Windows Server 2016 support ends January 12, 2027: what to upgrade, what to move, and when ESUs make sense

Microsoft stops sending security fixes for Windows Server 2016 on January 12, 2027, eleven weeks from now. Extended Security UpdatesdefinitionMicrosoft's paid way to keep getting Critical and Important security fixes after support ends. For Windows Server 2016 you can buy up to three years of it, and then it stops. can cover a server for up to three more years if you pay, and you shouldn't expect Azure to make them free this time. Get a list of every 2016 server this week and give each one a path and a date. Then read on for the domain controller and cluster problems that can wreck an upgrade weekend.

Mainstream support for 2016 ended back in January 2022, so these servers have been on security fixes alone for almost five years. January takes those away too. After that Microsoft says there are no new security updates, no other fixes, no assisted support (free or paid) and no updates to the online docs. If something breaks on a 2016 box in February, nobody at Microsoft will pick up the case for you.

The money side changed this year. With Windows Server 2012, ESUs were free for VMs in Azure, which made a lift into Azure an easy way to buy time. On April 1, 2026 Microsoft moved new ESU offerings to one list price wherever the server runs and however you buy. Its Azure Local page names Windows Server 2016 as falling under that pricing. So the old trick of moving to Azure for free patches isn't something to put in a 2027 budget.

Windows Server 2016 doesn't go alone. Several products built on it share the date, and some of them sit on servers nobody thinks of as "Windows Server projects". Check this list against your inventory, because the forgotten WSUS box or Hyper-V Server host is usually what turns up in the next vulnerability scan.

Read that table before you pick a target. A 2016 server that goes to 2019 is back in this same meeting in January 2029. Going to 2022 buys until 2031, but it's already past mainstream support, so it gets security fixes and not much else. 2025 runs to 2034, and for most servers that can make the jump, it's the one to pick.

Treat this as a choice for each server, not one decision for the estate. A file server, a domain controller, a SQL box and a vendor app host each have a different best answer. Most estates end up using four or five of the paths below, with ESUs kept for the few servers that really can't move in time.

If you do buy ESUs, there are two routes. Through Azure ArcdefinitionMicrosoft's tool for managing servers that sit outside Azure, in a company's own data center or another cloud. The inventory costs nothing, and it's how you buy 2016 ESUs month by month. you pay monthly per core, nobody juggles product keys, and the servers also get Azure Update Manager and Change Tracking at no charge. You'll need the Connected Machine agent at version 1.62 or later. Through Volume Licensing you buy one year at a time, and Microsoft's ESU rules say years two and three can only be bought after the years before them. We couldn't find a published 2016 ESU price in Microsoft's docs, which send buyers to their partner or account team, so get a quote per core before anyone assumes it's cheap.

Windows Server 2025 loosened the rules. A standalone server can now jump up to four versions at once, so 2016 goes straight to 2025 without a stop at 2019 or 2022. The catch is how you start it. Windows Update only offers 2025 to servers already on 2019 or 2022, so a 2016 box needs the installation media mounted and setup run by hand.

Setup also enforces a few rules that catch people on the night. You can't switch between Server Core and Desktop Experience during the upgrade. You can move from Standard up to Datacenter, but never down. Storage Server editions can't be upgraded in place at all. NIC Teaming has to be turned off first, and every upgraded server needs its own 2025 licence, unlike Windows client upgrades.

When the "Keep personal files and apps" option is greyed out, setup is telling you the pair doesn't match. Microsoft's upgrade rules exclude a language change, a switch between Core and Desktop Experience, upgrades to evaluation copies and a downgrade from Datacenter to Standard. Admins on Server Fault add two more from the field: an OEM install paired with ROK media, and an ISO that was simply bad. An evaluation domain controller can't be converted in place at all, so it gets replaced by a new retail one.

Domain controllers are where 2016 projects most often stall, and it's usually because of FRS. Windows Server 2016 is the last version that supports the old File Replication Service for SYSVOL. Plenty of domains first built on 2003 or 2008 still use it, even when every domain controller runs 2016. Try to promote a 2019, 2022 or 2025 domain controller into one of those domains and setup refuses, telling you to migrate to DFS Replication with dfsrmig first.

There's a trap in the other direction too. Microsoft documents a code defect: upgrading a 2016 domain controller in place to 2019 doesn't enforce that block. Run the DFSRdefinitionDFS Replication copies SYSVOL, where logon scripts and Group Policy files live, between domain controllers. It took over from FRS, and FRS doesn't work past Windows Server 2016. migration afterwards and the upgraded domain controllers get stuck in the Start phase, SYSVOL and NETLOGON stop being shared, and clients can't find a domain controller. Microsoft's fix is to demote those servers, migrate on the older ones and promote them again. Migrate SYSVOL while the 2016 domain controllers are still in charge, and avoid that whole cleanup.

If FRS is already unhealthy, fix it before you migrate. One Server Fault thread from August describes three 2016 domain controllers at the 2008 functional leveldefinitionThink of it as the oldest Windows Server version a domain or forest still has to allow for. Raising it switches on newer features and shuts out older domain controllers., with the role holder in an FRS journal wrap error and SYSVOL missing on another server. The advice there was an authoritative FRS restore first. Then there's the functional level: a 2025 domain controller isn't supported in a domain or forest below the Windows Server 2016 level. Raise each domain first and the forest last, and remember that raising the forest needs Enterprise Admin rights.

# First, what's actually installed? The edition matters for ESUs and upgrades
PS> Get-ComputerInfo -Property OsName, OsVersion
# SYSVOL replication: Eliminated means DFSR is done; an error or Start means FRS is still in play
PS> dfsrmig /getglobalstate
# Raise these first if they're low, or the new domain controller won't promote
PS> (Get-ADDomain).DomainMode
PS> (Get-ADForest).ForestMode
# Running an old Arc build? Upgrade it to 1.62 or later before you enroll in 2016 ESUs
PS> azcmagent version

Clusters don't get the four-version jump. Cluster OS Rolling UpgradedefinitionMicrosoft's way of upgrading a failover cluster one node at a time while it keeps serving. It only moves one Windows Server version per pass. moves one version per pass, so a 2016 Hyper-V cluster reaches 2025 in three rounds, through 2019 and 2022, and Microsoft wants each round finished within four weeks. Two more things bite on the way. VMs with a configuration version older than 8.0 won't run on 2022 or later, and Hyper-V switches bound to LBFO teams have to be rebuilt first. For many clusters a new 2025 cluster with the VMs moved across is the shorter road, and Microsoft lists it as the alternative.

If you'd like help, our cloud engineers can build the server inventory with you, pick a path per server and run the upgrades, rebuilds and Azure moves in your change windows. For domain controllers we handle the SYSVOL migration and functional levels with your identity team, and our Microsoft Entra ID engineers pick up the hybrid identity side. See how we run cloud migrations and ongoing server management, or start with an assessment of what's still on 2016.