Microsoft ends extended support for Windows Server 2016 on 12 January 2027. ESU covers only the Standard and Datacenter editions, leaving Essentials and MultiPoint Premium users with migration as the only route.
Microsoft has confirmed that extended support for Windows Server 2016 ends on 12 January 2027. After that date, no monthly security updates will be published for the Datacenter, Standard, Essentials or MultiPoint Premium editions. The servers will keep running — but any vulnerability discovered from then on stays open permanently.
What actually changes on the calendar
According to Microsoft's lifecycle notice, the January 2027 security update is the last one Windows Server 2016 will receive. Edition-specific components such as Remote Web Access in Essentials may continue to function, but problems found in them will no longer be fixed.
For servers that have to stay on-premises, Microsoft offers Extended Security Updates (ESU) delivered through Azure Arc. ESU covers critical and important vulnerabilities for up to three years, through January 2030. Three limits shape the decision: ESU is generally available only for the Standard and Datacenter editions, enrolment requires Software Assurance through a volume licensing programme, and billing begins on 13 January 2027. There is no confirmed ESU path for Essentials or MultiPoint Premium, so for those editions migration is the only option.
Why it matters
This is the third major support window to close in quick succession. On the same lifecycle schedule, extended support for SQL Server 2016 ended on 14 July 2026 and ESUs for Windows Server 2012 ended on 13 October 2026. In many organisations these products sit in the same rack — often on the same physical machine. One box can therefore carry three overlapping patch gaps.
An unsupported server does not fail on day one. The problem is accumulation: every newly published flaw stays open on that machine for good. That is precisely why ransomware operators scan for end-of-life systems as preferred targets.
What this means for SMEs in Türkiye
Windows Server 2016 is still widespread across Turkish SMEs: domain controllers, file and print servers, accounting and ERP databases, CCTV recording systems and terminal servers. Most of these machines were commissioned between 2016 and 2018 and have not been touched since.
There is a compliance dimension too. Article 12 of Turkey's Personal Data Protection Law (KVKK, Law No. 6698) obliges data controllers to take "all necessary technical and administrative measures to ensure an appropriate level of security." After a breach, it is hard to argue that employee or customer data running on a server known to be outside its support window met an appropriate level of security. Because the end-of-support date is public, this is not an unforeseeable risk.
The second practical obstacle is hardware. Upgrading to Windows Server 2025 means meeting Microsoft's published hardware requirements, which an eight-year-old server may simply not satisfy. The decision is therefore less about licensing than about refresh planning.
What we recommend at Kamer Bilişim
- Start with an inventory, broken down by edition. Which machines run Windows Server 2016, and which edition? Put Essentials and MultiPoint Premium servers on a separate list: with no ESU safety net, they have to move first.
- Pick one of three routes per server, now. Upgrade to Windows Server 2025, migrate to Azure, or buy time with ESU. If ESU is your choice, settle your Software Assurance position and Azure Arc enrolment before 13 January 2027, the date Microsoft starts billing.
- Validate the upgrade in a test environment first. Microsoft provides a free 180-day evaluation of Windows Server 2025. Use it to check your accounting, ERP and line-of-business applications for compatibility before production, and keep a verified rollback backup.
If you would like your server estate inventoried, an upgrade and migration plan costed out, or an honest view on whether ESU makes sense for you, get in touch via our contact page. We work across the Anatolian side of Istanbul and can begin the inventory remotely.
Source: Microsoft — Extended Security Updates page and Windows Server Blog, "Planning ahead for Windows Server 2016 end of support".
Source: Microsoft