Platform Forward Group
Book the inventory walkthrough

Exchange 2016 and 2019 have thirteen days

The paid Exchange 2016 and 2019 security updates end October 31, with no third period. The October 13 patch was the last one. Count the servers before the month does.

Pixel drawing of a sealed envelope with a green wax seal

October 31. That is the end of the second and final extended security update period for Exchange Server 2016 and 2019. Microsoft has said there is no period three. The October 13 security updates for 2016 CU23 and 2019 CU14 and CU15 are the last ones that will ever ship for those versions, whether or not you paid.

Exchange left support on October 14, 2025. What bought the last year was two six-month ESU purchases, each sold separately, each covering Critical and Important fixes only. If your mail still runs on-premises on either version, you have already spent every extension there is. Thirteen days is not a migration. It is a count.

  1. Count the servers. All of them, including the one kept alive for hybrid recipient management and the one in the DR site nobody has patched since spring. Get the build number from each. Anything below the October 13 build is behind on the last fix you will ever get.
  2. Install that October update everywhere before the 31st. It is the final good state. After that, the only move is forward.
  3. Decide the destination per server, not per estate. Mailboxes go to Exchange Online or to Exchange Server Subscription Edition. The hybrid management box can usually be decommissioned once recipient management moves to the cloud tooling. Write the destination next to each name on the list.
  4. Mind the coexistence clock. Microsoft's upgrade guidance is that the next Subscription Edition cumulative update will refuse to install while any 2016 or 2019 server remains in the organization. The real deadline for the on-premises path is that release, not the 31st, and it has a half-year window rather than a date. Plan for the early end of it.
  5. Isolate whatever stays. An unpatched Exchange server is the most attacked box in most estates, and it faces the internet by design. Pull it behind the gateway, restrict who can reach it, and log everything. Same drill as the 2012 survivors.

We walked an estate last year where the mail team had migrated every mailbox and still had three 2016 servers running, because hybrid needed one and nobody knew what the other two did. They did nothing. They had been doing nothing for two years. That is the usual shape of the count, and it is why the count comes before the plan.

Mail is the system that gets you a phone call from the board when it breaks. Put the 31st on the wall, put the server count under it, and name the owner who crosses them off.