How to Protect Windows Server 2016 After Extended Support Ends

Windows Server 2016 leaves Microsoft's Extended Support on 12 January 2027. Each server you keep running has three paths. Upgrade or migrate it. Enroll it in Microsoft's Extended Security Updates through Azure Arc. Keep it under a documented exception with compensating controls. Whichever you pick, limit what can reach the server and check what changes on it until the path is done.

Updated 22 October 2026 by Mimic Networks. The outside sources sit at the end, each with its own date.

When does Windows Server 2016 support end?

Microsoft puts it plainly: "In accordance with the Microsoft Lifecycle Policy, extended support for Windows Server 2016 will end on January 12, 2027" (Microsoft). Windows Server 2016 follows the Fixed Lifecycle Policy (Microsoft Learn), and Microsoft defines what end of support means: "there will be no new security updates, non-security updates, or assisted support" (Microsoft Learn).

The server keeps running. What stops is the flow of fixes. After that date, every new flaw stays open on a server that isn't upgraded, unless the server is enrolled in Extended Security Updates and Microsoft rates the flaw Critical or Important.

What does Microsoft offer after 12 January 2027?

Microsoft announced Extended Security Updates for Windows Server 2016 on 25 February 2026, delivered through Azure Arc (Microsoft). Its Azure Arc documentation sets the terms (Microsoft Learn):

• What you get: "Critical and Important security updates for up to three years, through 2030."
• When: you can configure the updates in the Azure portal from 3 August 2026, and billing begins 13 January 2027.
• Which editions: Windows Server 2016 Standard and Datacenter.
• Who can buy: customers with Software Assurance through a volume licensing program, or with servers licensed through SPLA or a Server Subscription.

Extended Security Updates have limits. Microsoft calls the program "a last resort option" for running legacy products past the end of support, with Critical and Important updates as the Microsoft Security Response Center defines them (Microsoft Learn). They don't include new features or customer-requested non-security hotfixes, and "technical support isn't included in the ESU program" (Microsoft Learn). Microsoft lists Critical and Important security updates only, distributed "if and when available" (Microsoft Learn).

Microsoft's alternative is to move: "this period also presents the opportunity to upgrade to Windows Server 2025 or consider migrating to Azure" (Microsoft). Check what runs on the server too. SQL Server 2016 left Extended Support on 14 July 2026 (Microsoft), so a 2016 server running it carries two end dates.

How do you decide what to do with each server?

1. List every Windows Server 2016 machine and what it runs.Include the applications and their own support dates. CIS Safeguard 2.2 asks you to review software support "at least monthly, or more frequently" (CIS).
2. Upgrade or migrate where you can.That removes the end date instead of managing it. Microsoft names Windows Server 2025 or Azure.
3. Enroll the rest in Extended Security Updates, or write the exception.For a server you keep without updates, CIS Safeguard 2.2 says to "document an exception detailing mitigating controls and residual risk acceptance" (CIS).
4. Cut what can reach it.Remove internet exposure and restrict which systems and accounts can connect. CISA lists unsupported software in critical infrastructure as a bad practice and calls it "especially egregious in technologies accessible from the Internet" (CISA).
5. Add a compensating control on the server itself.Network controls limit who can reach the server. A control on the server limits what an exploit can change once it gets there. That's where virtual patching fits.
6. Watch CISA's catalog for Windows Server 2016 flaws.A flaw in CISA's Known Exploited Vulnerabilities catalog is one attackers are using. Put those first, whether the fix is an Extended Security Update or a compensating control.

Where does virtual patching fit?

Extended Security Updates fix the code, when Microsoft ships an update and you've tested and deployed it. Virtual patching protects a vulnerable system without changing its code, so it covers the time between a flaw going public and the update landing, and the flaws no update will reach.

Mimic Networks' Virtual Patching works in two forms, and both require baselining. Disruption blocks the specific mechanism an analyzed vulnerability depends on, so the exploit doesn't succeed. Containment limits what an exploit can do once it lands, so one safeguard can cover a whole family of exploits. It's part of Mimic's known-good enforcement approach. Before a safeguard goes live, Mimic replays it against the host's recorded behavior to show what it would block. No reboots required.

Mimic supports Windows Server 2016 and later, and Red Hat Enterprise Linux 8 and later. It runs alongside Extended Security Updates; it doesn't replace them.

What doesn't this cover?

• It doesn't fix the flaw. The update or the upgrade does that, and you should still plan for both.
• It doesn't cover servers older than Windows Server 2016, which is where Mimic's support starts.
• It doesn't inspect network traffic. Keep the segmentation and network controls that limit who reaches the server.
• It doesn't replace Microsoft support. Extended Security Updates don't include technical support either, so plan who you'll call.