A plain-English guide for Australian businesses to the end of support for Windows Server 2016 on 12 January 2027. Explains what happens on the date (no more security updates unless you pay for Extended Security Updates), why running an unsupported, internet-facing server is a serious risk and a common ransomware entry point, and the four options: move to the cloud (Microsoft 365 and Azure, often retiring the last on-prem server entirely, recommended for most), upgrade to Windows Server 2025, buy ESU as a paid security-only stopgap for up to three years, or do nothing. Frames the deadline as the natural moment to ask whether you need a physical server at all, and funnels to cloud migration planning.
Windows Server 2016 end of support: your January 2027 deadline
On 12 January 2027, Windows Server 2016 stops getting security updates. If there is an ageing server humming away in a cupboard at your office, this is your prompt to decide its future, and maybe whether you need one at all.
The short version
Windows Server 2016 reaches end of support on 12 January 2027. After that, no more security updates unless you pay for Extended Security Updates. An unpatched server is a favourite target for attackers.
This is a decision, not just an upgrade. For many businesses, Server 2016 is the last on-prem box, and this deadline is the natural moment to move to the cloud and be done with server hardware for good.
With six months or more of runway, there is time to do it properly. Rushed server migrations are where data goes missing. Planned ones are quietly uneventful, which is exactly what you want.
What happens on 12 January 2027
On that date, Windows Server 2016 reaches the end of its extended support. Microsoft stops shipping the monthly security updates that keep it safe. The server does not switch off, and everything on it keeps running exactly as before, which is precisely why this deadline is so easy to ignore until it becomes a problem.
There is a paid escape hatch, Extended Security Updates, which keeps critical patches coming for up to three more years. But it costs money, it climbs in price each year, and it covers security only. It is a bridge for businesses that genuinely cannot move in time, not a destination.
This is the last big server end-of-life for a while. If you clear it properly, you are not staring down another one of these deadlines any time soon. That makes it worth doing right rather than just kicking down the road.
Why an old server is dangerous
A server is not like a laptop tucked in a drawer. It is usually on all the time, often reachable from the internet, and it tends to hold the crown jewels: shared files, databases, line-of-business applications, sometimes the identity that everything else logs into. That combination is exactly what attackers look for.
Once security updates stop, every newly discovered flaw in Server 2016 stays open permanently, and automated scanning tools find exposed, unpatched servers within hours. An out-of-support server is one of the classic footholds for the kind of attack we describe in our ransomware deep dive. Leaving one running past January 2027 undoes a lot of good work elsewhere.
Your options, honestly compared
There are four ways forward. Only two of them are real destinations.
Move to the cloud
For a lot of businesses, Server 2016 is the last box in the cupboard. File shares move to SharePoint and OneDrive, apps move to Azure or their cloud versions, and identity moves to Entra. No more server to patch, replace or air-condition.
Upgrade to Windows Server 2025
Some workloads genuinely need to stay on a server you control. A clean move to a current, supported Windows Server (on-premises or hosted in Azure) keeps you patched and buys years of runway.
Buy Extended Security Updates
ESU keeps the security patches coming for up to three more years, but it is paid, security-only, and gets more expensive each year. It buys time to plan a proper move, not a place to settle.
Do nothing
An unpatched, internet-connected server is one of the most dangerous things you can leave running. Attackers scan for exactly this. It is the classic soft entry point for a ransomware attack.
Do you still need a server at all?
This is the question worth sitting with before you spend a cent replacing hardware. A decade ago, a small business needed a server for file storage, email, printing and running its core apps. Today, most of that lives comfortably in the cloud. Files fit naturally in SharePoint and OneDrive, identity moves to Entra, and the majority of line-of-business apps either have a cloud version or run happily on a virtual machine in Azure.
For a lot of Perth businesses, retiring Server 2016 means retiring the server room entirely. No more hardware to buy every five years, no more patching weekends, no more single box that takes the whole business down if it fails. That is not the right answer for everyone, but this deadline is the ideal time to ask the question rather than default to buying another server out of habit. Working out which workloads go where is the heart of a good cloud migration.
The takeaway
Windows Server 2016 reaching end of support is a hard deadline with a soft trigger: nothing breaks on the day, so it is easy to let slide until the server is a genuine liability. The businesses that handle it well treat January 2027 as a planning date, not a panic date, and use it as the moment to modernise rather than just replace.
Whether that means a clean move to the cloud, a fresh Windows Server, or a short ESU bridge while you plan, the important thing is to decide deliberately and with time to spare. Mapping out the options and doing the migration with nothing lost along the way is exactly what our team does.
Common questions
When exactly does Windows Server 2016 support end?
Extended support for Windows Server 2016 ends on 12 January 2027. After that date, Microsoft stops issuing security updates unless you pay for Extended Security Updates. The server keeps running, but every new vulnerability found after that stays unpatched.
Can I just keep running it?
You can, and that is exactly the problem. The server will keep working, so nothing forces the issue, while it quietly becomes an unpatched, internet-facing target. An old server is one of the most common ways attackers get into a business network, so running one past end of support is a serious and avoidable risk.
Is ESU a reasonable option?
As a bridge, yes. Extended Security Updates keep critical patches flowing for up to three years after the deadline, which can be sensible if you have a genuine reason you cannot move by January 2027. But it is paid, it only covers security (no fixes or features), and the price climbs each year, so it is a way to buy planning time, not a long-term answer.
Do I even need to replace the server, or can I go cloud?
For many businesses, this deadline is the perfect moment to ask whether you need a physical server at all. File storage, email, identity and most line-of-business apps now have strong cloud equivalents. Moving those to Microsoft 365 and Azure often means retiring the last on-prem server entirely, with less to maintain and nothing to replace in another five years.
How long does a server migration take?
It depends on what the server does, but the honest answer is that it takes planning more than time. Rushed migrations are where data gets lost and downtime creeps in. With six months or more of runway before January 2027, there is time to do it properly: assess what the server holds, choose the right destination for each workload, and cut over with backups at every step.