Windows Server 2016 End of Support: What UK Businesses Need to Do

Windows Server 2016 reaches the end of support on 12 January 2027. That’s the date of Microsoft’s final security update for it, according to Microsoft’s end-of-support announcement, and its lifecycle page lists the end of extended support as 13 January 2027, in US Pacific time. If your business still runs a server on it, there are about three months to decide what happens next.

This post covers what end of support means, why it matters for your insurance and Cyber Essentials, the options, and a simple timeline from now to January.

What end of support means

Windows Server 2016 has been on extended support since mainstream support ended in January 2022, so it has only been getting security fixes for some time. After 12 January 2027, Microsoft says these servers “will no longer receive Windows security updates, non-security updates, bug fixes, technical support, or online technical content updates”.

The server won’t stop working. It will boot, share files and run your software as before. What changes is that any new security weakness found in Windows Server 2016 stays open.

All editions are affected: Standard, Datacenter, Essentials and MultiPoint Premium.

It’s often not the only thing on that server reaching the end. SQL Server 2016, which some business software uses for its database, reached the end of extended support in July 2026. If your accounts, case management or practice software runs on the same machine, check its version too.

The risks of carrying on

No more security updates. This is the main one. A server usually holds the files, the database or the sign-in system that everything else relies on, so a weakness in it affects the whole company.

Cyber Essentials. The current Cyber Essentials requirements say all software on in-scope devices must “be licensed and supported”, and must “be removed from devices when it becomes unsupported, or removed from scope by using a defined sub-set that prevents all traffic to or from the internet”. An unsupported server that’s part of your normal network means you can’t certify that network as it is. If clients, tenders or your insurer ask for Cyber Essentials, plan the replacement before your next renewal. Our free Cyber Essentials readiness checklist shows where else you stand.

Cyber insurance. Buying a policy can mean giving the insurer information about your security controls, and the NCSC’s cyber insurance guidance warns that “if you’re claiming that security measures are in place when they’re not, the insurer may not be obliged to pay any claims”. If you’ve told your insurer your systems are kept up to date, an unsupported server may make that answer untrue. Read your proposal form and policy conditions, and tell your insurer if things change.

Regulated data. If the server holds client or patient records, keeping it secure is part of your data protection duty, and some sectors have their own rules on top. Our regulated businesses page explains how this works for dental practices, and our post on technology trends includes a dental practice that came to us worried about Windows 10 and Windows Server 2016 reaching end of life.

Your options

1. Upgrade to a supported version of Windows Server

Microsoft recommends upgrading to Windows Server 2025, which its lifecycle page shows supported until November 2034. A server bought for Windows Server 2016 may be several years old, so this often means new hardware as well as a new version, with your data and applications moved across.

Before you choose a version, ask the supplier of each piece of software on the server which versions of Windows Server (and SQL Server, if it uses it) they support.

2. Move the work to the cloud

Files, shared folders and email can often move to Microsoft 365, into SharePoint, OneDrive and Teams, so there’s less on a server to look after. Some business software can run on a server hosted in Microsoft Azure, or the supplier may offer a hosted version of their own. Our cloud services page explains how we approach a move to Microsoft 365 and Azure.

For many small businesses the answer is a mix: files to Microsoft 365, and one application that still needs a server.

3. Extended Security Updates, as a bridge

Microsoft says that if you can’t upgrade by 12 January 2027, you can buy Extended Security Updates (ESUs) for Windows Server 2016 for up to three years. Be clear about what they are:

• They include critical and important security updates only.
• They don’t include new features, quality fixes or general technical support.
• Microsoft says the programme “is not intended to be a long-term solution but rather a temporary bridge”.

Microsoft’s announcement says pricing and availability for Windows Server 2016 ESUs are still to come, and when we checked in October 2026 its ESU FAQ didn’t list Windows Server 2016 yet. Ask your licensing provider for the price and the licences you’d need before you rely on them.

ESUs make sense when a move is planned but can’t be finished in time.

A simple timeline

• October 2026: find out what you have. List every server and what’s on it: Windows Server version, SQL Server version, the applications, who uses them and where the data lives. Check your backups.
• November 2026: decide. For each server, choose upgrade, cloud or a short ESU bridge. Ask your software suppliers which versions they support, and order any hardware and licences.
• December 2026: move. Migrate data and applications, ideally around your quieter weeks. Test that people can sign in, open files and run their software, and that backups of the new set-up work.
• 12 January 2027: the final security update. Anything still on Windows Server 2016 is unsupported from here, unless it’s covered by ESUs.
• After January 2027: finish any move that’s on an ESU bridge, retire the old server and wipe its disks, and update your answers for Cyber Essentials and your insurer.

If that looks tight, start with the list.

Getting help

If you’d like someone to look at what you have and plan the move, that’s IT consulting. If you’d rather we looked after the server, the move and everything around it from here on, see managed IT support. And if the old server fails before you’ve replaced it, our 24/7 emergency line is on 01482 274969.