Key points
- Extended support for Windows Server 2016 ends on 12 January 2027. After that the system receives no security updates unless the organisation buys ESU.
- Microsoft offers paid Extended Security Updates (ESU) through Azure Arc. They are a bridge for the migration period, not a long-term plan.
- An in-place upgrade from 2016 directly to 2025 is supported, but domain controllers and servers with many roles are safer to move to new, clean servers.
- New servers mean new access licences: users of a 2025 server need 2025 CALs, and terminal servers need 2025 RDS CALs.
- An unpatched server is not just a technical problem: the Polish KSC Act (NIS2) requires patch management, the KRI regulation requires reducing the risk of known vulnerabilities, and insurers ask about unsupported systems.
What end of support means
Windows Server 2016 follows Microsoft's Fixed Lifecycle Policy: 5 years of mainstream support and 5 years of extended support. Mainstream support, meaning new features and non-security fixes, ended in January 2022. Since then the system has received security updates only, and the last of them will be released on 12 January 2027.
After that date the server will not stop working. What changes is that every new vulnerability will remain in it permanently, and vendors of other software (backup, antivirus, line-of-business systems) will start dropping support for their agents on this version. Support for software running on the server often ends around the same time: SQL Server 2016 lost it in July 2026 and Exchange Server 2016 in October 2025.
| Version | End of support (security updates) |
|---|---|
| Windows Server 2012 and 2012 R2 | 10 October 2023 |
| Windows Server 2016 | 12 January 2027 |
| Windows Server 2019 | 9 January 2029 |
| Windows Server 2022 | 14 October 2031 |
| Windows Server 2025 | November 2034 |
Dates from Microsoft's product lifecycle pages. If you also run 2019 servers, include them in the plan now: that version loses support in January 2029.
Why you should not leave a server unpatched
Attackers do not need to find new vulnerabilities. Once a patch is published for newer systems, it is easy to see what changed and build an attack against versions that will not get the fix. An unpatched server on the corporate network is a typical route for ransomware to move from one infected workstation to the domain controller and the backups.
There are formal requirements too:
- the Polish KSC Act (NIS2) lists patch management among the mandatory security measures for essential and important entities,
- the KRI regulation requires Polish public bodies to reduce the risk arising from published technical vulnerabilities, and auditors will ask about unsupported systems,
- GDPR requires security measures appropriate to the risk; an unpatched system is hard to defend as appropriate after a breach,
- insurers ask about unsupported systems in cyber policy questionnaires, and an inaccurate answer can make a claim harder after an incident.
Options: what to do with each server
There is no single answer for the whole server room. The decision is made per server, depending on what runs on it:
| Option | When it makes sense | What to watch |
|---|---|---|
| New server and role migration | The default choice: domain controllers, file servers, terminal servers, servers with many roles | Needs a plan and maintenance windows, but gives a clean system without years of accumulated changes |
| In-place upgrade to 2022 or 2025 | A simple server with one application that is supported on the new version | Back up and test first; drivers and agents must support the new version |
| ESU through Azure Arc | An application that cannot be moved before 12 January 2027 because it depends on the vendor | An extra charge for every server; only a bridge for the migration period |
| Cloud or a service | A role better bought as a service, for example email or file shares in Microsoft 365 | Subscription costs and legal requirements on where data is processed |
| Decommission | A server nobody uses any more | Switch it off for a few weeks first, then remove it from the domain, DNS and backups |
Microsoft officially supports an in-place upgrade from Windows Server 2016 directly to 2025. In practice it works well on simple servers. On servers that have accumulated roles, agents and manual changes over the years, a new system and role migration usually take about as long and give a predictable result.
Domain controllers and Active Directory
We do not upgrade domain controllers in place. We build new domain controllers on Windows Server 2025, move the roles to them and only then demote the old ones. A few things need checking first:
- Domain health. Replication without errors (
repadmin /replsummary,dcdiag) and correct DNS. Migration will not fix existing problems and can make them worse. - SYSVOL replicated with DFSR. The old FRS mechanism is not supported by new domain controllers. If the domain still uses it, migrate to DFSR first (
dfsrmig). - Functional level. To add a Windows Server 2025 domain controller, the domain and forest functional level must be at least Windows Server 2016.
- Compatibility of older applications and devices. Newer versions have stricter defaults and retire old protocols. Test scanners, printers, line-of-business systems and network devices that authenticate against the domain.
The process
- A new Windows Server 2025 server joined to the domain and promoted to a domain controller with DNS and global catalogue.
- FSMO roles moved, time source configured on the new PDC emulator.
- DHCP moved if it runs on the domain controller, and DNS addresses updated in DHCP scopes and on servers with static IPs.
- A few days of observation: replication, logons, Group Policy, applications that use LDAP.
- The old domain controller demoted, and DNS and Active Directory cleaned up.
- Raising the functional level to 2025 only once all domain controllers run Windows Server 2025. This step is optional and need not be done straight away.
File servers, applications, SQL Server and terminal servers
File servers
Microsoft has a tool for this: Storage Migration Service in Windows Admin Center. It moves shares, files and permissions, and at cutover it can take over the old server's name and IP address, so users and mapped drives do not notice the change. The alternative is copying with permissions (robocopy) and a DFS namespace, so that paths do not depend on a particular server name.
Applications
The most time-consuming part is usually talking to the vendor: is the application supported on Windows Server 2022 or 2025, does it need a new version, who installs it and moves the data. Start here, because vendor lead times can be long.
SQL Server
Servers running 2016 often host SQL Server 2016, which lost support in July 2026. A server migration is a good moment to move databases to a supported SQL Server version. Check that the application supports it and test the database compatibility level first.
Terminal servers (RDS)
RDS client access licences are version-specific: a 2025 server needs 2025 RDS CALs. Build the new farm alongside the old one and move users in groups.
Hyper-V hosts
Cluster OS Rolling Upgrade, which upgrades a cluster node by node, only works one version at a time. Coming from 2016, it is usually faster to build a new 2025 cluster and move the VMs with live migration.
Licensing: what to remember
- Core licences. Windows Server 2025 is licensed by physical cores: at least 8 per CPU and 16 per server.
- Standard or Datacenter. Standard covers two Windows VMs on a licensed host (more if you add another full set of licences), Datacenter covers unlimited VMs. With a dozen or more VMs per host, Datacenter usually works out cheaper.
- Client access licences (CALs). Every user or device accessing a 2025 server needs a 2025 or later CAL. Old 2016 CALs are not enough, even if the 2016 server stays alongside.
- Software Assurance and downgrade rights. With active SA the new version may already be paid for. A 2025 licence also lets you run an older version if an application requires it.
- Other products. SQL Server, RDS and System Center are licensed separately.
Action plan and checklist
Start with a list. A single PowerShell command (Active Directory module) shows every Windows Server 2016 computer in the domain:
Get-ADComputer -Filter 'OperatingSystem -like "*2016*"' -Properties OperatingSystem, LastLogonDate |
Select-Object Name, OperatingSystem, LastLogonDate | Sort-Object NameAdd servers outside the domain, appliances with embedded Windows Server and cloud VMs by hand.
- A list of 2016 servers with roles, applications, owner and what happens if the server goes down.
- A decision for each server: new server, in-place upgrade, ESU, service or decommission.
- Confirmation from application vendors that they support the target version.
- A hardware and virtualisation check: Windows Server 2025 needs a CPU that supports SSE4.2 and POPCNT, among others, and drivers and firmware must support the new system.
- Licences purchased: Windows Server cores, 2025 CALs, and RDS CALs and SQL Server if needed.
- Backups of all servers before any change, and a restore test.
- An Active Directory health check and SYSVOL migration to DFSR if needed.
- A schedule in maintenance windows: domain controllers first, then file and print, applications last.
- For servers that will not make it before 12 January 2027: ESU and a date for moving them.
- After migration: updated documentation, monitoring and backups, old servers removed from the domain and DNS.
Frequently asked questions
Will a Windows Server 2016 server stop working on 12 January 2027?
No. The server will keep running as before, but it will stop receiving security updates. Any vulnerability discovered after that date will stay open unless the organisation buys Extended Security Updates (ESU).
Can Windows Server 2016 be upgraded straight to 2025?
Yes, Microsoft supports a direct in-place upgrade from 2016 to 2025. It works well on simple servers. Domain controllers and servers with many roles are better moved to a new, clean system.
How much do Extended Security Updates (ESU) cost?
The price depends on the number of cores and is billed through Azure Arc at Microsoft's current rates. For earlier Windows Server versions ESU were available for up to three years. They usually only make sense as a bridge of a few months for servers that cannot be moved in time.
Does moving to Windows Server 2025 require new CALs?
Yes. Users and devices accessing a 2025 server need 2025 or later CALs, and terminal servers need 2025 RDS CALs. If your CALs are covered by active Software Assurance, the right to the 2025 version is already part of your agreement.
Should we choose Windows Server 2022 or 2025?
Usually 2025: it is supported until November 2034 and has the latest security features. 2022 makes sense when an application vendor has not yet confirmed support for 2025.
Sources
- Microsoft Lifecycle: Windows Server 2016
- Microsoft Lifecycle: Windows Server 2025
- Microsoft Windows Server Blog: Windows Server 2016 end of support and ESU through Azure Arc
- Microsoft Learn: What's new in Windows Server 2025 (upgrade paths)
- Microsoft Learn: Active Directory functional levels
- Microsoft Learn: Storage Migration Service
- Microsoft Lifecycle: SQL Server 2016
Stated as at 6 November 2026. Licensing and ESU terms depend on your agreement with Microsoft; confirm them with a partner before buying.