SQUAREWAVE_OS · v.2026 · Orlando FL
SQUAREWAVE TECHNOLOGIES
Managed I.T. that picks up the phone. Drag icons to rearrange. Click to open.
SQUAREWAVE TECHNOLOGIES
Managed I.T. that picks up the phone. Drag icons to rearrange. Click to open.
November 4, 2026 · #windows-server #end-of-support #security
Windows Server 2016 stops getting security updates on January 12, 2027. The three options (upgrade, move to Azure, or pay for extended updates) and how to choose.
On January 12, 2027, Microsoft stops shipping security updates for Windows Server 2016. The servers keep running. They just stop getting fixes, and every vulnerability found after that date stays open for good. If your business still has a 2016 server in a closet or a data center, you have about ten weeks to decide what happens to it.
More businesses than you'd think. Windows Server 2016 was the default for a lot of Central Florida offices that bought a server in the late 2010s: domain controllers, file servers, the box that runs the accounting or practice-management software, and plenty of servers running SQL Server 2016 underneath a line-of-business app. SQL Server 2016 already reached end of support on July 14, 2026, so a 2016 server running a 2016 database is now two problems, not one.
For most small and mid-size businesses this is the right answer, and Microsoft's recommended target is Windows Server 2025. The work is usually less about the operating system and more about what runs on it: confirming the software vendor supports the new version, moving file shares and permissions cleanly, and retiring the jobs that don't need a server at all anymore. A lot of file sharing and sign-in now belongs in Microsoft 365. Plan it as a project with a rollback, not a weekend gamble.
If the hardware is due for replacement anyway, moving the workload to Azure can make more sense than buying a new server. Microsoft provides Windows Server 2016 Extended Security Updates for servers running in Azure, which buys time to upgrade on your schedule. The catch is cost discipline: an Azure server sized by guesswork becomes a surprise bill. Right-size it first.
Microsoft sells Extended Security Updates for Windows Server 2016 for up to three years, covering January 12, 2027 through January 2030. They deliver Critical and Important security updates only: no new features and no non-security fixes. On-premises servers get them either through Azure Arc, billed monthly so you can stop paying when the server is retired, or as a yearly Volume Licensing purchase. Arc-delivered updates generally require Software Assurance, and Microsoft doesn't publish one list price, so get a quote for your licensing before you count on this option.
Extended updates make sense when an application genuinely can't move yet. They don't make sense as a way to put off the decision: the bill arrives every month, and the upgrade is still waiting at the end.
First, find every 2016 server, including the ones nobody thinks about: the old domain controller, the virtual machine on the host in the back room, the server a software vendor installed and still manages. Second, write down what each one actually does and who depends on it. Third, pick an option per server, not one for the whole company. Fourth, schedule the work before January, because December disappears fast.
We do these migrations for Central Florida businesses, from the inventory to the cutover, including the SQL Server databases that usually sit underneath the line-of-business app. If you're not sure how many 2016 servers you have, that's the first thing we'd check.
