Server 2016 ends
12 Jan 2027. Now what?

Windows Server 2016 reaches end of support on 12 Jan 2027 — after that Microsoft ships no more security updates, fixes or support. Windows Server 2019 follows on 9 Jan 2029, and Windows Server 2022 on 14 Oct 2031. Extended Security Updates can buy up to three more years of security-only patches, but they are a paid bridge, not a fix.

Windows Server Extended Security Updates are licensed per core (with a 16-core-per-server minimum) at a flat ~100% of the full per-core licence price each year — this is Microsoft’s established Windows Server model, not the escalating "75/100/125" figure that circulates on third-party blogs, and not the Windows 10 per-device doubling. Crucially, Microsoft has not published a £/$ figure for Server 2016 ESU and points buyers to their account team, so this calculator shows ESU as a clearly-labelled range around your own per-core anchor rather than a false-precise number. You also need active Software Assurance to buy it.

No — that is a Windows 11 client confusion. Windows Server 2025 does not impose a hard hardware gate: TPM 2.0 and Secure Boot are listed as "required only for certain features" (BitLocker, Credential Guard, the optional Secured-core profile), not to install, and there is no Windows 11-style approved-CPU list. The only genuinely new CPU requirement is the SSE4.2 and POPCNT instruction sets, which every Intel chip since ~2008 and AMD since ~2011 already has — so essentially all 2016-era servers qualify. A direct in-place upgrade from Server 2016 to 2025 is supported via installation media.

It depends on the estate, and this tool is deliberately honest about it. If the servers are sound and not domain controllers, an in-place upgrade to Server 2025 is usually the cheapest compliant path — you avoid both ESU and new hardware, paying only for the 2025 licences and the upgrade labour. A short ESU bridge makes sense when you need time. A refresh wins when the hardware is old/out-of-warranty, when a host has fewer than 16 cores (you still pay the 16-core minimum, so consolidation pays), or when app-compatibility argues for a clean build. Domain controllers should be clean-installed and promoted, not upgraded in place.

No. Windows Server workloads running in Azure — Azure VMs, Azure Local, Azure VMware Solution, Azure Dedicated Host, Azure Stack Hub/Edge and similar — receive Extended Security Updates at no additional cost. Note that "ESU enabled by Azure Arc" is different: Arc is the paid monthly channel for delivering ESU to on-premises servers, not a free entitlement.

Running an unsupported server OS in scope is an automatic Cyber Essentials failure unless it is removed or internet-isolated, and the scheme requires critical/high vulnerabilities to be patched within 14 days. PCI DSS v4.x requires vendor-supported software: requirement 12.3.4 (an annual review of end-of-life technology) and 6.3.3 (patch critical vulnerabilities within one month), both mandatory since 31 March 2025. Unsupported systems can also affect cyber-insurance cover. ESU restores security-update eligibility, but the exposure and the hard end of ESU (around three years out) still need planning.

The lifecycle dates, the per-core/16-core-minimum rules, the Software-Assurance prerequisite, the Azure free-ESU list, the flat ESU model and the no-hardware-gate finding are all taken from primary Microsoft documentation and cross-checked in an adversarial fact-check pass (July 2026). The maths is deterministic and test-covered. What is NOT asserted as fact: the £ ESU price (unpublished — shown as a range around your editable anchor) and your hardware/labour costs (your own estimates). A Servnet specialist confirms firm UK pricing before you commit.