Windows Server 2016 End of Support: Upgrade paths, ESU and domain controller planning

Windows Server 2016 stops receiving security updates on 12 January 2027, and many estates still run it on domain controllers, file servers, line of business application hosts and Hyper-V clusters. After that date every newly found vulnerability stays open unless the server is enrolled in paid Extended Security Updates (ESU), which Microsoft now delivers for this release through Azure Arc. This guide sets out the official dates as Microsoft publishes them, what else ends on the same day, how to find every affected server and the identities tied to it, the in-place upgrade and migration paths to Windows Server 2022 or 2025, what changes for Active Directory and functional levels, and how to test and roll back. It is for infrastructure, Active Directory and vulnerability management leads. Lifecycle models and the general upgrade, extend or isolate decision are covered in the Operating System End of Life and Extended Support Guide; this page goes deeper on Server 2016 only.

This is an independent guide from NHI Mgmt Group, based on Microsoft's public documentation as of November 2026. It is not sponsored or reviewed by Microsoft. Product features change, so confirm settings against Microsoft's current documentation.

Key takeaways

• The date is 12 January 2027. Microsoft's 2027 end of support list gives 12 January 2027 for Windows Server 2016 under the Fixed Lifecycle Policy; mainstream support already ended in January 2022.
• More than the OS ends that day. Hyper-V Server 2016, IIS 10 on Server 2016, .NET Framework 4.6.2, WSUS for Server 2016 and Windows Storage Server 2016 share the date, and System Center 2016 components end on 11 January 2027.
• ESU exists, but through Azure Arc. Microsoft documents Critical and Important security updates for up to three years, through 2030, with billing starting 13 January 2027 and Connected Machine agent 1.62 or later required.
• Server 2025 can take a 2016 box in one step. From Windows Server 2025, nonclustered systems can upgrade up to four versions at a time, but cluster rolling upgrades still move one version at a time.
• Replace domain controllers, do not upgrade them. Microsoft recommends promoting new DCs on a clean install and demoting the old ones; Windows Server 2025 DCs need at least the Windows Server 2016 functional level and DFSR for SYSVOL.

What is changing and why

Windows Server 2016 follows Microsoft's Fixed Lifecycle Policy: five years of mainstream support followed by five years of extended support. Extended support, the phase that delivers security updates, is the one now ending. Microsoft's end of support pages state that once a product reaches end of support there are no new security updates, non-security updates, free or paid assisted support options, or online technical content updates. The only route to further security fixes is ESU, which is a paid, time-limited bridge and covers security updates rated Critical and Important only.

The lifecycle record applies to the Datacenter, Essentials, MultiPoint Premium and Standard editions, and Microsoft notes that containers released with Windows Server 2016 follow the same dates. That last point matters for teams that still build on windowsservercore or nanoserver images tagged for the 2016 release (version 1607): the image base goes out of support with the host OS.

Official timeline and current status

All dates below were taken from Microsoft's own lifecycle and documentation pages, checked on 8 November 2026. Microsoft can change ESU terms, so recheck the Azure Arc ESU page before committing budget.

Products ending on the same day: Microsoft's 2027 list also includes Hyper-V Server 2016, IIS 10 on Windows Server 2016, Microsoft .NET Framework 4.6.2, Windows Defender for Windows Server 2016, Windows Server Update Services for Windows Server 2016, Windows Storage Server 2016, Windows Azure Pack on Server 2016, HPC Pack 2016 and Configuration Manager LTSB version 1606. If your patch infrastructure is a WSUS server on 2016, the tool you use to patch everything else is itself going unsupported.

Microsoft 365 Apps on Server 2016: Microsoft's Office and Windows configuration matrix shows full support for Microsoft 365 Apps on Server 2016 ended in October 2025, with security updates for the desktop apps continuing until 10 October 2028 to help migration. Remote Desktop Session Hosts on 2016 therefore have two clocks, covered in the companion Office 2016 and 2019 End of Support guide.

ESU through Azure Arc: what Microsoft documents

• Delivery: servers must be Azure Arc-enabled with the Azure Connected Machine agent at version 1.62 or higher; the licence is created and linked in the Azure portal.
• Editions: Standard and Datacenter are supported for Server 2016 ESU.
• Licensing: Software Assurance is required when ESU is bought through Volume Licensing (EA, EAS, EES, SCE or Open Value); servers licensed through SPLA or a Server Subscription do not need it.
• Connectivity: outbound HTTPS to Microsoft endpoints such as login.microsoftonline.com, *.his.arc.azure.com and *.guestconfiguration.azure.com, or Private Link; a reduced endpoint set is allowed when Arc is used only for ESU.
• Not confirmed here: pricing and whether Server 2016 VMs hosted in Azure receive ESU at no extra charge. Microsoft's ESU overview and FAQ still describe the free Azure entitlement for Server 2012 and 2012 R2 only, so do not assume it carries over without written confirmation.

Arc enrolment makes every ESU server a managed cloud resource with a local agent and a machine identity in your tenant. Treat that as a security change in its own right. See the Azure Arc-Enabled Servers Security Guide.

Who and what is affected

Windows Server 2016 Essentials and MultiPoint Premium deployments fall under the same lifecycle record. Small organisations with a single Essentials server running AD, file shares and backup often have the hardest migration, because every role sits on one box.

Finding affected systems and identities

Inventory is where most end of life programmes fail, because the server list in the CMDB is not the server list on the network. Use at least three sources and reconcile them.

1. Directory query: list computer objects whose operatingSystem attribute contains "2016" and whose operatingSystemVersion shows build 14393, with lastLogonTimestamp and servicePrincipalName to separate live servers from stale objects. PowerShell Get-ADComputer with those properties is enough; this reads data and changes nothing.
2. Endpoint and patch tools: export OS version from your EDR, Configuration Manager or Intune, and vulnerability scanner. A server missing from all three is either decommissioned or unmanaged, and both need confirming.
3. Virtualisation and cloud: pull guest OS fields from hypervisor inventory and from cloud VM images, including marketplace images and golden images still tagged 2016.
4. Containers: search registries and build files for base images tagged 1607 or ltsc2016.
5. Network evidence: scanners that fingerprint SMB and RDP will find workgroup servers that never joined the domain.

Identities tied to each server

For every server, record the non-human identities that run on it, because a migration that copies them unchanged also copies their risk.

• Service accounts: domain accounts used by Windows services, IIS application pools and scheduled tasks. Note which have SPNs (Kerberoastable) and which hold Domain Admin or local admin rights. See How to find service accounts with Domain Admin.
• Stored credentials: passwords in scheduled tasks, connection strings and web.config files that will move with the application.
• Computer accounts and delegation: servers configured for unconstrained or constrained delegation; the replacement should not inherit unconstrained delegation.
• Certificates: machine and web server certificates, their templates and private key exportability.

The upgrade window is the cheapest point to convert service accounts to group managed service accounts. See the Group Managed Service Accounts (gMSA) Guide and How to convert AD service accounts to gMSA.

Migration options

In-place restrictions Microsoft lists: no change of language, no switch between Server Core and Desktop Experience, no upgrade from Windows Storage Server editions, no upgrade when booting from VHD, NIC Teaming must be disabled first, and each upgrade needs a valid licence for the target version. Edition can move up (Standard to Datacenter) but never down. Not every role supports in-place upgrade, so check the role migration matrix for each server.

Domain controllers and functional levels

• Method: Microsoft recommends clean installs promoted as new DCs, then demoting the 2016 DCs, rather than in-place upgrades. Promotion runs adprep /forestprep and /domainprep automatically; an in-place upgrade requires running them manually with Schema, Enterprise and Domain Admin rights.
• Functional level floor: a Windows Server 2025 DC is not supported at the 2012 R2 functional level, so domains and forests must be at Windows Server 2016 level before you introduce 2025 DCs.
• SYSVOL: the 2016 functional level requires DFSR for SYSVOL replication, and Windows Server 2016 is the last release that supports FRS. Any domain still on FRS must migrate first.
• 2025 functional level: it requires every DC to run Windows Server 2025 and adds the optional 32k database page feature. Raise it only after the last 2016, 2019 and 2022 DCs are gone; raising functional levels is largely one way.

Harden the new DCs from day one rather than copying old GPOs. See the AD Domain Controller Hardening Guide.

Testing and rollback

1. Pilot ring: pick three to five low-risk servers covering your common roles and upgrade them first. Record time taken, failures and application owner sign-off.
2. Snapshot or backup first: for VMs take a checkpoint and a backup; for physical servers take a bare-metal backup. A checkpoint is not a backup and must not be kept for long on production.
3. Application test scripts: agree with each owner a short functional test (log on, run a transaction, run a report) before the change, and run it before and after.
4. Domain controllers: introduce new DCs, let replication settle, check with repadmin /replsummary and dcdiag, move FSMO roles, then demote. Rollback is to move roles back while the old DCs still exist, so do not demote all 2016 DCs on the same day.
5. Clusters: keep the cluster functional level at the old version until every node is upgraded and validated; the rolling upgrade can be reversed only before the functional level is raised.
6. Rollback triggers: define them in advance (application test fails, authentication errors, replication errors) and the decision owner.
7. ESU fallback: for servers that miss the date, enrol in Arc and test ESU licence activation before 12 January 2027, not after.

Risks of doing nothing

• Permanent exposure: any vulnerability published after January 2027 stays exploitable. Public facing servers face exploitation of public-facing applications (ATT&CK T1190) and internal ones exploitation of remote services for lateral movement (T1210).
• Compliance findings: NIST SP 800-53 SA-22 (Unsupported System Components) requires replacing components without vendor support or justifying and documenting alternative support; CIS Controls v8.1 Safeguard 2.2 requires that authorised software is currently supported. Auditors and cyber insurers ask about both.
• No vendor help: no paid assisted support for incidents on unsupported systems, unless ESU is in place.
• Blocked dependencies: new versions of agents, backup software and line of business applications drop 2016 support, so security tooling coverage decays even before an exploit appears.
• Identity blast radius: an unpatched 2016 DC or a server running a Domain Admin service account turns a single exploit into domain compromise.

Detection, metrics and framework mapping

Until the last server is gone, monitor the 2016 estate more closely than the rest: alert on new logons by privileged accounts, new services and scheduled tasks, and outbound connections from servers that should not initiate them. See the Active Directory Security Monitoring and Event IDs Guide.

• Remaining 2016 servers by role and owner, trending to zero, reported weekly.
• Percentage of 2016 servers with an approved plan (upgrade date, ESU or risk acceptance).
• ESU-enrolled servers with confirmed licence activation and patch compliance.
• Service accounts migrated to gMSA during upgrades, and privileged service accounts removed.
• Unknown servers found by network scanning but missing from the CMDB.

Practitioner checklist

• Reconcile directory, endpoint, hypervisor and network inventories into one list of every Server 2016 instance, including Essentials, Hyper-V Server and container base images.
• Assign an owner, role and decision (upgrade, migrate, ESU, isolate) to each server before 12 January 2027.
• Confirm application vendor certification for Server 2022 or 2025 before choosing in-place upgrade.
• Replace 2016 domain controllers with new 2022 or 2025 DCs; confirm DFSR for SYSVOL and the Windows Server 2016 functional level first.
• Plan WSUS, System Center 2016 and AD CS replacements, since they end on or before the same date.
• For servers that will miss the date, Arc-enable them, check agent version 1.62 or later and test ESU activation in advance.
• Inventory service accounts, stored credentials and delegation on each server and convert service accounts to gMSA during the move.
• Pilot, back up, run owner test scripts and keep old DCs until replication and FSMO moves are verified.
• Record risk acceptances with an expiry date and compensating controls for any server left unsupported.

Standards and references

• Microsoft Learn: Windows Server 2016 lifecycle
• Microsoft Learn: Products reaching end of support in 2027
• Microsoft Learn: Prepare to deliver Extended Security Updates for Windows Server through Azure Arc
• Microsoft Learn: Windows Server upgrade overview
• Microsoft Learn: Upgrade domain controllers to a newer version of Windows Server
• Microsoft Learn: Active Directory functional levels
• NIST: SP 800-53 Rev. 5, Security and Privacy Controls
• CIS: Critical Security Controls v8.1

Related NHI Mgmt Group resources: Operating System End of Life and Extended Support Guide · SQL Server 2016 End of Support · Exchange Server 2016 and 2019 End of Support · Technology End of Life Policy Template · Patch Management Guide