Opens in a new tab
A black server tower with multiple drive bays sits in a modern office environment, visible desks, computer monitors, and plants in the background.

Windows Server 2016 Support Ends January 12, 2027: A Plan for Orlando Offices Still Running It

By Jason Russell · October 2, 2026

If your office has a server in a closet that went in around 2016 or 2017, there is a good chance it runs Windows Server 2016. Windows Server 2016 end of life arrives on January 12, 2027, the day Microsoft releases its last regular security update for it. The next morning the server will boot, your staff will log in, and nothing will look different. That is what makes this deadline easy to miss, and why I am writing about it in October instead of December.

If you start the week of October 5, you have 14 weeks: enough to do this properly, not enough to spend a month deciding whether to start. Below is the plan I would follow for a 15 to 75 person office in Orlando, Lake Mary, Winter Park, or anywhere else in Central Florida, including what Microsoft’s paid extension costs, who can buy it, and what the deadline means for compliance and insurance. If you went through the Windows 10 deadline last October, the logic is the same, except this machine holds everyone’s data.

A disclosure before you start

Harmony MSP replaces servers and moves workloads to the cloud, so this deadline is good for our business. Read this with that in mind. Where the cheaper answer is to do less, such as retiring a server instead of replacing it, I will say so. The plan works the same whether you do it yourself, with your current IT provider, or with us.

What Windows Server 2016 end of life actually changes

Microsoft’s end-of-support list puts the end of extended support for every edition of Windows Server 2016, including Standard, Datacenter, and Essentials, on January 12, 2027. Mainstream support ended in January 2022, so for almost five years your server has received security updates and nothing else. January 12 is also Patch Tuesday, so that day’s release is the last one Server 2016 gets without a paid extension.

Here is why that matters. In October 2025, attackers began exploiting a critical flaw in Windows Server Update Services, a patching role many offices run on a server. Microsoft shipped an emergency fix for every affected version, 2016 included, and CISA added the flaw to its catalog of known exploited vulnerabilities. The next flaw like it, found after January 12, will be patched in Windows Server 2019, 2022, and 2025, but not 2016, and the fix for the newer versions can show attackers exactly where to look in the older one.

Verizon’s 2026 Data Breach Investigations Report found that exploiting a vulnerability was the most common initial access route in the breaches it analyzed, at 31 percent, the first time it has passed stolen credentials in the report’s history. That is a global dataset covering organizations of every size, so it is not your odds as a small office. It is the direction attackers are moving, and an unsupported server can never be fully patched again.

What else is probably running on that server

In a 25-person office, a 2016 server rarely does one job, and several of its passengers have deadlines of their own.

  • SQL Server 2016. Many practice management and accounting applications store their data in SQL Server, and SQL Server 2016 reached end of life on July 14, 2026. Ask your vendor which version you run.
  • Microsoft 365 Apps on a Remote Desktop server. Microsoft ended support for Microsoft 365 Apps on Windows Server 2016 on October 14, 2025, and security updates for them stop on October 10, 2028.
  • Exchange Server 2016. If you still host your own email, Exchange 2016 left support on October 14, 2025. That problem is already here.
  • Active Directory. If the server is your domain controller, it holds every login, and that role has its own upgrade rules.
  • The quiet jobs. File shares, printing, backups, scanning, door access or phone software, and the virtual machine nobody has opened in two years.

Write all of it down. Good IT asset documentation turns a stressful migration into a checklist.

The 14-week plan for Orlando offices

If you start the week of October 5, here is how the calendar breaks down. The goal is to finish before the holidays and keep January as a buffer.

Weeks Dates What gets done
1 to 2 Oct 5 to Oct 16 Inventory every server and virtual machine running Windows Server 2016
2 to 4 Oct 12 to Oct 30 Get written answers from your software vendors and book their migration help
4 to 6 Oct 26 to Nov 13 Decide where each workload goes, approve the budget, order hardware and licenses
7 to 11 Nov 16 to Dec 18 Build, migrate one workload at a time, and test (skip Thanksgiving week)
12 to 13 Dec 21 to Jan 1 Cutovers only if your office is closed and your vendors will answer the phone
14 Jan 4 to Jan 12 Retire the old server, isolate anything that could not move, decide on ESU

Weeks 1 and 2: Inventory everything running 2016

Record each server’s edition (Standard, Datacenter, or Essentials), how the license was bought, its roles and applications, its SQL Server version, and its hardware age and warranty date. The license details decide whether Microsoft’s paid extension is even available to you.

Weeks 2 through 4: Get your software vendors on the record

Ask each vendor, in writing, which Windows Server and SQL Server versions they support, whether they support Windows Server 2025, and whether they will migrate your data. Book their help now. Every office with a 2016 server is working against the same date, and vendors schedule migrations weeks out.

Weeks 4 through 6: Decide by workload, not by server

This is where money gets saved or wasted. Do not ask what replaces the server. Ask where each job it does should live next.

Workload Usual best destination
Domain controller A new Windows Server 2025 domain controller, or Microsoft Entra ID if nothing on site still needs Active Directory
File shares SharePoint and OneDrive for everyday documents; an on-site server for very large files or application data
Practice management, accounting, or tax database Whatever your vendor supports: a new server, the vendor’s hosted version, or a cloud server
Remote Desktop server A new Windows Server 2025 host, or Windows 365 or Azure Virtual Desktop, which Microsoft recommends for running Microsoft 365 Apps
Print, scan, and utility roles Retire or consolidate

Sometimes, once files move to SharePoint and logins move to Entra ID, the only thing left is one application whose vendor offers a hosted version, and the server simply goes away. That outcome makes us the least money, and it is often the right one.

Windows Server 2025 upgrade in place, or a new build?

Microsoft supports upgrading a non-clustered server directly from 2016 to 2025. That is reasonable for a member server on hardware that is under warranty and certified by its manufacturer for 2025. It is a poor bet on a machine that is eight to ten years old, so check the manufacturer’s support list first. Not every role upgrades in place, either. Microsoft’s role matrix does not support it for print services and recommends against it for domain controllers, so you build a new domain controller, let it replicate, and retire the old one. Your domain and forest must already be at the Windows Server 2016 functional level before it can join.

Why 2025 and not 2022

You want the longest runway you can buy. Windows Server 2019 reaches end of support in January 2029, and Windows Server 2022 in October 2031. Windows Server 2025 is supported into November 2034. Buy 2025 unless a vendor you depend on has not certified it, and if one requires an older version, ask your reseller about downgrade rights before buying an older license.

What the budget has to cover

Owners budget for the server and get surprised by everything around it. Plan for:

  • Hardware. TrendForce expects server memory contract prices to keep rising every quarter through the second half of 2027, so waiting for a better price is not a strategy this year.
  • Server licenses. Microsoft’s suggested price for Windows Server 2025 Standard is $1,176 per 16 cores, covering the server plus two virtual machines.
  • Client access licenses. Microsoft’s terms let a CAL access its own version of Windows Server or earlier ones, so 2016 CALs do not cover a 2025 server. A 2025 Remote Desktop host also needs 2025 RDS CALs.
  • Labor. Vendor migration fees and the hours for the move itself.

Weeks 7 through 11: Build, migrate, and test

Test a restore from your backup before you touch anything. Hurricane season runs through November 30, so a tested off-site copy matters more than usual during a fall migration in Central Florida. Build the new environment beside the old one and move one workload at a time, on evenings or weekends, with a written way back. Test what people actually do: print a report, scan a document, open last year’s files, log in from home. Every migration turns up a mapped drive or scanner profile nobody documented. Finding it in November beats finding it on January 13.

Weeks 12 through 14: Holidays, then the buffer

Use the holiday weeks for cutovers only if your office is closed and your vendors confirm they will answer the phone. In early January, confirm nothing still points to the old server, keep it powered off for a short rollback window, then wipe or destroy its drives properly. Anything that genuinely cannot move gets isolated on the network and becomes a candidate for the paid extension.

Windows Server 2016 Extended Security Updates: the bridge, the price, and the catch

If you cannot finish before Windows Server 2016 end of life, Microsoft does sell a bridge. In February 2026 it announced Extended Security Updates (ESU) for Windows Server 2016, delivered through Azure Arc, its service for managing on-premises servers from the Azure portal. Configuration opened on August 3, 2026, and billing starts January 13, 2027. ESU provides Critical and Important security updates for up to three years, through 2030, with no new features or non-security fixes.

Microsoft’s current list price for Windows Server 2016 ESU, Standard edition, is $0.007132 per core per hour. For a physical server at the 16-core minimum, that is about $83 a month, or roughly $1,000 a year, and Datacenter runs about $480 a month. A virtual machine licensed by virtual cores has an 8-core minimum, so about half that. Compare that with the $1,176 suggested price for a Windows Server 2025 Standard license: about 14 months of ESU costs as much as the new license, and at the end you own nothing.

The catch for small offices:

  • Eligibility. For on-premises servers, Microsoft requires Software Assurance through a volume licensing program, or an equivalent server subscription. Most small offices I work with bought Windows Server with the hardware, and those licenses typically do not carry Software Assurance, so you would have to buy qualifying licenses first.
  • Editions. Microsoft lists only Standard and Datacenter as eligible. If you run Windows Server 2016 Essentials, plan on replacing it.
  • Setup. Each server needs the Azure Arc agent, version 1.62 or later, an Azure subscription, and outbound access to Microsoft.
  • Hardware. ESU patches Windows, not a nine-year-old power supply.

ESU fits one situation: a single application whose vendor cannot support anything newer by January, on a server that qualifies. Treat it as a dated bridge with a written exit plan.

What the deadline means for compliance and insurance in Florida

None of these rules says you can never run unsupported software. They say you must identify risks, act on them reasonably, and be able to prove it. An unpatchable server makes all three harder.

Medical and dental practices

The HIPAA Security Rule already requires an accurate risk analysis. OCR’s guidance on legacy systems says they belong in that analysis, and that your risk management plan should cover how you will reduce their risk and, where possible, when you will retire them. The larger Security Rule update proposed in January 2025 is still not final, and its target has slipped to July 2027, but today’s rule still applies. Tracking legacy systems is a standing part of our IT support for medical and dental practices.

CPA and tax firms

The FTC Safeguards Rule requires vulnerability assessments at least every six months unless you run continuous monitoring, and after January 12 an unsupported server will show findings you cannot fix on every one. Timing matters too. The IRS opened the 2026 filing season on January 26, after January 27 in 2025 and January 29 in 2024, so support ends about two weeks before filing season usually opens. For CPA and accounting firms, the real deadline is mid-December.

Law firms

The comment to Florida Bar Rule 4-1.1 says competent representation includes safeguarding confidential client information, electronic communications included, and understanding the risks of the technology you use. An unpatchable server holding client matters is hard to square with that duty, and it is one of the first things we check when we take on IT support for a law firm.

Every Orlando business: state law, card payments, and insurance

Florida’s breach law, section 501.171, requires reasonable measures to protect personal information stored electronically, and known unpatchable software makes “reasonable” harder to argue. If the server touches card payments, PCI DSS Requirement 12.3.4, mandatory since March 31, 2025, requires an annual review of whether your technology still gets vendor security fixes and a management-approved plan for anything that does not. Finally, cyber insurance applications commonly ask whether you run software its manufacturer has retired and, if so, whether it is segmented from the rest of your network and disconnected from the internet. Answer that question accurately.

What this plan does not fix

A new operating system is not a security program. Here is what this plan does not fix:

  • Your biggest everyday risks. Weak passwords, missing multi-factor authentication, and untested backups were your biggest risks before January 12, and they will be after it.
  • Disruption. Even a well-run migration means a few evenings of downtime and a few first-week surprises.
  • Cost. The cloud is not automatically cheaper. It trades a purchase for a monthly bill and makes your internet connection more important.
  • Backup assumptions. Files in Microsoft 365 are not backed up the way most owners assume.
  • The next deadline. Windows Server 2025 reaches end of support in November 2034. Put that refresh on the calendar now.

Frequently asked questions about Windows Server 2016 end of life

Can I still use Windows Server 2016 after January 12, 2027?

It will keep running, but it stops receiving security updates unless it is enrolled in Extended Security Updates, which cover Standard and Datacenter editions for up to three years and require Software Assurance or an equivalent subscription. Otherwise, every vulnerability found after that date stays open.

Can I upgrade Windows Server 2016 directly to 2025?

Yes, on non-clustered servers, but not for every role. Microsoft recommends against it for domain controllers and does not support it for print services, and it only makes sense on hardware that is under warranty and certified for 2025. Confirm with your software vendors first.

Should we choose Windows Server 2022 instead of 2025?

Usually not. Windows Server 2022 reaches end of support in October 2031, and Windows Server 2025 is supported into November 2034. Choose 2022 only if a vendor you rely on has not certified 2025.

The short version

Windows Server 2016 end of life is a fixed date. Find every server running it, ask your vendors what they support, decide where each workload should live, and finish before the holidays. Treat Extended Security Updates as a narrow, dated bridge, and only after you confirm you qualify.

Harmony MSP provides IT support in Orlando and across Central Florida from our office in Lake Mary. If you are not sure what is still running on Windows Server 2016 in your office, call us at (407) 720-6540. We will help you build the inventory and the plan, with no pressure either way, whether or not we end up doing the work.

Sources

Our latest posts