Windows Server 2016 end of support on 12 January 2027: what to do with your .NET application

Somewhere in your company, in a server room or with a hosting provider, there is a server nobody likes to touch. It runs the business application, the database, and perhaps a few scheduled jobs that import or send something every night. It has worked for years, which is exactly why nobody dares to touch it.

If it runs Windows Server 2016, the deadline is known: on 12 January 2027, Microsoft stops releasing security updates.

What exactly happens on 12 January 2027

• No more security updates. Not for new vulnerabilities, nor for ones yet to be discovered.
• No more fixes or technical support from Microsoft.
• The server keeps running. Nothing switches off that day.

That last point is the dangerous one. Because nothing happens, it is easy to put off. And a server without updates becomes an easier target every month.

Why this is a business problem, not just an IT one

• Vulnerabilities stay open for good. Attackers keep close track of which systems no longer get updates. What it looks like when someone gets in is covered in the article on data breaches.
• Insurance and audits. Cyber insurers and auditors increasingly ask whether you run unsupported systems.
• Customers and tenders. Large customers ask the same in supplier security questionnaires, and “yes, but it works” is not a good answer.
• Software vendors. Vendors of the software running on that server stop supporting installations on the old system.

Four options

Option	What it means	Effort	When it makes sense
Upgrade to Windows Server 2025	A new operating system on the same or new hardware	Medium	When the application has to stay on your premises
Extended Security Updates (ESU)	A paid Microsoft programme, via Azure Arc	Small, but paid	As a bridge while the real solution is prepared
Move the server to Azure as is	The same server as a virtual machine in Azure	Small to medium	When the old hardware needs to go quickly
Modernise	App on App Service, database on Azure SQL, current .NET	Largest	When the application needs to keep evolving anyway

A few notes on the table:

• Extended Security Updates are a bridge, not a solution. Microsoft offers them as a paid option through Azure Arc. They buy time, but the server stays old, and in a year or two you are back where you started.
• Moving the server to Azure as is solves the old hardware, but not the old operating system. It still needs upgrading or protecting.
• Modernising is the most work, but it is the only option after which there is no server left to patch. Microsoft looks after the operating system under App Service and Azure SQL. If the application runs on the old .NET Framework, this is a good moment to migrate to .NET 10 as well. And if it runs on .NET 8 or 9, end of support is close there too.

Decide per application, not per server

An old server rarely runs just one thing. Usually there is a web application, a database, a few scheduled jobs and the odd shared folder. They don’t all have to go the same way.

A typical outcome looks like this:

• The web application moves to App Service.
• The database moves to Azure SQL.
• Scheduled jobs move to Azure Functions.
• Shared folders move to SharePoint or OneDrive.
• Whatever nobody uses is switched off. There is more of that than anyone thinks.

What it will cost each month on Azure, and how to keep the bill from growing for no reason, is covered in the article on reducing Azure costs.

How to start

1. InventoryEvery server and what runs on it
2. DecideFor each application separately
3. MoveWithout downtime
4. Switch offThe old server only at the end

The deadline is 12 January 2027, and the inventory, the decisions and the move take weeks, not days. The old server is switched off only once everything works in its new place and it is certain nothing was forgotten.

What you can do this week

Make a list of all your servers. For each one, write down the Windows version, what runs on it, who is responsible for it and who knows how it works.

Most companies discover at least one server nobody can quite explain, and at least one application only one person understands.

How we work

This is exactly what we do: we move .NET applications from old servers to Azure, so there is no server left to patch, and we move them to current .NET along the way when it makes sense. We start with the inventory and a decision per application, move without downtime, and only then switch off the old server. The first step is a free 30-minute call.

Sources

• Planning ahead for Windows Server 2016 end of support, Microsoft, February 2026