Windows Server 2016 end of support: options for UK small businesses

Microsoft publishes these dates in Pacific Time on its lifecycle pages (opens in a new tab). If one of your 2016 servers also runs SQL Server 2016 or Exchange 2016, part of that server is already out of support today.

Under Microsoft's Fixed Lifecycle Policy, extended support is the phase where Microsoft still ships security updates but no new features. When it ends, three things stop: security updates, non-security fixes, and Microsoft's online technical content and assisted support for that version.

Nothing switches off. The server keeps booting and your applications keep running. The risk is gradual: every vulnerability found after that date stays open, and attackers know which versions no longer get fixes.

Why this matters more in the UK than it used to

• Cyber Essentials. The scheme's requirements say software on in-scope devices must be licensed and supported, and removed (or isolated from the internet) when it stops being supported. An unsupported server in scope is a fail. See the NCSC's Cyber Essentials requirements (opens in a new tab).
• UK GDPR. Article 32 requires security appropriate to the risk. The ICO's security guidance (opens in a new tab) treats keeping software up to date as a basic measure.
• Insurance and clients. Cyber insurance proposals and client due diligence questionnaires routinely ask whether all systems are supported and patched.

In February 2026 Microsoft said Windows Server 2016 will be eligible for up to three years of paid Extended Security Updates (ESU). Reporting at the time, such as The Register's (opens in a new tab), noted that ESU covers security fixes only, with no technical support, and that Microsoft had not yet published a price for Windows Server.

For earlier Windows Server versions, ESU was sold yearly and priced as a share of the licence cost. Check Microsoft's current licensing terms before you rely on it. ESU makes sense when a specific application cannot move before January 2027 and you have a dated plan to move it. It does not make sense as a way to avoid deciding.

1. Upgrade in place

Microsoft's upgrade guidance (opens in a new tab) says that from Windows Server 2025, non-clustered servers can upgrade up to four versions at a time, so 2016 can go straight to 2025. It is the fastest route, but it carries the old server's clutter forward, needs a new licence, and is only safe when every application on the server is supported on the new version. Take a full backup and test the restore first.

2. Rebuild on a newer Windows Server

Build a clean server on a current version and move roles, data and applications across. It takes longer than an in-place upgrade but gives you a known-good server, and it is the usual choice when the hardware is also old.

3. Move the workload off Windows

Websites, databases such as MySQL or PostgreSQL, and many internal tools run happily on Linux, which has no per-server licence cost. File shares often fit better in a service you already pay for, such as SharePoint or Google Drive.

4. Replace the application

Some 2016 servers exist only to run one application whose vendor now offers a hosted (SaaS) version. Ask the vendor what they support and what moving your data involves.

5. Hand it to a managed provider

A managed server moves patching and monitoring off your plate permanently, so you do not repeat this exercise when the next version reaches end of support. Compare the monthly cost with your current hardware, licence and staff time, not just with zero.

1. 01

   List every 2016 server

   Include virtual machines and the server under the desk in the back office. Note what it does and who would notice if it stopped.

2. 02

   Ask the vendors

   For each application, ask the vendor which Windows Server and SQL Server versions they support. Their answer often decides the route.

3. 03

   Pick a route per server

   Use the five options above. Mixed answers are normal: one server upgrades, one moves to Linux, one is retired.

4. 04

   Book the work before December

   Late December and early January are the worst weeks to migrate. Aim to finish by mid-December, with ESU only for anything that genuinely cannot.

5. 05

   Test restores and update records

   Take and test backups before each change, then update your asset register so the next end-of-support date does not surprise you.