Microsoft has confirmed that extended support for Windows Server 2016 ends on 12 January 2027. Dependent components including Hyper-V Server 2016, WSUS and IIS 10 go out of support on the same date.
Microsoft has confirmed in its official lifecycle calendar that extended support for Windows Server 2016 ends on 12 January 2027. After that date the operating system receives no security updates, no bug fixes and no technical support. Organisations still running production workloads on this version have roughly two months of planning time left.
It is not only the operating system
Components that run on top of Windows Server 2016 reach their end of support on the same day: Hyper-V Server 2016, Windows Storage Server 2016, IIS 10, Windows Server Update Services (WSUS) and Windows Defender. One day earlier, on 11 January 2027, the System Center 2016 family (Operations Manager, Virtual Machine Manager, Data Protection Manager, Service Manager, Orchestrator) together with BizTalk Server 2016 and Team Foundation Server 2017 drop out of support. The same week also covers .NET Framework 4.6.2 and Windows 10 Enterprise LTSC 2021.
So this is not a problem you close by upgrading a single server. Virtualisation, patch distribution, backup and monitoring all sit on the same calendar, and upgrading one layer while leaving another behind breaks the management chain.
Why it matters
An unsupported server stays permanently exposed to every vulnerability published after the cut-off date. Attackers deliberately prioritise versions they know will never be patched, and in most organisations the 2016 generation still carries the most critical roles - domain controller, file server, ERP or accounting server - so a single successful entry can affect the entire network.
There is a compliance dimension as well. Article 12 of Turkey's Personal Data Protection Law (KVKK, no. 6698) requires data controllers to take appropriate technical and administrative measures to keep personal data secure. Processing personal data on a server that no longer receives security updates is hard to defend as an appropriate measure once a breach happens. In the supervisory climate that followed Cybersecurity Law no. 7545, and under most cyber insurance policy terms, running a supported version is becoming a baseline expectation rather than a recommendation.
What this means for businesses in Turkey
Servers installed between 2016 and 2018 are still in daily service across offices on the Anatolian side of Istanbul. Some of this hardware does not meet the requirements of Windows Server 2025; in other cases the real blocker is not the operating system at all but the accounting, CRM or production-tracking application running on it. An upgrade carried out without written compatibility confirmation from the software vendor can halt operations for days.
For organisations that need more time, Microsoft has announced Extended Security Updates (ESU) for Windows Server 2016, delivered and managed through Azure Arc. ESU is a paid bridge rather than a destination: it provides only critical and important security updates for the period purchased, and excludes new features and general technical support.
What we recommend at Kamer Bilişim
- Inventory first, budget second. Put every Windows Server 2016 machine on one sheet with the role it carries and the applications it hosts. Licence and hardware decisions made before that list exists are almost always sized wrongly.
- Give each server one path and one date. There are three options: a clean migration to Windows Server 2022/2025, moving the workload to the cloud, or bridging with ESU until the migration is complete. Ask your software vendor for written compatibility confirmation before you decide.
- Test the rollback before you migrate. Take a full backup and verify it by actually restoring it. If some legacy servers cannot be upgraded at all, isolate them with network segmentation and tight firewall rules.
If you need help building a server inventory, drafting a migration timetable, or assessing whether your current infrastructure is ready for Windows Server 2025, you can reach us through our contact page. A migration planned before January is always cheaper than one carried out in a hurry.
Source: Microsoft Learn - Windows Server 2016 lifecycle page, and the Microsoft Windows Server Blog.
Source: Microsoft Learn