Short answer: Windows Server 2016 reaches the end of extended support on January 12, 2027, according to Microsoft’s lifecycle page. After that date, Microsoft stops releasing security updates for it. Your options are to upgrade, isolate what cannot move, or pay for Extended Security Updates if Microsoft offers them for 2016. Until you finish, keep patching every month.
The key dates
Windows Server 2016 follows Microsoft’s Fixed Lifecycle Policy. The policy applies to the Datacenter, Essentials, MultiPoint Premium and Standard editions.
| Milestone | Date |
|---|---|
| Lifecycle start date | October 15, 2016 |
| Mainstream support ended | January 11, 2022 |
| Extended support ends | January 12, 2027 |
Microsoft notes that containers released with Windows Server 2016 follow the same lifecycle dates.
What changes after end of support
- No new security updates. Vulnerabilities found after the date stay open unless you have a paid ESU option.
- Audit findings. Many frameworks expect unsupported operating systems to be replaced or formally risk-accepted.
- Vendor support. Application vendors may stop certifying their software on 2016.
- Servers keep running. Nothing switches off. The risk grows quietly over time.
Plan for a mixed period. Most organizations will run 2016 servers next to newer versions for months. Your patch process has to cover both without extra tools or manual exceptions. Your reports should also show which 2016 servers remain, and why.
Your options
1. Upgrade or migrate
Moving workloads to Windows Server 2019, 2022 or 2025 is the long-term fix. Start with servers that face the internet or hold sensitive data. Test each application on the target version before cutover.
2. Extended Security Updates, if offered
Microsoft calls ESU a last-resort paid option and a temporary bridge, not a long-term solution. It covers Critical and Important security updates for up to three years after end of extended support.
As of this writing, Microsoft’s ESU FAQ lists Windows Server 2012/2012 R2 and Windows 10. It does not list Windows Server 2016. Check with your Microsoft account team for current availability before you plan around ESU.
For products that do have ESU, Microsoft offers it through volume licensing or Azure Arc-enabled servers. ESUs are free for eligible VMs running in Azure.
3. Isolate what cannot move
Some servers run applications that cannot be upgraded on time. Reduce their exposure. Move them into a restricted segment, remove internet access and limit inbound connections to what the application needs. Document the exception and its compensating controls.
4. Retire
Some 2016 servers host workloads nobody uses anymore. Inventory reviews often find them. Decommissioning is the cheapest fix.
Keep patching until migration is done
The months before end of support are the worst time to fall behind. Many 2016 servers will stay in service while migrations finish. Every monthly update you apply now closes a gap you would otherwise carry forward.
A practical plan for the remaining months:
- Find every 2016 server. Include VMs, physical hosts and servers in isolated segments.
- Tag by plan. Mark each server as upgrade, isolate, retire or ESU.
- Patch on a fixed cadence. Apply each monthly update in your normal maintenance window.
- Check readiness first. Fix broken update agents and connectivity before the window opens.
- Report weekly. Track patch compliance and migration progress side by side.
How JetPatch helps during the transition
JetPatch supports Windows Server 2016 alongside 2019, 2022 and 2025. One console patches old and new servers during the migration, plus your Linux and Unix servers.
You choose how Windows updates are delivered. JetPatch integrates with your existing WSUS, or replaces it with the JetPatch repository. That matters because Microsoft lists WSUS as no longer actively developed. Read about your WSUS options.
Endpoint Readiness checks every Windows server before each cycle. It checks Windows Update Agent communication, WSUS connectivity, PowerShell policy, connector health and repository configuration. Servers that fail show the specific problem and the steps to fix it.
Servers you isolate can still be patched. Offline Windows Patching delivers verified updates to air-gapped servers without giving them internet access. Each update is digital-fingerprint verified against Microsoft’s catalog before it reaches a server.
Compliance reports show patch status by OS and environment. You can export them as CSV or PDF for auditors.
Deciding which servers move first
Not every 2016 server carries the same risk. Rank them so the most exposed systems move first.
- Internet-facing servers. Web, VPN and remote access servers face the most attack traffic.
- Servers holding sensitive data. Databases and file servers with regulated or personal data.
- Identity infrastructure. Domain controllers and certificate servers affect every other system.
- Servers with easy upgrade paths. Quick wins reduce the total count early.
- Servers with blocked applications. Plan isolation and exceptions for these well before January.
Review the ranking with application owners each month. Move servers between categories as plans change.
Frequently asked questions
When does Windows Server 2016 support end?
Microsoft’s lifecycle page lists the extended support end date as January 12, 2027. Mainstream support already ended on January 11, 2022.
Will there be Extended Security Updates for Windows Server 2016?
Microsoft’s ESU FAQ does not list Windows Server 2016 at the time of writing. Confirm with Microsoft before you rely on ESU in your plan.
Will my Windows Server 2016 servers stop working?
No. They keep running. They simply stop receiving security updates, so new vulnerabilities remain unpatched.
Can I patch 2016 and newer servers from the same tool?
Yes. JetPatch patches Windows Server 2016 through 2025 from one console, with or without WSUS.
Planning your 2016 migration? Request an evaluation to keep every server patched until the last one moves.
