What to do before 12 January 2027 if you run Windows Server 2016

What "end of support" actually means

Your server does not stop working on 13 January 2027. It keeps running exactly as it did. What stops is security patching. Every new vulnerability found after that date stays open on your machine forever.

That matters most if the server is reachable from the internet — remote desktop, an old line-of-business web portal, a VPN endpoint. An unsupported, internet-facing server is the single most common way small businesses get owned.

Find out whether you even have one

Plenty of businesses do not know. Look in the cupboard under the stairs or the corner of the office: a tall box with a fan, running all day, is usually a server. Check what Windows version it runs (Settings, or right-click This PC). If it says Server 2012/2016, or it is a Small Business Server, you have work to do.

Also ask: what would break if it went offline for a day? That answer shapes your options more than the version number does.

Your four options

There are only four honest paths. Most businesses land on one of the first two; the third is a bridge, not a destination; the fourth is for genuinely stuck legacy software.

• Upgrade in place or side-by-side to Windows Server 2025 — same role, newer OS, more cost and a migration window.
• Replace the server’s job with Microsoft 365 — SharePoint/OneDrive for files, Teams for collaboration — often the cheapest long-term answer for file shares.
• Buy time with Extended Security Updates through Azure Arc — a stopgap while you migrate, not a permanent fix.
• Isolate a legacy server that cannot be upgraded — no internet exposure, hardened, offline backups, documented compensating controls, and a real plan for when the vendor never catches up.

A realistic timeline

Migrations slip. The businesses that get into trouble are the ones that start in November 2026 and hope to cut over in a weekend. A file-share move sounds simple until you find the accounting package that needs a mapped drive and the scanner that only talks to the old server.

• This quarter: get an Exit Assessment — an inventory of what the server actually does and who depends on it.
• Then: pick the option and schedule it with your trading calendar (avoid your busy season).
• Before the date: stand up the new service, migrate a pilot group, test restores.
• After the date: decommission or harden the old server; do not leave it running "just in case".

What ESU through Azure Arc does and does not buy you

Extended Security Updates delivered via Azure Arc keep security patches flowing to Server 2016 after the cut-off, for a fee, for a limited window. It is a legitimate bridge if you have a migration scheduled and need the road to stay open.

It is not a reason to defer the decision indefinitely. An ESU-patched but otherwise ageing server still has the same hardware risk, the same support-model risk and a fixed end date of its own.