Microsoft ends extended support for Windows Server 2016 on 12 January 2027. From that day the servers keep running, but without security updates. Microsoft no longer gives technical support for them either. Paid Extended Security Updates exist for up to three more years, but only for licences with Software Assurance or an equivalent subscription; Microsoft does not offer them through SPLA, the licensing that hosting providers use. SQL Server 2016 is already past this point: its extended support ended on 14 July 2026. If a server in your company still runs either of them, plan the replacement now, because a clean move takes weeks, not a weekend.
This guide is for the owner, the CEO or the IT manager of a company with 10 to 100 people. If you already know the server has to move, see how we run a migration to our Riga data centre.
What ends and when
Windows Server gets five years of mainstream support, then five years of extended support with security updates only. The dates below come from Microsoft's lifecycle pages.
| Product | Mainstream support ended or ends | Extended support ends |
|---|---|---|
| Windows Server 2016 | 11 January 2022 | 12 January 2027 |
| SQL Server 2016 | 13 July 2021 | 14 July 2026 (already ended) |
| Windows Server 2019 | 9 January 2024 | 9 January 2029 |
| Windows Server 2022 | 13 October 2026 | 14 October 2031 |
| Windows Server 2025 | 13 November 2029 | 14 November 2034 |
The date is the same for the Standard, Datacenter and Essentials editions of Windows Server 2016, and for Windows containers released with it.
What actually happens after 12 January 2027
Nothing switches off. The server boots, people log in, the accounting program opens. What changes is underneath:
- No more security updates. Every vulnerability found in Windows Server 2016 after that date stays open. Attackers study the monthly fixes for newer Windows versions and check whether the same weakness exists in the old one, so the risk grows month by month.
- No technical support from Microsoft. Microsoft's lifecycle FAQ is explicit: after end of support, customers no longer receive technical assistance, software updates or security fixes.
- Your other software moves on. Vendors of accounting and ERP systems, backup agents and antivirus products stop testing on old operating systems. A problem that used to mean "call the vendor" turns into "the vendor asks you to upgrade first".
- Office on a terminal server is already on borrowed time. Microsoft 365 Apps stopped being supported on Windows Server 2016 on 14 October 2025. Microsoft still ships security updates for them there until 10 October 2028, but no new features.
Extended Security Updates: a bridge with conditions
Microsoft sells Extended Security Updates (ESU) for Windows Server 2016: Critical and Important security fixes for up to three years after the end date, through January 2030, for the Standard and Datacenter editions. Microsoft itself calls ESU a last resort, and the conditions matter:
- You need active Software Assurance through a volume licensing programme, or an equivalent subscription licence. A licence that came preinstalled with the server hardware (OEM) and has no Software Assurance does not qualify.
- Microsoft's documentation for Windows Server 2016 states that the Services Provider License Agreement (SPLA), the licensing model hosting providers use, is not available for these ESUs. A rented server with the licence included by the provider usually has no ESU route.
- ESU is delivered through Azure Arc, where it can be configured since 3 August 2026 and billing starts on 13 January 2027, or through volume licensing keys. Servers running in Microsoft Azure receive it at no extra charge.
- ESU includes no technical support and no non-security fixes. It buys time, not a supported system.
For a company with a handful of servers, ESU is worth checking for one specific system that truly cannot move in time, for example an old line-of-business program waiting for its vendor. It is not a plan for the whole server room.
Why this is a business risk, not only an IT one
Security. An unpatched server that holds the company's files, the accounting database or the domain controller is the most valuable machine in the building. Ransomware groups look for exactly these machines, and remote desktop opened to the internet is a common way in.
Data protection. GDPR requires appropriate technical and organisational measures for personal data (Article 32). After a breach, explaining why customer data sat on a system without security updates is a weak position to argue from.
NIS2. To be honest: most companies with 10 to 100 people are not subjects of the Latvian National Cybersecurity Law, which implements NIS2. If yours is, the law requires appropriate technical and organisational measures to manage cyber risks, Cabinet Regulation No. 397 requires processes to find and fix vulnerabilities, and an auditor will note an unsupported operating system as a finding. If you are not a subject, your larger customers may be, and they increasingly ask suppliers about unsupported software. Whether the law applies to you is covered on our NIS2 page. If it does, our NIS2 checklist for Latvia lists the ten measures and the evidence an auditor asks for.
Insurance, audits and customer questionnaires. Cyber insurance applications, bank due diligence forms and customers' security questionnaires regularly ask whether you run software that no longer receives security updates. Read your policy wording, because some policies tie cover to keeping systems patched. An honest "yes, one server, and this is the date it goes away" is a far better answer than a surprised one.
Your options
1. Upgrade in place
Windows Server 2025 supports in-place upgrades from up to four versions back, so a Windows Server 2016 machine can go straight to 2025. It is the fastest route and keeps the server name, roles and settings. It also keeps ten years of leftovers and does nothing for hardware bought in 2016 or 2017, which is out of warranty and at the age when disks and power supplies fail. An in-place upgrade makes sense for a virtual machine on healthy hardware, with a full backup taken and tested first.
2. Build a new server or virtual machine and move the roles
The cleaner route: install a fresh Windows Server 2025, then move the domain controller, file shares, printing and applications one by one while the old server keeps running. It takes longer, but it ends with a documented, supported system, and the old server remains a way back until the new one has proven itself.
3. Move the server out of the office into a data centre
If the server sits in a cupboard next to the coffee machine, the end of support is a good moment to ask whether it belongs there at all. In a data centre it gets redundant power and cooling, a proper network, monitoring and backups kept elsewhere, and staff reach it over a VPN or remote desktop. The move and the upgrade can be one project.
4. Let the cloud take over some roles
Some old server roles no longer need a server of your own. Email can move to Exchange Online, shared documents to SharePoint and OneDrive, and user accounts to Microsoft 365. What usually stays on a server is the accounting or ERP system, a SQL Server database and programs that need a Windows desktop, often used through remote desktop.
Which version to move to
For a new build choose Windows Server 2025, which gets security updates until 14 November 2034. Windows Server 2022 leaves mainstream support on 13 October 2026, and moving to Windows Server 2019 buys only two years, until 9 January 2029. If your staff run Microsoft 365 Apps on a terminal server, Microsoft supports that on Windows Server 2025 during its mainstream support. Treat SQL Server 2016 the same way: move the database to a supported SQL Server version in the same project instead of opening a second one later.
Checklist and timeline
A company with two to five servers can usually finish in 8 to 12 weeks if it starts early enough. The order matters more than the speed.
- Now: name an owner and a date. One person is responsible, and the target date sits well before 12 January 2027, so the holidays and one surprise still fit in.
- Weeks 1-2: inventory. List every physical server and virtual machine, its Windows and SQL Server version, what it does (domain controller, files, printing, remote desktop, accounting, ERP, backup), who uses it and which licences it runs on, including whether you have Software Assurance. Look for the forgotten ones: the old virtual machine with the time clock software, the backup server, the SQL Server Express hidden inside a business program.
- Weeks 2-4: decide server by server. Upgrade, rebuild, move, replace with a cloud service or switch off. Ask each software vendor which Windows Server and SQL Server versions they support. Budget the licences: Windows Server core licences, client access licences, remote desktop licences and SQL Server.
- Weeks 4-8: build and test. Build the new environment, restore real data into it from backup and let the people who use each program test it with their daily tasks. This also proves that restoring from backup actually works.
- Weeks 8-12: migrate. Move one system at a time in an agreed window, usually an evening or a weekend. Keep the old server available but out of use until everyone confirms the new one works.
- Decommission. Remove the old server from the domain, wipe its disks securely, update the asset list and documentation, and cancel support contracts and licences you no longer need.
If one system really cannot move before 12 January 2027, reduce its exposure: no direct access from the internet, remote desktop only through a VPN, access limited to the people who need it, and a backup kept offline. Check ESU eligibility early, because confirming the licensing conditions takes time.
How CloudHosting helps
CloudHosting SIA runs its own data centre in Riga and moves company servers there from offices and from other providers.
- Migration. We survey what you have, write a plan with a way back for every step, rehearse the switch and only then touch production. Read how a migration runs.
- Servers with Windows Server 2025 in the Riga data centre, virtual or dedicated, sized for your workload.
- Licences. As a Microsoft partner we sell Windows Server, remote desktop and SQL Server licences, or you use your own licence where its terms allow. Licences are priced separately from the server. See Windows Server licensing.
- Remote desktop for your team. A managed Windows desktop for every employee, reachable from any computer: our remote office.
- Backup and monitoring. Backups with tested restores, plus monitoring and incident response 24/7, with engineers answering on working days 9:00-17:00 Riga time.
Not sure what is running in your server room? An IT audit from 200 EUR gives you the inventory and a ranked list of what to fix, and the Windows Server 2016 question is part of it.