across Western Europe | VPS Mini | 4 shared vCPU, 4 GB RAM, 80 GB NVMe, 1 Gb/s | Amsterdam |
| A small domain controller for an office in Kosovo or the Balkans | VPS Mini | 4 shared vCPU, 4 GB RAM, 80 GB NVMe, 1 Gb/s | Prishtina |
| A business program with a SQL Server database, plus file shares | VDS Small | 4 dedicated vCPU, 8 GB RAM, 240 GB NVMe, 10 Gb/s | Closest to the office |
| Remote Desktop Services for a team (with RDS CALs), or a larger database | VDS Medium | 8 dedicated vCPU, 16 GB RAM, 480 GB NVMe, 10 Gb/s | Closest to most users |
| Two or three old 2016 servers merged into one | VDS Large | 16 dedicated vCPU, 32 GB RAM, 960 GB NVMe, 10 Gb/s | Closest to most users |
Unsure? Start one size smaller and upgrade later from the client area with a short reboot. Every plan has NVMe storage, unmetered traffic, its own IPv4 and IPv6, and a 99% monthly uptime SLA. Availability by city is on the plans page.
| City | Choose it when | Measured |
|---|---|---|
| Amsterdam | Users are spread across Western and Central Europe | 6.6 ms from Frankfurt, 6.7 ms from London |
| Dublin | Users are in Ireland or the UK and data should stay in the EU | Not part of our 6 October ping.pe test; the nearest of our cities for Irish users |
| Prishtina | Users are in Kosovo and the Balkans | 19 ms from Vienna; Skopje about 3 ms on our own network |
The figures are our own ping.pe measurements of 6 October 2026, the lowest of about 10 pings per probe city. Whether the Windows licence is part of the plan is shown at the configure step for the plan and city you pick; check there, or ask us before you pay. All sizes are on the Windows VPS page.
How to migrate a Windows Server 2016 VPS, step by step
This is the side-by-side method: the old server stays live the whole time, and users notice only the DNS switch.
1. Write down what the old server does
List every program, scheduled task, Windows role, shared folder, certificate and firewall rule. Note which outside services allow your server's IP address, such as banks, payment gateways, brokers and partner APIs, because the new server gets a new one. Then save the basics. These commands only read; the first four are from Microsoft's in-place upgrade guide, and none were run in our lab:
# as Administrator in PowerShell on the old 2016 server (read-only)
Get-ComputerInfo -Property WindowsProductName
Get-ComputerInfo -Property WindowsBuildLabEx,WindowsEditionID | Out-File -FilePath .\computerinfo.txt
systeminfo.exe | Out-File -FilePath systeminfo.txt
ipconfig /all | Out-File -FilePath ipconfig.txt
Get-WindowsFeature | Where-Object Installed | Out-File -FilePath roles.txtThe first line shows which Windows Server version and edition the machine runs, so you know whether the 12 January 2027 deadline applies to it. The last file lists installed roles such as File Server, IIS or Remote Desktop Services. Copy all four files off the server.
2. Order the new server and lock it down first
Choose the plan, city and Windows Server 2022 or 2025. Before installing anything, set a long password, turn on account lockout and limit RDP to your own IP, as our RDP security guide shows. Run Windows Update until nothing is left.
3. Reinstall programs and move databases
Use each program's newest installer and check that the vendor lists 2022 or 2025. Move databases with a backup on the old server and a restore on the new one, never by copying files while the service runs. Still on SQL Server 2016? Move to a supported version in the same step.
4. Copy the data
Robocopy, the copy tool built into Windows, skips unchanged files on a second run. Run it over a VPN or other private link between the servers, and never open the file-sharing port (TCP 445) to the internet. The syntax follows Microsoft's robocopy reference and was not run in our lab:
# as Administrator in a command prompt on the NEW server, pulling from the old one
mkdir C:\migration
robocopy \\OLD-SERVER\Shares D:\Shares /E /COPY:DAT /DCOPY:DAT /R:2 /W:5 /LOG:C:\migration\copy1.log/E includes all subfolders, /COPY:DAT keeps data, attributes and timestamps, and /R:2 /W:5 retries a locked file twice. In the summary at the end of the log, the FAILED column should read 0. Permissions are left out on purpose, because local accounts differ between two separate servers; in a domain, use /COPY:DATS to keep them.
5. Test, then switch
Let one or two users work on the new server for a day, by IP address or with a hosts file entry on their own PC. Test printing, exports and nightly jobs. A day before the switch, lower the TTL of your DNS records (how long other servers cache them) to 300 seconds.
On the day, stop the program on the old server, run the robocopy command again, point DNS at the new IP and update every IP allowlist. If the server sends email itself, set the reverse DNS (PTR) for its IPv4 in the client area, and ask us on Telegram to open outbound port 25, which is blocked on new servers.
6. Keep the old server for a while
Leave the 2016 server running, untouched, until a full month-end has worked on the new one, and cancel it before 12 January 2027. If RDP errors appear after the move, our list of Remote Desktop connection fixes matches each message to its cause. With Remote Desktop Services, note that 2016 RDS CALs don't license a 2025 session host; the page on the RDS grace period on Windows Server 2025 explains CAL versions.
How to replace a Windows Server 2016 domain controller
A domain controller (DC) holds Active Directory: the user accounts, passwords and group policies of a Windows network. Microsoft's upgrade guide prefers a fresh server to an in-place upgrade of a DC. Its recommended method is to promote a new server to an extra DC, move the five FSMO roles (jobs only one DC holds at a time) to it, then demote the old DC. Promotion runs the schema preparation for you.
Check the functional level first. It is a domain-wide setting that decides which Windows versions may act as DCs. A Windows Server 2022 DC still works at the Windows Server 2012 R2 level, but a Windows Server 2025 DC needs the domain and forest raised to the Windows Server 2016 level (Microsoft Learn, functional levels). The new DC also needs a private connection, such as a site-to-site VPN, to the old DC and your office. Directory ports should never face the internet. These commands are from Microsoft's guide and were not run in our lab:
# as a Domain Admin in PowerShell on a domain controller: who holds the roles (read-only)
Get-ADDomain | FL InfrastructureMaster, RIDMaster, PDCEmulator
Get-ADForest | FL DomainNamingMaster, SchemaMaster
# after the new DC is promoted and replicating: move all five roles to it
Move-ADDirectoryServerOperationMasterRole -Identity "NEW-DC" -OperationMasterRole 0,1,2,3,4NEW-DC is the name of the server that receives the roles. Run the two Get- lines again and every role should show the new server. Point clients' DNS at it, then demote the old DC. A DC can't share a server with the RD Connection Broker role, so keep brokering elsewhere.
If the 2016 server sits on your own VMware host, our VMware to KVM disk conversion guide shows how disks move across, but converting a 2016 disk only moves the 2016 problem.
Frequently asked questions
When does Windows Server 2016 support end?
Extended support for Windows Server 2016 ends on 12 January 2027, with the final monthly security update on that day, according to Microsoft's lifecycle page. Mainstream support ended on 11 January 2022. Paid Extended Security Updates can add up to three years of security fixes.
Can I keep using Windows Server 2016 after January 2027?
The server keeps working, but without ESU it gets no security updates, bug fixes or Microsoft support after 12 January 2027. On an internet-facing VPS with Remote Desktop open, every flaw found after that date stays open, and rules such as PCI DSS expect critical patches within a month.
Are there Extended Security Updates for Windows Server 2016?
Yes, for Standard and Datacenter, for up to three years. Through Azure Arc, servers outside Azure could enroll from 3 August 2026, with billing from 13 January 2027. You need Software Assurance, a Server Subscription or a licence-included Windows from an SPLA host. Virtual machines in Azure get ESU at no extra charge.
Can I upgrade Windows Server 2016 directly to 2025?
Yes. Microsoft supports an in-place upgrade from 2016 straight to 2025 with installation media, because 2025 allows jumps of up to four versions. The Windows Update route works only from 2019 or 2022. Domain controllers should be replaced, not upgraded, and the new version needs its own licence.
Is it better to upgrade in place or migrate to a new server?
On a rented VPS a new server is usually better: the old one keeps running while you build and test, a failed step costs nothing, and old leftovers stay behind. An in-place upgrade suits one carefully configured server when the host supplies media and licence and you have a restore-tested backup.
Should I replace Windows Server 2016 with 2022 or 2025?
Choose Windows Server 2025 unless a program you depend on is certified only for 2022. Microsoft gives 2025 security updates until 14 November 2034 and 2022 until 14 October 2031. Moving to 2019 is not worth the work, because its updates end on 9 January 2029.
Three patches left: start the move this week
Eighty-eight days is enough for a calm move if the new server is running by mid-November. Order Windows Server 2025 on VPS Mini or a VDS plan, copy and test while the 2016 server is still patched, and switch DNS before the holidays. Pick a size and city on our Windows VPS page. If you want help sizing the server, or want us to handle part of the move, which we quote per job, message us on Telegram.