Microsoft's extended support for Windows Server 2016 ends on 12 January 2027. Mainstream support already ended in January 2022; since then the product has received security fixes only. After January 2027, even those stop for anyone without a paid Extended Security Updates agreement.
Why this matters
An operating system without security updates does not fail on day one. It fails the first time a serious vulnerability is published and attackers start scanning for servers that cannot be patched. For businesses that handle payments or personal data, running an unsupported system is also a compliance problem: most security standards require supported, patched software.
Your options
- Upgrade in place to Windows Server 2019, 2022 or 2025. Fastest, but carries over years of configuration drift.
- Build a fresh server on Windows Server 2022 or 2025 and migrate the workload. More work, but you start clean and can test before you switch.
- Move the workload off Windows where it makes sense, for example a website that only needs PHP or a database that runs equally well on Linux.
- Buy Extended Security Updates as a bridge, if an application truly cannot move in time.
A practical plan
- Inventory every Windows Server 2016 machine, including the ones nobody remembers setting up.
- List what runs on each: applications, roles, scheduled tasks, certificates, service accounts.
- Check that each application supports the target version. Ask vendors early.
- Build the new server alongside the old one and test with real data.
- Switch over during a quiet window, keep the old server for rollback, then retire it.
Starting a year ahead leaves room for the vendor who replies slowly and the dependency nobody documented.
How IDX can help
IDX VPS Windows plans include Remote Desktop (RDP) access, and our dedicated servers are built to your specification, with the Windows Server version you choose. If you would rather not run the project yourself, our migration team plans and moves workloads with downtime kept to a minimum.
IDX on digital infrastructure
Back to blog →