Windows Server 2016 end of support (Jan 12, 2027): what to do
Extended support for Windows Server 2016 ends January 12, 2027. How to find every 2016 server, keep them patched until the end, decide upgrade, Extended Security Updates, or retire, and prove where each one stands.
Microsoft's lifecycle policy ends extended support for Windows Server 2016 on January 12, 2027 (Microsoft Windows Server blog). Mainstream support already ended in January 2022. After the end date there are no more security updates unless you buy Extended Security Updates (ESU) for the machines that need them.
For most teams the hard part is not the decision for any one server. It is knowing exactly which servers are on 2016, keeping them patched until the last day, and showing an auditor where each one ended up.
Step 1: find every 2016 server#
Asset spreadsheets are always out of date. Ask the machines. With an agent on every server you can list them by what they report about themselves (OS name and version, domain, roles), not by what a spreadsheet says.
Group them by what blocks an upgrade:
- In-place upgrade candidates: standard roles, supported hardware or hypervisor, no vendor lock to 2016.
- Application-bound: a vendor product certified only on 2016.
- Retire: servers nobody can name an owner for.
Step 2: keep them patched until the end#
The last few months are not the time to fall behind. Patch 2016 servers on the same rings and windows as the rest of the fleet, and watch pending updates per machine so a stuck server is caught early.
Step 3: decide per group#
| Group | Typical decision |
|---|---|
| Upgrade candidates | In-place upgrade or rebuild on Windows Server 2022 or 2025 |
| Application-bound | ESU for a defined period, with a dated plan to move |
| No owner | Shut down, wait, then retire |
Step 4: prove it#
Auditors will ask which servers were on 2016, what happened to each, and whether any ran unpatched after the date. A per-machine record of OS version, patch runs, and decisions answers that in minutes.
How Gardience helps#
Gardience is a supported console on open-source Salt that manages Windows Server 2016 to 2025, Windows 10 and 11 and major Linux distributions:
- Inventory from the machines themselves: OS and version, domain membership, BitLocker, .NET, local admins, disk and last boot, so you can group every 2016 server in one view.
- Patching with pending updates per machine, pilot and broad rings, change windows, and reboots handled.
- A scored STIG/CIS-aligned baseline that keeps rebuilt 2022 and 2025 servers hardened from their first day.
- A tamper-evident audit log and a signed evidence pack showing what was patched, upgraded, or retired, and when.
Questions#
When does Windows Server 2016 support end?#
Extended support ends on January 12, 2027, under Microsoft's lifecycle policy. Some Microsoft pages show January 13 because they use UTC.
What happens to 2016 servers after that date?#
They keep running, but they stop receiving security updates unless covered by Extended Security Updates.
Should we upgrade in place or rebuild?#
Rebuild where you can, especially for servers that have accumulated years of changes. Upgrade in place where a rebuild is impractical, and harden the result against the same baseline as new servers.
Try Gardience on your own machines
One supported console for Windows and Linux on open-source Salt: patching, a scored STIG/CIS-aligned baseline, drift repair, event-driven automation, two-person approval and a tamper-evident audit log. Flat yearly pricing, not per node.
Free 90-day trial (25 nodes)See it work Compare