Monday, October 26, 2026
News

Windows Server 2016 ends Jan 12: the ESU rules that set the bill

Microsoft's 90-day reminder says to upgrade to Windows Server 2025. For servers that cannot move in 80 days, here are the Extended Security Updates terms, and what a host and a VM cost.

CRT monitor turned off

Windows Server 2016 gets its last security update on January 12, 2027, 80 days from today. Microsoft's 90-day reminder, posted in the Windows message center on October 14 and picked up by BleepingComputer this week, covers every edition: Datacenter, Standard, Essentials and MultiPoint Premium. Support for the Essentials features, Remote Web Access included, stops the same day. Microsoft wants customers on Windows Server 2025, which has extended support to November 14, 2034.

Not every 2016 server can move by January. o365hq points out that a rolling cluster upgrade has to step through each release, from 2016 to 2019 to 2022 to 2025, and that Windows Server 2025 will not run on processors without SSE4.2 and POPCNT support. For those servers, Microsoft sells Extended Security Updates (ESU) for the Standard and Datacenter editions only. Essentials and MultiPoint Premium get no paid extension.

The terms that decide the cost

Microsoft's Azure Arc documentation sets out the basics. ESU brings Critical and Important security fixes for up to three years, through 2030, and nothing else: no new features and no nonsecurity hotfixes. Servers can be set up for ESU in the Azure portal now (it opened on August 3), and Arc billing begins on January 13, 2027. Servers need the Azure Connected Machine agent at version 1.62 or later.

The license rule rules some companies out. Microsoft requires Software Assurance through an Enterprise Agreement, EAS, EES, Server and Cloud Enrollment or Open Value. Servers licensed through SPLA or a Server Subscription do not need it.

Late enrollment does not save money. Jimber says Arc ESU set up after January 12 is billed for every month back to January 13, and o365hq says late licenses are billed back to the end-of-support date. CloudServus says year two and year three can only be bought on top of the earlier years. Microsoft's own FAQ for the Windows Server 2012 program said the same thing: customers who join late pay for the months they missed.

o365hq says moving to Azure is no longer a free way out either. Microsoft gave 2012 customers ESU at no extra charge on Azure VMs. According to o365hq, that does not apply to 2016, which gets an Azure bill plus an ESU bill.

What a host and a VM cost

None of the Microsoft pages we read lists a 2016 ESU price. Two Microsoft partners, o365hq and CloudServus, quote the same year-one figures: $124 per two-core pack for Standard and $720 per two-core pack for Datacenter. o365hq cites Microsoft's US price list for October 2026. Both say the minimum is 16 cores for a physical server and 8 virtual cores for a VM, and o365hq says Datacenter can only be licensed by physical core.

What you cover Cores billed Year-one cost
One Standard VM 8 $496
Ten Standard VMs 80 $4,960
One Standard host 16 $992
One Datacenter host 16 $5,760
Two Datacenter hosts 32 $11,520

Jimber, working from Arc's monthly rates, gets close to the same numbers: about $1,000 a year for a 16-core Standard host and about $5,755 for Datacenter. A Datacenter host costs about 5.8 times a Standard one, so a cluster of Datacenter hosts kept alive for a handful of old VMs is the expensive case. Jimber contrasts the old ESU model, which charged more each year, with a flat rate for all three years, and tells buyers to get their reseller to confirm in writing which one applies to their agreement.

Other parts of the 2016 stack end on the same date. Jimber lists .NET Framework 4.6.2, Hyper-V Server 2016 and WSUS running on 2016.

What IT teams should do

  1. Count every Windows Server 2016 instance, physical and virtual, with its edition and core count. Flag Essentials servers using Remote Web Access, which have no ESU option.
  2. Check that each server you may keep has Software Assurance, SPLA or a Server Subscription. If it has none, ESU is not available and the server has to move.
  3. Get a written ESU quote from your Microsoft partner for year one and the escalation for years two and three. Use the table above as a rough check.
  4. Onboard the servers you will keep to Azure Arc now, with agent 1.62 or later, so coverage starts on January 13 and there is no back-bill to settle later.
  5. Give every ESU server a retirement date. The program ends in 2030, and Jimber says Arc charges end within five business days once a server is deactivated.

Related: Microsoft's October 13 end-of-support list and the Exchange fix after October's Windows Server updates.

Sources