What the date changes
Nothing stops on 12 January 2027. The server boots, the files open, the application runs. What stops is the stream of security updates: Microsoft’s lifecycle for Windows Server 2016 ends extended support on that day, and every vulnerability found afterwards stays open on that machine, for good.
That turns a working server into a growing exposure, and into a finding. Cyber insurers ask whether you run systems the vendor no longer supports, and price the answer. Clients’ due-diligence questionnaires ask the same. Firms under rules on ICT risk are expected to retire what the vendor no longer maintains. An unsupported server on the network is the kind of thing an auditor writes down first, because it is the easiest thing to find.
It also changes how an incident plays out. A server that cannot be patched is the one an attacker goes for once inside, and the one your insurer will ask about afterwards. The date is not when the risk starts; it is when the risk stops being deniable.
Where a 2016 server usually still is
In firms with 30 to 150 people, the servers that reach this age tend to be the ones nobody touches because they work:
- the file server, often the oldest machine in the building, with ten years of matters, projects or client files on it
- the domain controller, which holds every account and password and decides who may sign in
- an application server for the firm’s own software: practice management, the document system, accounting, time recording, a CAD licence server
- a print server, a terminal server people connect to from home, a backup target
- a server that only exists to run one old thing: a scanner workflow, a fax gateway, a database somebody built years ago
The first step is not a decision but an inventory: which servers run 2016 or older, what runs on each, and what depends on it. The dependencies matter more than the list. A file server is easy to replace until you find the application that writes to a share on it by its old name.
The three ways out
Retire the server
Move what it does to where it belongs, and switch it off. Files go to SharePoint, organised by matter, client or project. Identity goes to Microsoft Entra ID, with the on-premises domain kept only where an application still needs it, or retired entirely once nothing does. Print goes to a cloud print service. The application goes to the vendor’s hosted version where there is one, and most practice and accounting vendors have one by now.
For a firm that already works in Microsoft 365, this is the cheapest way in the long run: there is no server left to patch, back up or replace in another seven years, and no licence to renew for it. It is also the way that changes most for the people, so it needs a plan for the files above all: what moves, what is archived, what is deleted, and who decides.
Replace it
A new Windows Server 2025, on your own hardware or as a virtual machine in Azure, and the roles moved across. This is the way when the application has to stay a server: a licence server for CAD software that checks a machine name, practice software that only runs on Windows Server, a database the vendor won’t host, a scanner that only speaks to a local share.
Two things decide the cost here. One is the licence: Windows Server is licensed per core, with client access licences on top, and a server that was bought in 2016 with its hardware rarely has paperwork that transfers cleanly. The other is the hardware: a server that has run for ten years should not get a new operating system on the same disks. In Azure the hardware question disappears, and the licence can come with the virtual machine.
Bridge it
Microsoft offers Extended Security Updates for Windows Server 2016, delivered through Azure Arc, which means the server is registered with Azure and receives its updates from there even if it stays in your building. They are paid, and they are a bridge, not a destination: for the one workload that cannot move before January, while the move is planned and dated. A server on Extended Security Updates still counts as unsupported in most questionnaires; it buys time, not a clean answer.
Upgrade in place, or move?
The question comes up with every server, so the answer up front: moving the roles to a fresh server is almost always the better path. An in-place upgrade from 2016 to 2025 carries ten years of settings, drivers and leftovers into the new system, and if it fails halfway you have neither the old server nor the new one. A fresh server with the roles moved across can be tested next to the old one, and the old one stays until the new one has run for a few weeks.
The exception is the small, single-purpose server whose software the vendor will reinstall anyway. There an in-place upgrade can be the quickest route, with a full backup and a tested restore before it starts.
What is on the server besides Windows
The operating system is rarely the only thing reaching its end. Check what runs on it:
- An old SQL Server under the practice software or the accounting system has a lifecycle of its own, and the application may need a newer version anyway.
- Exchange Server on the same machine, if the firm never moved mail to Microsoft 365, is the first thing to move, because it is exposed to the internet.
- The domain’s functional level, if the server is the last domain controller, limits what a new one can do until it is raised.
- Certificates, scheduled tasks, scripts and printer drivers that nobody has looked at since the server was built. They are the things that break on day one after a move.
How we would run it
- Inventory and dependency map: what the server does, what talks to it, which backups cover it, who uses it at which hours.
- One decision per role, not one for the server: files retire, the application is replaced, print moves, the domain is kept or retired.
- A tested restore before anything is touched. A move you cannot undo is not a move.
- The new server or the new place built next to the old one, and each role moved and tested while the old server still runs.
- The change itself in a window that avoids your deadlines: filing dates, tender submissions, month-end, the week an audit is due.
- Hypercare for the weeks after, with the old server switched off but not yet wiped, so a forgotten dependency can be switched back on in minutes.
- The old server wiped and documented, and the new one in your evidence file: what runs where, who holds the admin accounts, when it was last patched, when the backup was last restored.
The questions to ask now
Whoever runs your IT should be able to answer these this week:
- Which of our systems run Windows Server 2016 or older, and what runs on each?
- What is the plan and the date for each one?
- What happens to our backups during the move, and has a restore been tested?
- Who holds the admin accounts on the new server, and where is that written down?
- What will the insurer’s questionnaire say about our servers in February?
If the answers are vague, the date is not the first problem to solve.
If January is too close
Start with exposure, not with size: a server reachable from the internet (remote desktop, VPN, a web application, mail) moves first, then the domain controller, then the rest. Isolate what cannot move yet so that it talks only to what it must: no internet access, no sign-in from the outside, no admin accounts that are also used elsewhere. Buy the bridge for that one workload, and put the move on the plan for the first quarter with a date and a name next to it.
Questions we get
Does the server stop working on 12 January 2027?
No. It keeps running exactly as before. It stops receiving security updates, which is a different kind of problem: invisible on the day, and growing every month after it.
We only use the server as a file server. Is that still a risk?
Yes, and often the biggest one. The file server holds the data an attacker wants, and ransomware is written for exactly this kind of machine. It is also the server that is easiest to retire, because SharePoint and OneDrive do its job without a server at all.
Can we just buy Extended Security Updates and leave it?
You can, for a limited time and a price, and only through Azure Arc. It keeps the updates coming; it does not make the server supported in the eyes of an insurer or a client, and it does not make the hardware younger. Treat it as the bridge for a workload that cannot move yet, with the move dated.
How long does a move take?
For a firm of this size, from inventory to the old server switched off, usually a few weeks of calendar time with a few days of actual work, most of it in the planning and the testing. The move itself is often one evening or one weekend. What stretches it is an application whose vendor has to be involved, or files that nobody has decided about.
Does this apply to Windows Server 2019 too?
Not yet: Windows Server 2019 is supported until January 2029. But a firm that moves a 2016 server now should look at its 2019 servers in the same project, because the work is the same and the next date is closer than it looks.