Every Windows Server release has a support lifecycle, and for Windows Server 2016 that lifecycle ends on 12 January 2027, as Microsoft’s Windows Server blog confirmed in February 2026. Nothing breaks on the day. The servers keep running, and the applications on them keep working. What stops is the flow of security patches from Microsoft, so any vulnerability found after that date stays open on every Windows Server 2016 machine still in service.
For a large enterprise, the date is a planning problem more than a technical one. A migration is not just moving a server. Each application on it has to be confirmed as supported on the new version, and each change needs a maintenance window the business agrees to. A server with many dependencies needs more planning than a standalone one, and starting late leaves little room for any of it.
This guide follows the work in the order it happens: finding every Windows Server 2016 instance, choosing a path for each one, and sequencing the move. It also covers what the Personal Data Protection Act means for servers that hold personal data.
What Happens to Windows Server 2016 on 12 January 2027?
According to Microsoft’s 2026 guidance, security updates for Windows Server 2016 stop on 12 January 2027, when extended support ends. Servers keep running, but every new vulnerability stays unpatched unless the organization buys ESU.
Microsoft’s February 2026 guidance names three paths: upgrade to Windows Server 2025, buy ESU through Azure Arc, or migrate workloads to Azure. Microsoft’s ESU page adds that ESU in Azure runs for three more years and that classic ESU through Volume Licensing is bought in yearly increments. Neither page states a price, so request a quote from your Microsoft account team before you set a budget.
How Do You Find Every Windows Server 2016 Instance?
Start with a complete inventory of the physical hosts, virtual machines and cloud instances that run Windows Server 2016. A server nobody knows about misses the migration, then runs unpatched once extended support ends in January 2027.
Follow these steps:
- Export records from your tools. Pull server lists from the hypervisor, the configuration management database (CMDB), the patch tool and the monitoring system, then compare them for gaps.
- Scan the network. Run an authenticated scan across every server subnet, because test, branch and forgotten servers rarely appear in the CMDB.
- Record the details. Note the operating system edition, roles, applications, owner, hardware age, dependencies and whether the server holds personal data.
- Rank by business impact. Score each server by the cost of an outage and the sensitivity of its data, so the riskiest servers move first.
What Are the Options for Each Server?
Each Windows Server 2016 machine ends in one of five outcomes: in-place upgrade, migration, a move to Azure, ESU or retirement. The right outcome depends on the application, the hardware and the time left before the January 2027 deadline.
| Option | What it does | Use it when |
|---|---|---|
| In-place upgrade | Installs Windows Server 2025 over the existing operating system and keeps settings, roles, features and data | The hardware supports Windows Server 2025 and the application vendor confirms support |
| Migration | Moves roles or features from the old server to a different destination server | New hardware is due, or roles need to be split across servers |
| Move to Azure | Runs the workload on Azure instead of an on-premises server | The workload suits cloud hosting, or a hardware refresh is coming |
| ESU | Provides security updates after 12 January 2027, for three more years in Azure or through Azure Arc for on-premises servers | The application cannot move before the deadline |
| Retirement | Decommissions the server and its data | The application is no longer used |
Source: Microsoft’s upgrade overview, ESU page and 2026 guidance describe the options. The “Use it when” column is our assessment.
We treat ESU as a bridge for servers that cannot move in time. ESU buys security updates but leaves the old operating system in place, so give every server on ESU a migration date.
Which Windows Server Version Should Replace It?
Windows Server 2025, the upgrade target in Microsoft’s 2026 guidance, has mainstream support until November 2029 and extended support until November 2034, according to Microsoft’s lifecycle page. A Windows Server 2016 machine can upgrade in place directly to Windows Server 2025.
Microsoft’s upgrade overview lists the supported paths and limits. Starting with Windows Server 2025, nonclustered systems can upgrade up to four versions at a time, while Windows Server 2022 and earlier allow two. Cluster rolling upgrades move one version at a time. The same page says a direct upgrade to Windows Server 2025 works from Windows Server 2012 R2 and later.
We recommend migration for servers with years of accumulated configuration and an in-place upgrade for stable, single-purpose servers. The application vendor’s support statement has the final say.
How Do You Plan an Enterprise Migration?
A Windows Server 2016 migration plan runs in six steps, from scope to decommissioning, and each step needs an owner and a completion check. Work backward from the January 2027 deadline so the highest-risk servers move first.
- Freeze the scope. List every server from the inventory, assign each one an option from the table above and get the application owner’s sign-off.
- Check application compatibility. Ask each vendor whether the software is supported on Windows Server 2025, then test the application on a lab copy.
- Back up and prove the restore. Take a full backup of each server and test a restore before any change, so a failed upgrade can be rolled back. Our guide to disaster recovery testing covers restore tests.
- Sequence the waves. Move low-risk servers first to prove the method, then move the high-priority servers in planned maintenance windows. Keep ESU for any server that cannot finish before the deadline.
- Cut over and validate. Move the workload, test logins, integrations and performance, and keep the old server offline for a rollback period.
- Decommission and document. Remove the old server from monitoring, patching and backup jobs, wipe its disks and update the CMDB.
Cloud migration assesses application dependencies, maps them to the target platform, transfers the data, then validates and tests the result. Server management patches each new build on a schedule so the migrated servers stay current.
What Are the Common Mistakes?
Four mistakes derail a Windows Server 2016 migration: an incomplete inventory, untested backups, an unchecked application and ESU treated as a permanent fix. Each has a direct fix.
- Missing servers. Test and branch servers outside the CMDB keep running unpatched. Fix: scan the network and compare the results with the CMDB.
- Skipping the restore test. A backup that has never been restored is an assumption. Fix: restore a full copy to a lab before the cutover.
- Assuming the application will run. Older line-of-business software may not support Windows Server 2025. Fix: get written confirmation from the vendor and test on a lab copy.
- Treating ESU as the plan. ESU adds cost and keeps the old operating system. Fix: set a migration date for every server on ESU.
What Does Malaysian Data Protection Law Mean for Server Upgrades?
The Security Principle in section 9 of the Personal Data Protection Act 2010 (PDPA) now binds data processors as well as data controllers. Under the Amendment Act 2024, contravening a principle carries a fine of up to RM1,000,000, imprisonment of up to three years, or both.
The Data Protection Report said in January 2025 that the higher penalty and the processor changes take effect on 1 April 2025. The Personal Data Protection Commissioner’s principles page says the Security Principle requires organizations to protect data from misuse, modification and access by unauthorized parties.
In our view, a server that no longer receives security updates is harder to defend as a practical step to protect personal data. Move the servers that hold personal data first, and delete or archive data on retired servers under your retention policy. Our guide to the PDPA explains all seven principles. This is general information, not legal advice.
How Can Callnet Help?
We manage servers, networks, firewalls and virtual desktops through server and network management, including server configuration, migration and patch management, and data backup and disaster recovery. For workloads moving to Azure or another cloud, we handle enterprise cloud migrations.
Book a free consultation for a system audit of your Windows Server estate.
