# Windows Server 2016 end of support: UK options

> Windows Server 2016 support ends on 12 January 2027. What that means, what Extended Security Updates cover, and five realistic options for UK small businesses.

Source: https://wharfcloud.co.uk/guides/windows-server-2016-end-of-support-uk · Last updated 21 October 2026 · WharfCloud

Published 21 October 2026. Reading time about 9 minutes.

## Short answer

Microsoft ends extended support for Windows Server 2016 on **12 January 2027**. After that date there are no free security updates. Your realistic options are: upgrade in place, rebuild on Windows Server 2025, move the workload to Linux or a SaaS product, move it to a managed server, or buy Extended Security Updates as a short bridge. Start with an inventory of what each server actually does; the right answer is often different for each one.

## The dates that matter

Table: Microsoft lifecycle dates relevant to Windows Server 2016 estates (UK dates)

| Product | Mainstream support ended | Extended support ends |
| --- | --- | --- |
| Windows Server 2016 | 11 January 2022 | 12 January 2027 |
| SQL Server 2016 | 13 July 2021 | 14 July 2026 (already ended) |
| Exchange Server 2016 | 13 October 2020 | 14 October 2025 (already ended) |

Microsoft publishes these dates in Pacific Time on its [lifecycle pages](https://learn.microsoft.com/en-us/lifecycle/products/windows-server-2016). If one of your 2016 servers also runs SQL Server 2016 or Exchange 2016, part of that server is already out of support today.

## What actually stops on 12 January 2027

Under Microsoft's Fixed Lifecycle Policy, extended support is the phase where Microsoft still ships security updates but no new features. When it ends, three things stop: security updates, non-security fixes, and Microsoft's online technical content and assisted support for that version.

Nothing switches off. The server keeps booting and your applications keep running. The risk is gradual: every vulnerability found after that date stays open, and attackers know which versions no longer get fixes.

### Why this matters more in the UK than it used to

- **Cyber Essentials.** The scheme's requirements say software on in-scope devices must be licensed and supported, and removed (or isolated from the internet) when it stops being supported. An unsupported server in scope is a fail. See the NCSC's [Cyber Essentials requirements](https://www.ncsc.gov.uk/cyberessentials/overview).
- **UK GDPR.** Article 32 requires security appropriate to the risk. The ICO's [security guidance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/) treats keeping software up to date as a basic measure.
- **Insurance and clients.** Cyber insurance proposals and client due diligence questionnaires routinely ask whether all systems are supported and patched.

## Extended Security Updates: a bridge, not a destination

In February 2026 Microsoft said Windows Server 2016 will be eligible for up to three years of paid Extended Security Updates (ESU), through 2030. ESU covers Critical and Important security fixes only, with no technical support. Through Azure Arc it is billed per core from 13 January 2027 and needs Software Assurance unless the server is licensed through SPLA or a Server Subscription. Prices, minimums and eligibility are in our [Windows Server 2016 ESU guide](https://wharfcloud.co.uk/guides/windows-server-2016-extended-security-updates).

ESU makes sense when a specific application cannot move before January 2027 and you have a dated plan to move it. It does not make sense as a way to avoid deciding.

## Your five realistic options

### 1. Upgrade in place

Microsoft's [upgrade guidance](https://learn.microsoft.com/en-us/windows-server/get-started/upgrade-overview) says that from Windows Server 2025, non-clustered servers can upgrade up to four versions at a time, so 2016 can go straight to 2025. It is the fastest route, but it carries the old server's clutter forward, needs a new licence, and is only safe when every application on the server is supported on the new version. Take a full backup and test the restore first. Our [in-place upgrade guide](https://wharfcloud.co.uk/guides/upgrade-windows-server-2016-to-2025) has the checklist.

### 2. Rebuild on a newer Windows Server

Build a clean server on a current version and move roles, data and applications across. It takes longer than an in-place upgrade but gives you a known-good server, and it is the usual choice when the hardware is also old.

### 3. Move the workload off Windows

Websites, databases such as MySQL or PostgreSQL, and many internal tools run happily on Linux, which has no per-server licence cost. File shares often fit better in a service you already pay for, such as SharePoint or Google Drive.

### 4. Replace the application

Some 2016 servers exist only to run one application whose vendor now offers a hosted (SaaS) version. Ask the vendor what they support and what moving your data involves.

### 5. Hand it to a managed provider

A managed server moves patching and monitoring off your plate permanently, so you do not repeat this exercise when the next version reaches end of support. Compare the monthly cost with your current hardware, licence and staff time, not just with zero.

## A plan you can start this week

1. **List every 2016 server.** Include virtual machines and the server under the desk in the back office. Note what it does and who would notice if it stopped.
2. **Ask the vendors.** For each application, ask the vendor which Windows Server and SQL Server versions they support. Their answer often decides the route.
3. **Pick a route per server.** Use the five options above. Mixed answers are normal: one server upgrades, one moves to Linux, one is retired.
4. **Book the work before December.** Late December and early January are the worst weeks to migrate. Aim to finish by mid-December, with ESU only for anything that genuinely cannot.
5. **Test restores and update records.** Take and test backups before each change, then update your asset register so the next end-of-support date does not surprise you.

> **How we can help** Our [Windows Server 2016 migration plan](https://wharfcloud.co.uk/windows-server-2016-end-of-support) does the inventory and route choice for up to five servers at a fixed price, and our free [migration cost calculator](https://wharfcloud.co.uk/tools/migration-cost-calculator) gives a rough figure in a couple of minutes.

## Frequently asked questions

### Will my Windows Server 2016 machines stop working on 12 January 2027?

No. They keep running, but they stop receiving security updates unless you buy Extended Security Updates.

### Can I upgrade Windows Server 2016 directly to Windows Server 2025?

Microsoft's upgrade guidance says non-clustered servers can upgrade up to four versions at a time from Windows Server 2025, which covers 2016. You need a licence for the new version and every application on the server must support it.

### Does an unsupported server fail Cyber Essentials?

Cyber Essentials requires in-scope software to be licensed and supported. An unsupported server must be removed from scope, for example by isolating it from the internet, or replaced.

### Is Windows Server 2019 a sensible target?

It is supported until January 2029, which is a short runway for a new build. If your applications support Windows Server 2025, it gives you the longest period before you need to do this again.

## Sources

- [Microsoft Lifecycle: Windows Server 2016](https://learn.microsoft.com/en-us/lifecycle/products/windows-server-2016)
- [Microsoft Lifecycle: SQL Server 2016](https://learn.microsoft.com/en-us/lifecycle/products/sql-server-2016)
- [Microsoft Learn: Plan your Windows Server upgrade](https://learn.microsoft.com/en-us/windows-server/get-started/upgrade-overview)
- [NCSC: Cyber Essentials overview](https://www.ncsc.gov.uk/cyberessentials/overview)
- [ICO: A guide to data security](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/)
- [The Register: Microsoft ESU announcement coverage (24 February 2026)](https://www.theregister.com/2026/02/24/microsoft_windows_support/)

---

WharfCloud is a trading name of Sunucu Internet Services Consultancy Ltd, registered in England and Wales, company number 12963678. Not VAT registered.
Support: engineers Monday to Friday, 08:00 to 18:00 UK time. Critical incidents: A person responds to critical incidents within 1 hour (Every day, 07:00 to 23:00 UK time). Automated monitoring and automated recovery overnight and at weekends.
Contact: hello@wharfcloud.co.uk · https://wharfcloud.co.uk/contact