Microsoft ends extended support for Windows Server 2016 on 12 January 2027. ESU offers a three-year bridge at most, while CSP software subscriptions rose 5 percent from 1 October 2026.
Microsoft has confirmed that extended support for Windows Server 2016 ends on 12 January 2027. After that date the operating system receives no security updates, no bug fixes and no technical support. Fewer than 80 days remain.
Mainstream support ended back on 12 January 2022, and since then the platform has been kept alive by monthly security patches alone. In January 2027 that last channel closes too. The server keeps running and the licence stays valid; what changes is that any vulnerability found afterwards will never be patched.
What the options look like after the deadline
Microsoft offers Extended Security Updates (ESU) for organisations that need to keep receiving patches. For Windows Server 2016 the programme runs for a maximum of three years and covers only vulnerabilities rated critical and important. It brings no new features and no quality fixes. The years are cumulative: you can buy year two only if you bought year one, and year three only if you bought both earlier years.
ESU for Windows Server 2016 is delivered through Azure Arc. The physical or virtual server on your premises has to be onboarded as an Arc-enabled machine, and it needs active Software Assurance or a qualifying subscription licence. Licensing is counted per core, with a floor of 16 physical cores per server and 8 virtual cores per virtual machine, so even a modest server is billed against that minimum.
The cost side shifted again in October
From 1 October 2026, Microsoft applies a 5 percent uplift to CSP software subscriptions that carry an annual term but are billed monthly. The change covers Windows Server, SQL Server, CALs and System Center. For existing subscriptions it does not apply mid-term; it takes effect at the first renewal on or after 1 October 2026. Annual up-front and month-to-month subscriptions are unaffected. In short, staying put and renewing both got more expensive in the same quarter.
What this means for small and mid-sized businesses
A familiar pattern persists in offices across Istanbul's Anatolian side: one physical server running Active Directory, file shares, an accounting or ERP database, and sometimes print services. Many of those machines were commissioned between 2016 and 2018, which puts them on Windows Server 2016. Once support ends they sit unpatched against every newly disclosed flaw.
The legal side does not move. Under Turkish data protection law the controller's duty to maintain an appropriate level of security continues regardless of Microsoft's lifecycle calendar. If a breach happens through an unsupported server, out-of-date technical measures count against the organisation in any assessment. Tender requirements and cyber insurance policies that ask for a supported operating system become impossible to satisfy after January.
What we recommend at Kamer Bilisim
- Build a server inventory in November. Which machine runs which Windows Server release, how many physical cores it has, which applications and databases sit on it, and when the hardware warranty expires. Without those four columns neither an upgrade budget nor an ESU quote is reliable.
- Test the upgrade against your applications, not just the OS. In-place upgrades to Windows Server 2025 are supported for most installations, but the real risk lies with older ERP, accounting and production software rather than with Windows itself. Run the upgrade on a virtual copy before touching production.
- Treat ESU as a bridge with a stated end date. If you buy ESU, buy it alongside a migration plan that names the month it finishes. Verify Azure Arc onboarding, Software Assurance status and the core floor in advance, or you may find in January that the server simply is not receiving updates.
If you would like help producing a server inventory, moving workloads off Windows Server 2016, or costing the ESU route, reach us through the contact page. We provide on-site support across the Anatolian side of Istanbul and remote support elsewhere.
Source: Microsoft Windows Server Blog, Microsoft Extended Security Updates
Source: Microsoft Windows Server Blog