Don’t forget Server 2016 dies on 12 January — this is a Q4 project, not a January one

Windows Server 2016 stops getting security updates on 12 January 2027. That is a Q4 2026 project. If you start it in January, you are already out of support while you migrate.

What’s happening

Windows Server 2016 reaches the end of its extended support on 12 January 2027. I have verified that against Microsoft’s own lifecycle page, not a summary of it. After that date there are no more security updates through normal channels. The box keeps running. It just stops being patched, and every vulnerability found from 13 January onward stays open unless you pay for Extended Security Updates or you have moved off it.

The trap is the calendar. People read \”January 2027\” and file it as a next-year problem. It is not. A domain controller, a file server, or an application host running on 2016 is not something you flip on the deadline. You size it, you test the target, you migrate, and you leave slack for the thing that always breaks. Do that work in January and you spend the migration window unpatched. Do it in Q4 2026 and you cross the line already off the old estate.

Why it bites

Unpatched Windows Server is exactly the exposure attackers scan for, and an out-of-support host is a finding in every serious audit and cyber-insurance renewal. If you are in scope for NIS2, DORA, or an ISO 27001 certification, \”we are still on Server 2016 with no ESU\” is a control gap someone will write down. The cost is rarely the licence. It is the application that only its author understood, the service account nobody can rotate, and the dependency you find at the worst possible moment.

• Who this is for:
• Anyone running a domain controller, file server, or line-of-business app on Windows Server 2016.
• IT leads whose asset inventory has not been reconciled against build versions in the last year.
• Regulated firms whose next audit or insurance renewal lands in the first half of 2027.

The one thing to do before the date

Before you plan anything, count. Run one inventory query this week that returns every Windows Server 2016 host, its role, and the applications bound to it. You cannot schedule a migration for machines you have not enumerated, and the surprise 2016 box is always the one holding a service nobody documented. From that list, decide per host: migrate to a supported server, move the workload to a managed or cloud service, or buy Extended Security Updates as a deliberate, budgeted stopgap. One decision per host, made in Q4 2026, not a scramble in January.

If the migration itself is the worry, the patching and hardening discipline you will need afterwards is worth setting up now: see my notes on automating Windows Server patching with PowerShell and on a CIS-aligned hardening baseline you can actually apply and verify. And if you want the estate looked at properly, that is what my advisory work covers.

Advisory and delivery are day-rate; a scoped migration is fixed-price once the estate is counted. No retainer to get an answer.

Advisory: if you want a second pair of eyes on the estate and the migrate-versus-ESU call before you commit budget, that is what I do. Delivery: if you have the plan but not the hands, my sister-brand build and ops capacity can run the migration alongside your team.

The date is 12 January 2027. Start it in Q4.