Tamworth-based managed IT provider Bold IT is now telling Midlands businesses to check what their servers are running before Microsoft ends support for Windows Server 2016 in January 2027. The Greater Birmingham Chambers of Commerce carried the warning. The deadline is real, and the advice to check is sound, whoever is giving it. There is also one useful detail the Chambers piece leaves out: a paid safety net now exists for Windows Server 2016. Here's what's confirmed, what it means in practice and what to do before the holidays.
The date and what stops
Microsoft's own announcement is clear: "In accordance with the Microsoft Lifecycle Policy, extended support for Windows Server 2016 will end on January 12, 2027."
You may also see 13 January quoted. That isn't a conflict. Microsoft's lifecycle page lists times in Pacific Time and gives the extended end as 13 January 2027 at 6:59:59 a.m. PT, which is effectively the close of 12 January. Microsoft's 2027 end-of-support list, its release-information table and the Chambers report all use 12 January. That day is also January's Patch Tuesday, so the final scheduled security update and the end of support fall on the same day. The Back Room Tech, citing Microsoft's release-health notice, reports that Microsoft says the January 2027 security update is the last one available for Windows Server 2016.
According to Microsoft's lifecycle documentation, once a product reaches end of support it gets no new security updates, no non-security updates, no free or paid assisted support and no further updates to online technical content.
Two things are worth knowing:
- Your server won't switch itself off. Nothing gets disabled on 13 January. As Flamingo puts it, "The servers keep running, but without ESU, security updates and Microsoft support stop, and vendors follow." The danger is that any vulnerability found from February onwards stays open on your machine.
- It covers more than the core OS. Microsoft's 2027 list includes Hyper-V Server 2016, IIS 10 on Windows Server 2016, Windows Defender for Windows Server 2016, Windows Server Update Services for Windows Server 2016 and Windows Storage Server 2016, all ending 12 January 2027. Microsoft also says containers released with Windows Server 2016 follow the same lifecycle dates. System Center 2016 components and BizTalk Server 2016 end a day earlier, on 11 January.
Microsoft's lifecycle page names four editions in scope: Datacenter, Essentials, MultiPoint Premium and Standard. Essentials is the one to watch in the SMB world, because it was sold as the small-business server.
Section summary: Support ends 12 January 2027, which is also the final Patch Tuesday for the OS. Servers will keep working after that, but they won't get fixes for newly found flaws, and related components such as WSUS, IIS 10 and Hyper-V Server 2016 go out of support with them.
How many patches are left?
Microsoft's Windows Server release-information page, updated 10 November 2026, already lists the November 2026 monthly update for Windows Server 2016 (KB5131291). The newest build is 14393.9688, from that November update; 14393.9615 was the October 26 out-of-band build. That leaves the December 2026 and January 2027 Patch Tuesdays. Think of it like a long-running TV series: you know how many episodes are left, and no spin-off is coming.
The safety net: Extended Security Updates
The Chambers piece frames the choice as an upgrade, a cloud move or a mix of the two. All three are sensible. It doesn't mention Extended Security Updates (ESU), and that's a meaningful omission.
In February 2026, Microsoft wrote: "Today, we are announcing Extended Security Updates for Windows Server 2016." It added that Extended Security Updates for Windows Server 2016 deliver an enhanced cloud experience through Azure Arc.
Here's what third-party coverage reports about how the programme works. Treat these as leads to confirm with your licensing partner, not as contract terms:
- Availability: Schneider IT Management reports that effective August 6, 2026, Microsoft made Extended Security Updates (ESUs) for Windows Server 2016 generally available through Azure Arc.
- Coverage: The same source says Critical and Important security updates stay available for up to three years after that date, and that Windows Server virtual machines hosted in Azure receive ESUs at no extra charge.
- Eligibility: The Back Room Tech reports that Arc-enabled ESUs cover Standard and Datacenter only and need Software Assurance, SPLA or a Server Subscription, with billing starts January 13, 2027. If that holds, firms running Essentials or MultiPoint Premium may not have an ESU route at all. Check this before you count on one.
Microsoft's general ESU FAQ also makes clear what ESU is not. Microsoft calls it a last-resort paid option and a temporary bridge to a supported platform. It doesn't extend the product's lifecycle, add features, fix non-security bugs or bring back technical support. For the earlier Windows Server 2012/R2 programme, the FAQ explains that customers who enrolled after the deadline were back-billed for the months they'd missed. Late enrolment doesn't save money.
Pricing is beyond what the available evidence can confirm, so ask your partner for a quote. ESU buys you time. It doesn't move you anywhere.
Section summary: Microsoft has announced ESU for Windows Server 2016, delivered through Azure Arc. Third-party reports say it covers up to three years of Critical and Important fixes, is free for Azure-hosted VMs and is limited to Standard and Datacenter. That last point matters most for small firms running Essentials.
Same month, different problem: the analogue phone switch-off
Bold IT also points out that January 2027 brings a second deadline, the end of the UK's analogue landline network. The two have nothing in common technically. Upgrading a server won't fix a burglar alarm on a copper line. But they may well land on the same person's desk.
What the official guidance says:
- A government timeline published in March 2026 states that all users of the Openreach PSTN must be migrated to new services by 31 January 2027. Separate government guidance says most customers are expected to switch by the end of January 2027 and that ISDN is also being retired.
- The government says communications providers don't know what equipment is connected to their lines. Businesses therefore need to review devices such as lift alarms, burglar alarms and card payment systems, and decide whether each needs replacing, upgrading or an adaptor.
- Digital lines don't carry power the way copper does. Handsets and routers need mains power or a battery backup to work during an outage.
- In the government's words, the old network is reaching the end of its serviceable life. It cites Ofcom figures showing 20% more PSTN incidents in 2023 than in 2022, and a 60% rise in service hours lost.
Bold IT's statement that card machines and alarm lines must move by the deadline broadly matches this guidance. The detail depends on your provider, though. Ask your provider and your equipment suppliers directly rather than assuming everything fails on 31 January.
A pre-Christmas action plan
Bold IT's managing director, Danny Leitch, sums up the company's advice: find out what you have, then get a plan in the diary before Christmas. Here's a practical version:
- Inventory every Windows server. That includes VMs and the box in the cupboard. Running
winveron Windows Server 2016 shows version 1607, OS build 14393. If you see 14393, you're affected. - Record the edition. Standard, Datacenter, Essentials or MultiPoint Premium decides whether ESU is even an option.
- Map the workloads. The Chambers report highlights files, finance systems and line-of-business software. Add domain controllers, print servers, WSUS, IIS sites and Hyper-V hosts. Ask each software vendor which server OS it currently supports.
- Choose a route for each workload.
- Move to a supported release. Microsoft's release information lists Windows Server 2025 as the current LTSC release, with Windows Server 2022 supported until 14 October 2031 and Windows Server 2019 until 9 January 2029. Check Microsoft's upgrade-path documentation before attempting an in-place upgrade.
- Rehost in Azure, where ESU is reported to be included for Windows Server VMs.
- Retire the workload entirely. Some file shares are better off in SharePoint or OneDrive.
- Buy ESU through Azure Arc as a time-limited bridge, if your edition and licensing qualify.
- Back up and test a restore before any change. A backup you've never restored is just something to hope about.
- Book a change window early. January is busy for IT, and partners' diaries fill up.
- Audit the phone lines separately. List every analogue line and what's plugged into it: alarms, payment terminals, lift phones, door entry, any fax machine still clinging on. Then contact your provider.
Weighing the messenger
The Chambers item is essentially a press release from a local IT firm, and it ends with an offer of a free server and phone-line check for Midlands businesses. That doesn't make the warning wrong. The dates match Microsoft's and the government's own documentation. It does mean you should read the free check as a sales conversation.
Steven Brazier, a partner at Bold IT, says most businesses his firm talks to don't know which server version they're running. The firm offers no survey data for that, so treat it as its experience rather than a measured figure. His other point holds up regardless: rushing a migration in February usually means buying whatever can be delivered fastest, not what suits the business.
The bottom line: Windows Server 2016 gets its last regular security update on 12 January 2027. Microsoft does sell ESU as a paid safety net, but reportedly only for some editions and only for a limited time. Check what you're running this week, and plan the phone-line migration as a separate job alongside it.
Correction (November 11, 2026): The "How many patches are left?" section originally said the newest Windows Server 2016 build was 14393.9615. That was the October 26 out-of-band build; the November 10 update (KB5131291) takes Windows Server 2016 to build 14393.9688.