Windows Server 2016 Gets Its Final Security Update in January
Microsoft has confirmed that the January 2027 security update will be the last one for every edition of Windows Server 2016. Here is a month-by-month plan for the next eleven weeks and the layers that protect any server you cannot move in time.
Here Is How a Countdown Plan and Layered Defenses Keep Older Servers From Becoming Your Weakest Link
Plenty of small and midsize businesses still have a Windows Server 2016 machine doing quiet, important work: a file share, a line-of-business application, a domain controller in a branch office. Microsoft has now put a firm date on when those servers stop getting security fixes, and it is about eleven weeks away.
We based this Pick on BleepingComputer’s coverage of Microsoft’s Message Center notice.
The key dates
- October 2016: Windows Server 2016 became generally available on October 12, 2016, a month after its debut at Microsoft Ignite.
- January 2022: Mainstream support ended.
- January 12, 2027: Extended support ends. Microsoft says the January 2027 security update will be the last one for this version.
- Which editions: All of them, including Datacenter, Essentials, MultiPoint Premium and Standard. Essentials-specific features such as Remote Web Access lose support on the same date.
- Microsoft’s suggested destination: Windows Server 2025, which reached general availability in November 2024 and is supported until November 14, 2034, with mainstream support ending in November 2029. A free 180-day evaluation is available.
A countdown plan
- Now through mid-November: find them. List every physical and virtual server running Windows Server 2016, what runs on it, who depends on it and whether the application vendor supports a newer server version.
- Late November: decide each server’s fate. For each one, choose upgrade in place, rebuild on a newer version, move the workload to a cloud or hosted service, or retire it. Check licensing and hardware before you commit.
- December: move the easy ones. Migrate file shares, print servers and simple roles first, and test backups of anything you are about to change.
- January: install the last update and close out. Apply the January 2027 update to anything still running 2016, and document every server that will remain after that date along with the reason and a target date to move it.
Layers for the servers you cannot move in time
Some servers will still be running 2016 after January, usually because of an application that cannot move yet. An unpatched server is not safe on its own, so surround it with layers that each block a different path:
- Isolate it. Put it on its own network segment and allow only the connections the application actually needs.
- Keep it off the internet. No direct remote desktop, web or file sharing access from outside. Use a VPN or remote access gateway with multifactor sign-in.
- Shrink who can log in. Remove unneeded admin accounts, use separate admin credentials, and require multifactor authentication wherever possible.
- Watch it closely. Keep endpoint detection and response running and send its logs somewhere a person or service reviews them.
- Back it up separately. Keep tested, offline or immutable backups so a compromise is a restore, not a disaster.
What this means for your company
An unsupported server does not fail on the day support ends. It simply stops getting fixes, and every new flaw found after that stays open for good. If you plan now, most Windows Server 2016 machines can be moved in an orderly way before January. The few that cannot should be walled off and watched until they are replaced. Microsoft products are named here because this is a Microsoft lifecycle change, but the same planning and layers apply to any operating system reaching end of life.
Need help inventorying your Windows Server 2016 machines and planning a migration before support ends? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
