CloudekWindows Server
Windows Server 2016 End of Support: Role-by-Role Migrate or Upgrade Guide
Windows Server 2016 end of support in January 2027: a migrate or upgrade verdict for every role, the order to work in, and a guide to each role.
Windows Server 2016 end of support is a calendar problem before it is a technical one. Every server has a role, every role has a different answer, and the answers depend on each other. This guide is the index to our Windows Server 2016 series: a verdict for every role, what happens in January 2027, the order we would work through an estate, and a link to a detailed guide for each role. Sources checked 6 November 2026 against Microsoft Learn and Microsoft Lifecycle; they are listed at the end.
Verdict
Verdict: it depends on the role.
Migrate domain controllers, Exchange, AD FS, NPS and print servers; choose between an in-place upgrade and a migration for the rest, as the table below shows.
What happens on 12 January 2027
Microsoft Lifecycle lists Windows Server 2016 under the Fixed Lifecycle Policy. The Lifecycle table shows the extended support end as 1/13/2027 6:59:59 AM, while Microsoft's extended security updates page names 12 January 2027. Plan to finish before 12 January 2027. From 6 November 2026 that is 67 days.
Servers do not stop on that date. What stops is security updates, unless you buy Extended Security Updates (ESU). Microsoft's Azure Arc documentation says Windows Server 2016 reaches end of support on January 12, 2027, and that Extended Security Updates provide Critical and Important security updates for up to three years, through 2030, without new features, customer-requested nonsecurity hotfixes or design change requests. Arc-enabled ESU can be configured in the Azure portal from August 3, 2026, and its billing begins January 13, 2027. Standard and Datacenter editions are supported; physical-core licences need at least 16 cores per machine, and virtual-core licences need at least 8 per VM and use Standard. You must attest to Software Assurance or an equivalent server subscription, or license through SPLA. The pages I read show no price, so get a quote. Microsoft describes ESU generally as a last resort paid option and a temporary bridge, so treat it as a way to finish a migration, not as the plan. Treat it as a way to finish a migration that has already started, not as a plan.
Two facts change the urgency of individual roles. Exchange Server 2016 and 2019 reached end of support on 14 October 2025, and Microsoft's Exchange team has said no more updates will be released for them, so an Exchange server on Windows Server 2016 is already outside any safety net. And for clusters, Microsoft allows only one Windows Server version per rolling upgrade, so a 2016 cluster has no short route to 2025.
Verdict by role
The starting verdicts below come from Microsoft's own role matrix and migration guides, and match the role-by-role planner on our licensing calculator page. "Either" means Microsoft documents both an in-place upgrade and a migration; the guide for the role says how to choose.
| Role | Verdict | Why, in one line | Guide |
|---|---|---|---|
| Domain controllers | Migrate | Microsoft recommends a clean install and demotion over an in-place upgrade | Domain controllers |
| File servers | Either | In-place is supported; Storage Migration Service moves data with a fallback | File servers |
| Hyper-V hosts and clusters | Either | Rolling upgrade is one version per hop, so 2016 to 2025 is three hops or a new cluster | Hyper-V |
| Exchange Server | Migrate | Major-version OS upgrades with Exchange installed are unsupported; Exchange 2016 and 2019 are out of support | Exchange |
| Remote Desktop Services and RD Gateway | Either | A strict order: Connection Broker, then licensing, then Session Hosts | Remote Desktop Services |
| AD FS | Migrate | No in-place upgrade; add newer nodes, or move to Microsoft Entra ID | AD FS |
| AD CS | Either | Both are supported; protect the CA key and backups | AD CS |
| DHCP | Either | Export and import; failover pairs have their own steps | DHCP, DNS and NPS |
| DNS | Either | Check AD-integrated versus file-backed zones | DHCP, DNS and NPS |
| NPS | Migrate | Export and import; the XML holds unencrypted shared secrets | DHCP, DNS and NPS |
| WSUS | Either | Both supported; WSUS is deprecated but supported | WSUS |
| Print servers | Migrate | No in-place upgrade; Printbrm export and import | Print servers |
| Application or general server | Either | For non-clustered servers, 2016 to 2019, 2022 and 2025 are listed in-place paths; check vendor support | Use the planner |
| Several roles on one server | Migrate | Our planning default, not a Microsoft rule: split roles, then move each | Use the planner |
For an application server, Microsoft lists direct in-place paths from Windows Server 2016 to 2019, 2022 and 2025 for non-clustered servers, with the usual restrictions: no language change, no switch between Server Core and Desktop Experience, and no boot-from-VHD. The application vendor's support statement, drivers and your hardware decide whether you take it.
Decision table: the same four options for every role
| Option | What it means | When it is the answer |
|---|---|---|
| Stay and buy ESU | Azure Arc ESU: Critical and Important updates for up to three years, through 2030, billed from 13 January 2027; needs Software Assurance or an equivalent subscription | Only to finish a migration already under way; no price is published on those pages |
| In-place upgrade | Install a newer Windows Server over the existing one | Roles where Microsoft marks it supported and downtime of one server is acceptable |
| Side-by-side migration | Build a new server, move the role, retire the old one | Roles where Microsoft recommends or requires it, and anywhere you want a fallback |
| Move to Azure or SaaS | Azure VMs through Azure Migrate, Microsoft 365, Microsoft Entra ID, Universal Print | When the role is replaceable by a service, not just relocatable |
How to order your estate
Microsoft does not publish a single order for a whole estate, so this is our recommendation, built on dependencies Microsoft does document.
- Inventory first. List every Windows Server 2016 machine, its roles, its owner and its dependencies. Several roles on one server is the single biggest source of surprises; Microsoft's DHCP guide, for example, does not cover source servers that run multiple roles, and Storage Migration Service cannot cut over from a domain controller.
- Identity first. Domain controllers and the DNS that runs on them come first, because other roles depend on them: AD FS needs the directory schema at a minimum level, Exchange setup needs supported domain controllers and has a documented update requirement for a Windows Server 2025 Schema Master, and every migration that renames or rejoins a server needs a healthy domain.
- Exchange in parallel. It is the most urgent role because it is already out of support. Start the plan as soon as the domain controller work has checked the forest, rather than waiting for the end of it.
- Trust and sign-in next. AD CS, AD FS and NPS: certificates, federation and RADIUS affect how every other migration authenticates and encrypts. Decide early whether AD FS is migrating or being replaced by Microsoft Entra ID.
- Network services. DHCP and DNS, with their relay agents, forwarders and clients, once identity is stable.
- Data, print and virtualization. File and print servers move well in waves with a pilot group. Hyper-V clusters take the longest: Microsoft recommends finishing each rolling-upgrade hop within four weeks, so three hops need real calendar time, or a new cluster is cheaper.
- Platforms and the long tail. RDS, WSUS and application servers, once their dependencies (licensing, certificates, storage, identity) are on supported systems.
- Re-check the guests. Every virtual machine running Windows Server 2016 counts too, whatever its host runs.
Checklist
- Every Windows Server 2016 machine, role, owner and dependency inventoried, guests included
- A verdict recorded per role, with the reason
- Identity work started first; Exchange planned in parallel
- Certificates, federation and RADIUS decided before the services that depend on them
- Backups and a rollback point written down for each change
- Cluster hops and pilot groups put on the calendar
- ESU treated as a bridge for stragglers, with its terms confirmed before relying on it
- Everything finished before 12 January 2027
Tools and related reading
The Windows Server 2016 end-of-support planner on our licensing calculator gives a starting verdict, Microsoft source links and an ESU reminder for each role, and runs in your browser. Use the Windows Server licensing guide before you buy hosts, the certificate expiry planner and CSR and private key generator for the certificate work every migration creates, and the Hyper-V vs Azure VMs vs Azure Local cost model if you are deciding where the replacement servers live.
Sources
Checked 6 November 2026.
- Windows Server 2016 on Microsoft Lifecycle
- Extended Security Updates for SQL Server and Windows Server
- Prepare to deliver Extended Security Updates for Windows Server through Azure Arc (2016 dates, coverage, Software Assurance)
- License provisioning guidelines for Extended Security Updates for Windows Server (editions, core minimums)
- Billing service for Extended Security Updates for Windows Server through Azure Arc (billing start)
- Product Lifecycle FAQ: Extended Security Updates
- Upgrade and migrate roles and features (role matrix)
- Plan your Windows Server upgrade path (in-place paths and restrictions)
- Upgrade domain controllers to a newer version of Windows Server
- Storage Migration Service overview and FAQ
- Cluster OS rolling upgrade
- Exchange Server supportability matrix and Exchange 2019 and 2016 end of support roadmap
- Upgrade Remote Desktop Services deployments and Migrate Remote Desktop Services
- Upgrade an AD FS farm by using Windows Internal Database
- Migrate a Certification Authority
- Migrate DHCP Server and Export an NPS configuration
- Features removed or no longer developed in Windows Server (WSUS)
General planning information, not a design for your environment. The role guides list their own sources.