Windows Server 2016 is nearing end of support: build a realistic migration plan

January 12, 2027 is more than a calendar date

Windows Server 2016 reaches the end of extended support on January 12, 2027. After that date, servers no longer receive regular security updates or the standard product support associated with the release. The real risk is not only a missing patch; it is discovering too late that a critical service depends on a system nobody documented.

A realistic migration starts with an inventory of roles, flows, service accounts, certificates, backups and applications. It ends with business validation and a tested rollback plan. Bringing up a new server without treating dependencies is a transfer of risk, not a migration.

• Microsoft — Windows Server 2016 lifecycle ↗
• Microsoft — Planning for end of support ↗

Build an inventory you can actually use

Do not start with a list of server names alone. For every instance, record the edition, build, roles, applications, ports, owners, criticality, RPO/RTO, backup method and migration target. A server that appears idle may still host an SMTP relay, scheduled task or certificate authority.

Get-ComputerInfo -Property WindowsProductName,WindowsVersion,OsBuildNumber,
  CsName,CsDomain,OsLastBootUpTime

Get-WindowsFeature | Where-Object InstallState -eq 'Installed' |
  Select-Object Name,DisplayName,InstallState

Get-Service | Where-Object Status -eq 'Running' |
  Sort-Object Name | Select-Object Name,DisplayName,StartType

Choose a clean install, role migration or in-place upgrade

A side-by-side build is usually the most predictable option: the old server remains intact while the new one is tested, and rollback can be a controlled role, DNS or traffic change. Role migration fits files, DHCP, selected databases and infrastructure services when Microsoft’s procedures are followed.

An in-place upgrade can preserve roles and settings, but it increases the blast radius. Drivers, backup agents, antivirus, storage filters and old software can make the operation unsupported. Verify the exact path, editions, languages and installed roles before choosing it.

Active Directory: add before removing

For a domain controller, add a current controller first, verify replication and transfer FSMO roles before decommissioning Windows Server 2016. A domain controller is not an ordinary member server: DNS, SYSVOL, sites, certificates, time and LDAP dependencies must be validated independently.

repadmin /replsummary
repadmin /showrepl * /csv
dcdiag /e /c /v
netdom query fsmo

Get-ADDomainController -Filter * |
  Select-Object HostName,OperatingSystem,IsGlobalCatalog,Site

• Related guide — Kerberos and RC4 in Active Directory →
• Related guide — Active Directory security assessment →

Files, DHCP, IIS and databases: document what breaks

For a file server, measure ACLs, shares, quotas, DFS paths, replication tasks and locks. For DHCP, export scopes, reservations, options and AD authorization. For IIS, record certificates, pools, identities, bindings and secrets. For SQL Server, validate versions, SQL Agent jobs, accounts, connection strings and maintenance windows.

Export-DhcpServer -ComputerName SRV2016 -File C:\Temp\dhcp.xml -Leases
& $env:windir\system32\inetsrv\appcmd.exe list site /config /xml > C:\Temp\iis-sites.xml
Get-SmbShare -CimSession SRV2016
Get-SmbShareAccess -Name Data -CimSession SRV2016

Windows Server 2022 or 2025?

Windows Server 2022 remains a stable target when the application vendor certifies it or the team wants to minimize change. Windows Server 2025 is relevant for a longer lifecycle, but confirm compatibility for agents, backup tools, drivers and clinical or industrial applications.

The version number is not enough. A supported target must also meet virtualization, encryption, networking, storage, licensing and monitoring requirements. Obtain written vendor confirmation for applications that cannot be easily stopped.

• Microsoft — Windows Server release information ↗
• Microsoft — Upgrade and migrate roles ↗

ESU is a bridge, not a strategy

Microsoft has announced Extended Security Updates for some Windows Server 2016 scenarios, including through Azure Arc. This can reduce risk during a complex migration, but it does not fix an abandoned application, weak configuration or undocumented dependency. Treat it as an exception with an exit date, owner and budget.

If you choose ESU, document covered servers, activation method, updates actually received, compliance controls and the replacement plan. Do not let temporary licensing become a reason to keep an old system indefinitely.

• Microsoft — Windows Server 2016 ESU announcement ↗

A four-wave migration plan

For every wave, define an approved change, a rollback decision-maker and business validation. A successful migration is measured by service continuity, not by whether the new server boots.

Post-migration health checks

• Compare logs and performance with the pre-migration baseline.
• Test client connections, scheduled tasks, certificates and relays.
• Validate the new server backup and perform a representative restore.
• Remove old DNS records, AD objects, accounts and firewall rules only after observation.
• Keep the decision, results and exceptions in operational documentation.

Get-WinEvent -LogName System -MaxEvents 200 |
  Where-Object LevelDisplayName -in 'Error','Warning'
Test-NetConnection app.example.local -Port 443
Get-SmbSession
Get-DnsServerResourceRecord -ZoneName example.local

Decision checklist

The end of Windows Server 2016 is an opportunity to reduce operational debt. Treating inventory, dependencies and testing as one project avoids a rushed January 2027 migration and leaves a platform that is easier to back up, monitor and secure.

• All Windows Server 2016 instances are inventoried and ranked by criticality.
• Every application has a supported target and an owner.
• Network, DNS, certificates, accounts and backup dependencies are documented.
• The migration path and rollback were tested on a pilot.
• ESU exceptions have an end date and do not replace an exit plan.
• AD controllers, file servers, DHCP, IIS and databases are validated separately.

• Service — Microsoft 365 and Active Directory security assessment →
• Related guide — Why Microsoft 365 is not a backup →