Windows Server 2016 End of Support: Find Forgotten Servers Before January 12, 2027

Microsoft hasn't announced anything new here. The date has been fixed for years. What DJH Tech Partners adds is a fair point about how these deadlines tend to play out. Plenty of organisations don't know where their older servers are, or which applications, file shares and printers still depend on them.

What DJH Tech Partners is saying​

According to Marketing Derby, which published the firm's advice on November 3, 2026, DJH Tech Partners says many businesses don't have a clear picture of where their older servers are or what relies on them. The firm stresses that servers won't stop working when the deadline passes. Running an unsupported operating system still carries security and business risk that organisations need to understand and manage.

Jon Woliter, the firm's managing director, said the sensible time to start is "well before 12 January." He warned that many businesses will find a server doing a job nobody has looked at in years. He listed three possible outcomes: an upgrade, a move to the cloud, or retiring the system entirely. He also described paid extra security updates as breathing space rather than a plan.

That's sound advice. It is also advice from a company that sells IT services, so it isn't neutral. The underlying facts, though, come straight from Microsoft.

Section summary: The news is a preparedness warning tied to a confirmed Microsoft lifecycle date. It is not a new Microsoft announcement.

The dates, according to Microsoft​

Microsoft's lifecycle page for Windows Server 2016 lists these key dates:

The lifecycle policy covers the Datacenter, Essentials, MultiPoint Premium and Standard editions. Microsoft notes that containers released with Windows Server 2016 follow the same lifecycle dates. If you run 2016-based container images, they're on the same clock.

In its 90-day reminder in the Windows message center, Microsoft confirmed that the January 2027 security update will be the last one for Windows Server 2016. After that, the servers stop getting monthly security fixes. The same reminder covers a detail Essentials users can easily miss: support for Essentials-specific features, including Remote Web Access, ends on the same day. Microsoft says any Essentials feature that keeps working afterwards should be treated as unsupported.

Third-party coverage adds context. CloudServus points out a common mix-up: mainstream support ended back on January 12, 2022. What ends in 2027 is extended support, and no phase follows it. Windows Management Experts also lists System Center 2016 as ending on January 11, 2027. Shops running SCCM or SCOM from that era should check their management stack as well as the servers it manages.

Section summary: January 12, 2027 is the last update for every edition. After that, the normal security patches stop for good.

"Won't stop working" isn't the same as "safe to keep"​

DJH Tech Partners is right that nothing shuts down. A 2016 domain controller or file server will boot on February 1, 2027, just as it did the day before.

The risk builds up over time instead. Infrassist sums it up bluntly: vulnerabilities found after January 12 stay unpatched on any server without ESU coverage. Flamingo adds that the February 2027 Patch Tuesday won't include Server 2016. In practice, every Patch Tuesday after that is likely to fix flaws in newer Windows Server versions that may also exist in 2016. That gives attackers a map of where to look.

This is general industry experience rather than a claim in DJH Tech Partners' advice: unsupported servers often cause compliance and insurance problems before they get breached. An auditor or cyber-insurance questionnaire asking about unsupported operating systems doesn't care whether the box is still running fine.

Extended Security Updates: real, but limited​

Readers searching for this topic may find conflicting answers about whether Windows Server 2016 gets Extended Security Updates (ESUs) at all. Some third-party pages written in early or mid-2026 said no ESU program had been announced. Flamingo's guide, for example, stated that as of late September 2026, Microsoft has not announced an Extended Security Update (ESU) program for Server 2016. An AI-generated answer on Microsoft's own Q&A forum from January 2026 said the same.

Microsoft's current documentation says otherwise. Its Azure Arc guidance confirms that ESUs exist for Windows Server 2016 Standard and Datacenter editions. They provide Critical and Important security updates for up to three years, through 2030. Windows Management Experts reports that Microsoft announced ESU for Windows Server 2016 in February 2026, delivered through Azure Arc with subscription billing for on-premises servers. Rely on Microsoft's own documentation, not older blog posts.

According to Microsoft, these are the limits:

• Editions: Only Standard and Datacenter are covered. Microsoft's ESU material doesn't list Essentials or MultiPoint Premium. Small businesses on Essentials should assume they have no bridge.
• Scope: Security fixes only. Microsoft says ESUs don't include new features, customer-requested non-security hotfixes, or design changes.
• Licensing: Buying ESUs generally requires Software Assurance through volume-licensing programs such as Enterprise Agreement, Enterprise Agreement Subscription, Enrollment for Education Solutions, Server and Cloud Enrollment, or Microsoft Open Value. Machines licensed through SPLA or a Server Subscription don't need Software Assurance.
• Cost trajectory: CloudServus warns that three years is the ceiling, and you pay double every year you stay. Get licensing quotes before you build a budget on that.
• Late enrollment: Infrassist reports that customers who enroll late are back-billed to January 12, 2027, the end-of-support date. Waiting until March doesn't save you January and February.

So Woliter's "breathing space" description is accurate. Microsoft itself treats ESUs as a way to finish a move, not to put one off indefinitely.

Section summary: ESUs exist for 2016 Standard and Datacenter, but they cover security fixes only, come with licensing conditions, and get more expensive the longer you stay.

What Azure Arc ESU enrollment actually involves​

For on-premises servers, Microsoft's documented route is Azure Arc. Its preparation guidance includes these requirements:

1. Install the Azure Connected Machine agent, version 1.62 or higher for Windows Server 2016 ESUs, to connect each server to Azure.
2. Enroll the servers through the Azure portal or with Azure Policy. Microsoft says the portal then shows ESU coverage and enrollment status, which helps you spot gaps.
3. Check network connectivity. Arc supports public endpoints, proxy servers, and Private Link or ExpressRoute. Microsoft publishes a reduced list of endpoints for servers that use Arc only for ESUs, including the Entra ID sign-in endpoints and an intermediate-certificate endpoint for ESU updates.
4. Make sure the required certificate authorities are present. Microsoft lists four Azure RSA TLS Issuing CAs (03, 04, 07 and 08) and says they can be downloaded and installed manually if needed.
5. Keep your patching pipeline configured. Microsoft says enrolling in ESUs makes a server eligible for the patches but doesn't deliver them. You still need to configure updates from Microsoft Update or WSUS. Azure Update Manager or another patching tool can then deploy them.

There are two more exceptions worth noting. Microsoft says not to use Arc to deliver ESUs to VDI virtual machines; use Multiple Activation Keys instead. Azure VMware Solution machines and VMs on Azure Local get ESUs free and shouldn't enroll through Arc.

Microsoft says enrolled servers get free access to Azure Update Manager, Change Tracking and Inventory, and Azure Policy guest configuration. That's useful, and it also pulls customers further into Azure. Organisations should decide for themselves whether that suits their wider strategy.

A practical way to run the project before January​

DJH Tech Partners' main point is to find out what you have before you choose a fix. A workable sequence, based on that advice and Microsoft's edition-specific rules, looks like this:

• Inventory: Find every Windows Server 2016 instance, physical, virtual or in a container. Record the edition, because Essentials and MultiPoint Premium have no ESU path.
• Map dependencies: Note what each server does, who owns that work, and what connects to it upstream and downstream. This is how you find the "server doing a job nobody has looked at for years."
• Sort: Put each server into one of four groups: upgrade, migrate, retire, or temporarily keep under ESU with a firm exit date.
• Test: Microsoft recommends Windows Server 2025 as the current LTSC release and offers a free 180-day evaluation for compatibility testing. Applications and hardware still need checking server by server. Windows Management Experts notes that most organizations end up using all three, server by server, meaning upgrade, ESU and Azure.
• Schedule: Leave room for maintenance windows, verified backups and rollback plans. The Christmas holidays fall in the middle of this timeline.

One caveat on upgrades: Microsoft's newer option to upgrade in place through Windows Update applies to Windows Server 2019 and 2022 moving to 2025. Microsoft doesn't list 2016 for that route, so expect 2016 servers to need traditional media-based upgrades or migrations.

The bottom line​

This is a familiar deadline with a new twist. Windows Server 2016 does have a paid ESU option, which wasn't clear for much of 2026, but it only covers Standard and Datacenter and comes with licensing conditions. Small businesses on Essentials have no bridge at all. Everyone else has until January 12 to decide which servers move, which get retired, and which get a temporary, time-limited extension.

DJH Tech Partners' warning comes from a firm that sells this kind of work, but the advice holds up. Finding the forgotten servers is the slow part, and it needs to start well before January 12.