Microsoft has confirmed that the January 2027 security update will be the final one for Windows Server 2016. After that date the platform receives no monthly security fixes, on any edition.
What happened
The end of extended support has been on the lifecycle calendar for years, but Microsoft has now stated it plainly in a message centre update: the January 2027 Windows security update is the last update available for this version, and devices running it will no longer receive the monthly security updates that protect against current threats. The cut-off covers Datacenter, Standard, Essentials and MultiPoint Premium alike, so there is no edition that keeps receiving patches.
Server 2016 reached general availability in October 2016 and left mainstream support in January 2022. The same date also ends support for the Essentials-specific features, including Remote Web Access, which several small offices still use as their remote access path.
Who is affected
Any organisation still running Windows Server 2016 in production, on physical hardware or as a virtual machine.
- File, print and line-of-business servers that were installed in 2016-2018 and never moved.
- Small offices using Windows Server 2016 Essentials for Remote Web Access or its dashboard.
- Virtual machines on Xen, Hyper-V or VMware hosts where the guest OS was set up once and left alone.
- Backup, CCTV, access control or accounting applications pinned to Server 2016 by a vendor's compatibility matrix.
What to do now
Inventory every Windows Server 2016 instance you are responsible for this month, then budget and schedule the replacement to Windows Server 2025 before December.
- List the servers, their roles, who owns the application on each, and whether the vendor supports 2025.
- Test the business application on Windows Server 2025 in a lab or a clone before committing to a migration date.
- Check the hardware: Server 2025 is the practical target, and older physical hosts may not have supported drivers.
- For anything that cannot move in time, isolate it, restrict inbound access and raise it as an accepted risk in writing.
- Do not assume extended security updates will be available on the same terms as previous generations; confirm the licensing position for your edition before counting on it.
What this means for South African businesses
Server 2016 is old enough that it is often the machine nobody has logged into for a year, running a file share or an ageing line-of-business app, and those are the systems that quietly become the weakest link in a ransomware path. An unpatched server in January 2027 is not a theoretical exposure: it is a permanent, publicly documented set of holes that will never be fixed. The realistic SME risk is a scramble in the first quarter, when hardware lead times and consultant availability are worst, so the planning window is now and not December.
Primary source: BleepingComputer report on the Windows Server 2016 end of support.