Windows Server 2016 gets its last free security update on 12 January 2027. Unlike the 2012 generation, Microsoft has already said there will be paid updates for three more years, to January 2030, but has not said what they cost. For a 5 to 20 person NZ firm the real question is why the server still exists, rather than whether to buy them. Files, printing and logins are already in the Microsoft 365 you pay for. The one application left on the box is the decision, and it is usually a database migration, not a server purchase.
The dates
| Milestone | Date | What it means |
|---|---|---|
| Mainstream support ended | 11 January 2022 | No new features or non-security fixes |
| Microsoft 365 Apps support on this server ended | 14 October 2025 | Office on a 2016 terminal server is security-only until 10 October 2028 |
| Extended support ends | 12 January 2027 | Last free security update |
| ESU years 1 to 3 | January 2027 to January 2030 | Announced February 2026; Critical and Important fixes only; price not yet published |
From Microsoft's lifecycle pages and the Windows IT Pro blog announcement; every related date is on the end-of-support dates page.
Why the ESU is the wrong purchase for most small firms
Extended Security Updates are a bridge for organisations that cannot move a workload in time. A 200-server estate needs a bridge. A firm with one server that does files, printing, logins and a job database does not; three of those four jobs are already included in Microsoft 365 Business, and the fourth is a migration project with a fixed price. If the 2012 R2 pricing repeats (100% of the licence price per year, on-premises), three years of ESU costs more than retiring the server, and at the end of it you still have to do the migration. Buy the ESU only if the application genuinely cannot move before January 2027 and the server is exposed enough to matter.
The four options, and what has changed since 2012 R2
The options and the prices are the same table as the Windows Server 2012 R2 post: retire into Microsoft 365, upgrade in place to Windows Server 2025 (supported to November 2034), new hardware, or an Azure virtual machine. Two things are different this time. There is a paid ESU, so a firm that misses January 2027 is not immediately unpatched, provided it pays. And a 2016 server is more likely to be running something that is still supported, a SQL Server 2019 or a current vendor product, in which case an in-place upgrade to 2025 is a sane answer rather than a stopgap. The test is unchanged: walk over and read the installed-programs list.
If the application is a database
Most 2016-era small-firm servers run one: a SQL Server instance under an Access front end or a bespoke app. That is the migration into SharePoint lists or Dataverse, $8,000 to $18,000 for a firm under 20 staff, three to eight weeks, and afterwards no server to patch at all. Moving a SQL Server database into Microsoft 365 has the decision and the costs; the migration hub has the mechanics per source. If the SQL Server on it is 2016 or Express, read the SQL Server 2016 post too, because that clock ran out on 14 July 2026. If it is an Access front end instead, Access 2016 and 2019 are out of support too, and the fix is usually the same migration.
A realistic timeline from today
- This month: inventory the server and take a tested, restored-somewhere-else backup.
- By November: decide retire, upgrade or migrate, with a price against it.
- December to January: move files and logins to Microsoft 365 if they are not there already; start the application migration.
- By 12 January 2027: either the server is off, or the ESU is bought as a deliberate bridge with an end date.
Common questions
When does Windows Server 2016 go out of support?
Extended support ends on 12 January 2027, so that is the last free security update. In February 2026 Microsoft announced Extended Security Updates for Windows Server 2016 for up to three years after that date, so paid Critical and Important fixes run to January 2030. Pricing had not been published as at September 2026.
Is there ESU for Windows Server 2016?
Yes, announced February 2026, three years, price not yet published. On past form (Windows Server 2012 R2 was 100% of the licence price per year on-premises, free in Azure) it will be a real annual cost for a small firm. For most 5 to 20 staff businesses the money is better spent leaving the server than renting three more years of it.
Microsoft 365 Apps on Windows Server 2016: still supported?
Support for Microsoft 365 Apps (Word, Excel, Outlook) on Windows Server 2016 ended on 14 October 2025. Microsoft continues security updates for the apps on that server until 10 October 2028, with feature updates frozen. If the server is a terminal server running Office, the clock started a year ago.
What should a small NZ firm do with a Windows Server 2016 box?
The same four options as the 2012 R2 generation: retire it into Microsoft 365, upgrade in place to Windows Server 2025, replace the hardware, or move it into an Azure virtual machine. The one application the server runs decides which. If it is a SQL Server or Access system, that is a migration into SharePoint or Dataverse at $8,000 to $18,000 for a firm under 20 staff.
Not sure what the server runs?
Send me a photo of the installed-programs list. One free 30-minute call and you know which of the four options you are in and what it costs, and whether the ESU is worth buying as a bridge.