Windows Server 2016 end of support: what it means for your business applications
Microsoft stops publishing security updates for Windows Server 2016 on 12 January 2027. Plenty of business applications still run on it, often alongside an older SQL Server. Here's what that means and how to plan the move.
The key dates
| Product | End of support |
|---|---|
| Windows Server 2012 / 2012 R2 | Ended October 2023 |
| SQL Server 2016 | Ended 14 July 2026 |
| Windows Server 2016 | 12 January 2027 |
| .NET 8 and .NET 9 | 10 November 2026 |
| Windows Server 2022 and 2025 | Supported into the 2030s |
Check current dates on Microsoft's Windows Server 2016 lifecycle page.
What "end of support" means for you
Your server won't switch off on 13 January. But every vulnerability found after that date stays open unless you pay for extended updates. For a server that runs your website, customer portal or line-of-business system, that matters:
- Security: internet-facing servers are scanned constantly, and unpatched Windows is a favourite target.
- Compliance and insurance: Cyber Essentials, ISO 27001 and many customer security questionnaires require supported operating systems.
- Knock-on effects: new versions of SQL Server, .NET and other software stop supporting old Windows versions, so you can't stay current on one without moving the other.
Which applications are affected?
The operating system is usually the easy part. The hard part is the software on it, especially anything bespoke:
- ASP.NET and .NET Framework web applications running in IIS
- Older Classic ASP or Web Forms sites
- Windows services and scheduled tasks that move data between systems
- SQL Server 2016 databases on the same machine, which are already out of support
- Anything with hard-coded server names, file paths or old certificates
If the person who built these has moved on, read what to do when your developer has left first.
Your options
- Move to Windows Server 2022 or 2025. The most direct route for .NET Framework applications, which need Windows. Usually best done as a migration to a new server rather than an in-place upgrade, so the old one stays as a fallback.
- Modernise as you move. Applications upgraded to modern .NET (.NET 10 is supported until November 2028) can run on Linux, in containers or on managed cloud hosting, which often cuts hosting costs and ends the cycle of server upgrades. See migrating .NET Framework to .NET 10.
- Buy time with Extended Security Updates. Microsoft offers paid ESUs for Windows Server 2016 through Azure Arc. They're a bridge while you migrate, not a plan.
A sensible migration plan
- Inventory: list every application, service, scheduled task and database on each server, with its versions and dependencies.
- Decide per application: move as-is, upgrade, modernise or retire.
- Build the new environment alongside the old one, with a repeatable deployment, so nothing depends on a hand-configured server again.
- Test with real data, then switch over with a rollback plan.
- Keep it current: put patching and upgrades on a schedule so the next end-of-support date isn't another project.
Need a hand?
I've built and hosted ASP.NET applications on Windows Server for more than 20 years, and I modernise them to run on current .NET and cloud hosting. My fixed-price upgrade audit lists what's on your servers, the risks and a costed plan for the move. Afterwards, a care plan keeps it patched and current.