Windows Server 2016 reaches end of life on 12 January 2027. After that, no security patches, no bug fixes, no Microsoft support. The honest answer for most UK businesses of small businesses up to 100 staff is not to buy another on-prem server. It is to retire the box completely and move the four or five jobs it actually does onto Microsoft 365 and Microsoft Azure. The deadline is on the calendar. The decision about how you handle it is the one to make this quarter, not next autumn.
Hi, I’m Andy from Initial IT. We have been retiring on-prem servers for UK SMBs in Lichfield, Tamworth, Cannock and across Staffordshire and the West Midlands for the best part of a decade. This guide is the plain-English version of the conversation we have with most business owners who still have a 2016 box humming away in a cupboard.
Key takeaways
- Windows Server 2016 ends support on 12 January 2027. No more security patches, no bug fixes, no help from Microsoft.
- For most UK SMBs, the cheapest and lowest-risk move is to retire the server, not replace it. Microsoft 365 and Azure already do most of the jobs.
- The decision is a 2026 decision. Wait until autumn and you are buying hardware in a hurry.
- The business risks are cyber insurance, Cyber Essentials, audit and supplier expectations, not just “is it patched”.
- The five jobs most 2016 boxes still do (file shares, AD, print, line-of-business app, a bit of email) each have a sensible cloud destination.
What actually happens on 12 January 2027?
Microsoft stops shipping security updates for Windows Server 2016. The server will keep running. It will look exactly the same on the morning of 13 January. The difference is invisible and important: any new vulnerability discovered after that date stays unfixed forever, and you are running a system Microsoft has officially walked away from.
You can pay for Extended Security Updates (ESU) to buy time, the same way Windows 10 customers can today. ESU is a holding pattern, not a strategy. It gets more expensive each year, and it does not get you a single new feature or a smile from a Cyber Essentials assessor. Microsoft’s official lifecycle page spells it out.
Why this is a business problem, not just an IT problem
If your only worry is “will the server keep working”, the answer is yes. That is not the worry. The worry is the four places running unsupported software starts to bite long before any attack happens:
- Cyber insurance. UK SMB cyber insurance renewals now ask explicitly whether you are running supported operating systems. Some insurers will refuse to renew. Some will quietly drop a clause that matters.
- Cyber Essentials. Cyber Essentials certification requires supported software. Same for the SRA’s technology expectations for law firms, ICAEW guidance for accountants, and most sector-specific data rules.
- Supplier and customer expectations. Larger customers are starting to demand their suppliers certify they are running supported software. “Server 2016, but we are on ESU” is increasingly an awkward answer.
- Recovery and resilience. When something does go wrong, unsupported software means you cannot pick up the phone to Microsoft. Your IT partner is on their own.
None of that arrives as an emergency. It arrives as a deadline. By the time it bites, you are buying hardware in a panic.
Replace, or retire? The fork in the road most businesses get wrong
The instinct when a server reaches end of life is to buy another server. New box, same job, ten more years. That made sense in 2010. In 2026, for a business of small businesses up to 100 staff, it usually does not.
Most UK SMBs we look at have a Server 2016 box doing four or five distinct jobs. Each of those jobs has a sensible cloud destination that is cheaper to run, easier to manage, and meaningfully more resilient than the cupboard option. The honest exercise is not “what server do we buy next?”. It is “which of these jobs actually still needs a server at all?”.
Three caveats up front, because we are not absolutists about this:
- Some workloads genuinely need on-prem. Specialist line-of-business software, machine-tool controllers, certain healthcare applications. If yours is one, you keep an on-prem server and we get on with the Server 2022 or 2025 migration. That is fine and normal.
- Some businesses cannot move because of bandwidth. If your connection is genuinely unreliable, cloud is harder. Fix the connection first.
- Some workloads end up in Microsoft Azure, not Microsoft 365. A line-of-business application that genuinely needs a Windows Server can run as an Azure VM. Same software, no cupboard.
The four jobs your Server 2016 box probably still does, and where each one belongs
Walk into a typical Lichfield or Staffordshire business with a Server 2016 box and you will find it doing some combination of the following. Here is where each one usually ends up.
File shares (the H: drive)
This is the biggest job most 2016 boxes are still doing. A folder structure that has built up over a decade, mapped as the H: drive on every laptop, used by everyone. Destination: Microsoft 365 SharePoint and OneDrive. Same files, accessible from anywhere, with proper versioning, sharing rules and audit trails. The day you finish the migration is the day a stolen laptop stops being a real risk.
Active Directory and user logins
Your domain controller authenticates everyone who signs into a laptop. Destination: Microsoft Entra ID (formerly Azure AD) with Microsoft Intune joining laptops directly to the cloud. Conditional access stops sign-ins from unknown devices or risky locations. Both are bundled into Microsoft 365 Business Premium.
Print server
The bit nobody thinks about until it breaks. Destination: Microsoft Universal Print, also bundled in Business Premium. No more printer queues mysteriously stuck on the server in the cupboard.
The one line-of-business application that still needs a Windows Server
The legal practice management software. The accounting package. The bespoke industry-specific tool. If it genuinely needs Windows Server underneath, destination: an Azure virtual machine. Same software, same vendor support, no on-prem hardware, predictable monthly cost. Read our Azure migration cost worked example for what that looks like in pounds.
That mailbox database, or the legacy on-prem Exchange
If your Server 2016 box is still hosting any email, that one is easy. Destination: Microsoft 365 Exchange Online. We do the migration in a weekend, no email is lost, and the user experience improves immediately.
The honest sum: for most UK SMBs of small businesses up to 100 staff, replacing a Server 2016 box with another Server 2025 box is the most expensive choice on the table. Retiring it is cheaper to run, easier to manage, and stops the cupboard being a single point of failure.
What to do this quarter, calmly
Four steps that fit nearly every UK SMB we onboard for this:
- Audit what the server is actually doing. Every role, every service, every shared folder, every login dependency. We do this for free for businesses in Lichfield and the wider Midlands as part of an initial conversation.
- For each job, decide retire or replace. Most jobs retire. A small number replace into Azure or a new on-prem Server 2025 box.
- Plan the migration in waves. Files first, then user accounts, then printing, then any line-of-business app. Four to eight weeks for an SMB of 20 to 60 staff, calmly.
- Tidy security as you go. Cyber Essentials alignment, conditional access, proper backup of the cloud workloads. Free uplift while everything is moving anyway.
The thing to avoid: doing nothing until October 2026, then panic-buying a new server because there is no time for anything else. That route locks you into another decade of cupboard maintenance you do not need.
How we help
This is most of what our managed IT support work looks like right now. Server 2016 audit, retirement plan, migration in waves, Azure infrastructure where it earns its keep, and the cyber security work most providers leave switched off. If you would like an honest read on what your specific Server 2016 box actually does and where each job should go, book a 30-minute chat with me or call 01543 524 594. If you want the longer plain-English version of why most UK SMBs are heading to the cloud full stop, our free Cloud Guide is the place to start.
Frequently asked questions
When exactly does Windows Server 2016 end of life happen?
12 January 2027. After that date, Microsoft stops releasing security updates for the OS. Extended Security Updates (ESU) can extend the runway, but they get more expensive each year and they do not solve the underlying business risk.
Can I just buy Extended Security Updates and carry on?
You can, as a short-term bridge. ESU is a holding pattern, not a strategy. For most UK SMBs of small businesses up to 100 staff, the money is better spent on retiring the workloads to the cloud and avoiding ever having this conversation again.
Do I have to move to the cloud?
No. Some workloads genuinely need an on-prem Windows Server. For those, you upgrade to Server 2022 or Server 2025. The point of this article is that for most UK SMB workloads, that is not the case. File shares, identity, print and email all have better homes in Microsoft 365.
How long does a Server 2016 migration take for a small business?
For an SMB of 20 to 60 staff, a planned migration in waves usually takes 4 to 8 weeks end to end, including testing, communications and proper user training. Far calmer than a last-minute server purchase in December 2026.
What does it actually cost to move to Microsoft 365 and Azure?
Less than a new on-prem server in almost every case, once you include the hardware, the warranty, the cooling, the power, the backup target and the warranty refresh in five years. Our Azure migration cost worked example walks through the numbers for a typical 30-staff business.
Where can I read more from Microsoft about Server 2016 end of life?
Microsoft’s official lifecycle policy is at learn.microsoft.com. UK government advice on supported software for businesses is at the National Cyber Security Centre.
– Andy Price, Founder & MD, Initial IT · 01543 524 594 · hello@initialit.co.uk