Exchange Server on Windows Server 2016: Migrate, Do Not Upgrade the OS

If Exchange Server is installed on a Windows Server 2016 machine, you have two end-of-support dates stacked on one server, and the one that matters more has already passed. Exchange Server 2016 and 2019 reached end of support on 14 October 2025, and the Windows Server 2016 operating system underneath follows in January 2027. This guide explains why the answer here is to migrate rather than upgrade, what Microsoft documents as your options, and a step list with the cmdlets and the points where you can still turn back. Sources checked 6 November 2026 against Microsoft Learn, Microsoft Lifecycle and the Exchange team blog; they are listed at the end.

Verdict

Verdict: Migrate.

Microsoft says an in-place upgrade of the Windows Server operating system between major versions with Exchange installed is not supported, and Exchange 2016 cannot be upgraded in place to a newer Exchange, so the only supported road is a new server or Exchange Online.

There is no clever shortcut. Upgrading the operating system under Exchange is the tempting move because it keeps the server name, the databases and the certificates. It is also the one Microsoft's supportability matrix rules out, and Exchange 2016 does not run on Windows Server 2019 or later in any case.

Who this is for and what changes on the end-of-support date

This is for anyone with Exchange Server 2016 (or 2019) servers on Windows Server 2016, including the "leftover" server kept only for mail relay, public folders or recipient management after a move to Microsoft 365.

Start with Exchange, because it is the bigger problem. Microsoft's end-of-support roadmap says support for Exchange 2019 and 2016 ended on 14 October 2025, so Microsoft no longer provides technical support, bug fixes, security fixes or time zone updates for them. The installation keeps running, but nothing fixes it. Microsoft ran an Extended Security Update programme for Exchange 2016 and 2019. Its second period ran from May to October 2026 for customers with an Enterprise Agreement, covering Exchange 2016 CU23 and Exchange 2019 CU14 and CU15. In an update dated 13 October 2026 the Exchange team said it had released the final set of updates, that no more updates will be released for Exchange 2016 or 2019, and that future updates will be for Exchange Server Subscription Edition (SE) only. So there is no ESU path left to buy time for Exchange itself.

For the operating system, Microsoft Lifecycle lists Windows Server 2016 under the Fixed Lifecycle Policy. The Lifecycle table shows the extended support end as 1/13/2027 6:59:59 AM, while Microsoft's extended security updates page names 12 January 2027 and says 2016 ESU starts on that date. Microsoft's Azure Arc documentation says Windows Server 2016 ESU provides Critical and Important updates for up to three years, through 2030, can be configured in the Azure portal from August 3, 2026, is billed from January 13, 2027 and requires Software Assurance or an equivalent server subscription; the pages show no price. That covers the operating system only. Whatever you decide about the operating system, it does not repair an Exchange build that no longer gets fixes.

Exchange servers are commonly reachable from the internet, which is why this role belongs near the top of the list. Finish before 12 January 2027, and treat any Exchange 2016 or 2019 server as overdue now.

Decision table

Exchange Server SE supports Windows Server 2025, 2022 and 2019 in Datacenter and Standard editions, with Server Core recommended, per the supportability matrix. Exchange 2016 supports Windows Server 2016, 2012 R2 and 2012.

Steps, with the rollback point

1. Inventory the organization. In the Exchange Management Shell run Get-ExchangeServer | Format-Table Name, Edition, AdminDisplayVersion, Get-Mailbox -ResultSize Unlimited | Measure-Object, Get-MailboxDatabase -Status, Get-ReceiveConnector and Get-SendConnector. Run Get-OrganizationConfig | Format-List PublicFoldersEnabled and Get-HybridConfiguration. Write down every client, application and device that sends mail through this server by name or address; those are the things that break.
2. Decide the destination. Microsoft 365 if no regulatory or technical reason forces mail on-premises. Exchange SE otherwise. Microsoft's decommission guide says organizations under 2,000 mailboxes should strongly consider a cutover or staged migration over hybrid, and hybrid for larger or longer migrations, because hybrid allows moves in both directions.
3. Know the identity catch. If you keep Microsoft Entra Connect managing accounts from on-premises Active Directory, you must keep at least one Exchange server to change Exchange recipient attributes, because the source of authority is on-premises. Microsoft's roadmap lists upgrading to Exchange SE, or using a management-tools approach, as the supported answers. Plan this before you promise "we will switch Exchange off".
4. Prepare Active Directory. Domain controllers must run versions supported for the target Exchange. If a Windows Server 2025 domain controller holds the Schema Master, Microsoft requires the November 2025 or later cumulative update on it before any PrepareAD operation. If your domain controllers are also on Windows Server 2016, schedule that work first, because Exchange setup depends on a healthy forest.
5. Back up and freeze. Take a verified backup of the Exchange databases, the system and the configuration, record Get-ExchangeCertificate, the virtual directory URLs (Get-OwaVirtualDirectory, Get-EcpVirtualDirectory, Get-WebServicesVirtualDirectory) and the Autodiscover settings, and stop any "just one more change" on the old server. This is your rollback.
6. On-premises route: build and join. Install Windows Server 2019, 2022 or 2025, run Exchange SE setup (the Exchange Server Deployment Assistant generates a tailored checklist), and add the new server to the existing organization. Microsoft warns that SE CU2 setup prohibits coexistence with any Exchange version no longer supported at that release, so plan to remove Exchange 2016 on a schedule rather than leave it indefinitely, and install the newest cumulative update at build time.
7. On-premises route: move. Create target databases, then move mailboxes with New-MoveRequest -Identity user@contoso.com -TargetDatabase DB-NEW, watch Get-MoveRequest | Get-MoveRequestStatistics, and complete in batches. Move arbitration, audit and discovery mailboxes and public folder mailboxes too. Move the namespace last: import or request certificates, repoint the Autodiscover and virtual directory URLs, and update receive connectors and any relay IP lists.
8. Microsoft 365 route: connect. For a cutover or staged migration, follow the migration batch process in the Exchange admin center. For hybrid, run the Hybrid Configuration Wizard from an on-premises Exchange server, then move mailboxes as remote moves. Public folders need their own migration if you use them, and the decommission guide lists the exact check.
9. Cut mail flow. For Microsoft 365, point MX and Autodiscover at Exchange Online, update both internal and external DNS (Microsoft warns about inconsistent client behaviour otherwise), and move relay users to a supported alternative. Rollback point: keep the old server, its databases and its connectors untouched until mail has flowed cleanly through the new path for a full business cycle.
10. Decommission only when allowed. If all mailboxes are in the cloud and you can disable directory synchronization, Microsoft's steps include removing the Hybrid Configuration Wizard connectors and organization relationship, disabling the OAuth intra-organization connectors, setting Get-ClientAccessService | Set-ClientAccessService -AutoDiscoverServiceInternalUri $Null, and then uninstalling Exchange. If you keep synchronization, keep one (preferably two) Exchange servers for recipient management; they need no database availability group.
11. Uninstall the old server. Run Exchange setup in uninstall mode (Setup.exe /mode:Uninstall /IAcceptExchangeServerLicenseTerms_DiagnosticDataON) after mailboxes, public folders, arbitration mailboxes and connectors have moved, then rebuild or retire the Windows Server 2016 machine.

Mistakes that cause outages

• Upgrading Windows underneath Exchange. Microsoft states it is not supported. A failed upgrade usually means a rebuild during business hours.
• Removing the last Exchange server in a synchronized environment. You lose the ability to edit Exchange attributes for cloud mailboxes.
• Forgetting relay. Printers, scanners, line-of-business apps and scripts relay through the server by IP address. Public folders and SMTP relay are the two things Microsoft calls out as reasons not to decommission.
• Changing MX or Autodiscover in only one DNS. Internal and external records both need to move.
• Leaving the certificate for last. The new server needs a certificate with the right names before clients find it.
• Skipping the schema and domain controller checks. A Windows Server 2025 Schema Master without the required cumulative update can cause replication issues during PrepareAD.
• Running Exchange 2016 alongside a newer SE build indefinitely. Microsoft's coexistence rule for SE CU2 and later blocks it.
• Treating hybrid as free. Hybrid adds complexity; Microsoft recommends cutover or staged for smaller organizations.

Checklist

• Exchange servers, versions, mailboxes, connectors, public folders and relay users inventoried
• Destination chosen: Exchange SE or Microsoft 365
• Identity source of authority understood; plan for the last Exchange server written down
• Domain controllers and functional levels checked; Schema Master update confirmed if on 2025
• Backups verified; certificates and URLs recorded
• New server or tenant ready; test mailboxes moved first
• Mail flow and DNS cut over; relay users moved
• Old Exchange uninstalled, Windows Server 2016 host retired
• Finish before 12 January 2027, and sooner for Exchange itself

Related tools and reading

Use the role-by-role Windows Server 2016 end-of-support planner for the other roles on the same host. For the migration itself, see our guides on the Exchange cutover method, Exchange hybrid deployment prerequisites and Microsoft 365 SMTP relay options.

Sources

Checked 6 November 2026.

• Exchange Server supportability matrix (supported operating systems, major-version OS upgrade, Windows Server 2025 Schema Master note)
• Exchange Server 2019 and 2016 End of Support Roadmap (14 October 2025, options)
• Upgrading to Exchange Server Subscription Edition (legacy and in-place upgrade, coexistence rules)
• Exchange Server 2016 on Microsoft Lifecycle
• Announcing Period 2 of the Exchange 2016/2019 ESU program (final updates, no further extension)
• How and when to decommission on-premises Exchange in a hybrid deployment
• Windows Server 2016 on Microsoft Lifecycle
• Extended Security Updates for SQL Server and Windows Server
• Prepare to deliver Extended Security Updates for Windows Server through Azure Arc (2016 dates, coverage, Software Assurance)
• License provisioning guidelines for Extended Security Updates for Windows Server (editions, core minimums)
• Billing service for Extended Security Updates for Windows Server through Azure Arc (billing start)
• Upgrade and migrate roles and features

General planning information, not a design for your environment. Pilot with test mailboxes first.