Windows Server 2016 runs out in January 2027

Inventory first. Extended support for Windows Server 2016 ends January 12, 2027. After that date the security patches stop, and an unpatched Windows Server sitting on a domain is not a risk you get to accept quietly. Auditors ask. Cyber-insurers ask louder.

Count the boxes.

1. Pull the estate. Every Server 2016 instance: physical, virtual, cloud, and the ones not in the CMDB, which is usually most of them. The inventory always surprises; budget for the surprise.
2. Sort by role. Domain controllers first, then application servers, then the file-and-print and utility boxes nobody remembers standing up. The DCs carry the longest tail, because raising a forest functional level touches everything downstream of it.
3. Flag the app-locked ones. The 2016 box that stays 2016 because a vendor application is certified only on 2016 is your real project. That is a vendor conversation, and vendor conversations run in months, so open the ones due in 2027 now.

Price the two paths. An in-place upgrade to 2019 or 2022 is cheaper and riskier. A clean rebuild on 2022 or 2025 is more work and fewer ghosts. We usually rebuild the domain controllers and upgrade the disposable boxes in place, but the split depends on what the application-compatibility testing says, and app-compat testing is the line item people cut and then regret in the cutover window.

The ESU escape hatch, priced plainly. Microsoft will sell Extended Security Updates for Server 2016 past the date, and the price climbs every year on purpose. ESU is a bridge, not a plan. Buy it for a box with a real migration scheduled that cannot quite make January. Buy it for the app-locked box while the vendor drags. Do not buy it as a way to avoid deciding, because next January it costs more and the servers are the same.

One war story, serial number filed off. A shop we walked had two hundred-odd Server 2016 instances and a plan for all of them except four. The four ran a licensing app for the system that billed customers. No source, vendor acquired twice, last certified on 2016. Those four were the whole project. The other two hundred were a schedule.

One more thing about the domain controllers, since they are the schedule's long pole. You do not upgrade a DC in place and hope. You stand up a new one on 2022 or 2025, let it replicate, transfer the roles, and demote the old one, and you do all of that before you raise the forest functional level, because raising it is the step you cannot walk back. Budget a change window per controller and a rehearsal in a lab that looks like production, because the one that goes wrong is the one holding the schema master.

Put the date on the wall. January 12, 2027, is a calendar deadline, not a soon. Work back from it: vendor conversations by spring, app-compat by summer, domain controllers rebuilt with a quarter to spare. The boxes still running 2016 that January are the ones nobody inventoried this year.