Before January 12, 2027: triaging Windows Server 2016 by role

Three actions across eight server roles

Take a hypothetical land surveying firm, Pell Creek Surveying, with two offices and about 35 staff. Its 2016 estate is one 16-core Hyper-V host from 2017 (HV01) running four VMs: DC01 for Active Directory, DNS and DHCP; FS01 for file shares and print queues; RDS01, the session host the second office uses for Microsoft 365 Apps; and APP01, a project accounting application on SQL Server 2016. Every license came with the server (OEM), with no Software Assurance.

Every 2016 server gets one of three actions: rebuild on a new VM and cut over, upgrade in place, or buy ESU while a vendor or a project catches up.

Pell Creek's servers cover the first seven rows.

An in-place upgrade from Windows Server 2016 to 2025 runs from installation media, and a non-clustered server can jump the three versions in one pass. Clusters move one version at a time, so 2016 to 2025 takes three rolling upgrades. The language and the Server Core choice can't change during the upgrade, NIC Teaming has to come off first, and each upgrade needs its own license.

An in-place upgrade is the fastest path on the same hardware. It also keeps the 2017 disks, fans and power supplies, and its only way back is the backup taken before it starts. A rebuild costs a new VM, a license and a cutover. In return, the old server keeps running until the new one passes its checks, which is why every role that users touch gets a rebuild.

Every rebuild needs a host that can run the new version, so the host goes first. Microsoft supports a Windows Server 2025 guest only on a 2022 or later host, and a 2022 guest only on a 2019 or later host, so none of the replacement VMs belongs on HV01 while it runs 2016.

Pell Creek has two ways through. It can upgrade HV01 in place: the 2016 guests keep running on a 2025 host, but every guest goes down that weekend and the 2017 hardware stays. Or it can put a new host on 2025, build the replacements there, and retire HV01 when the last 2016 guest shuts down. On that path the OEM licenses stay with HV01 and keep covering the old VMs through the overlap, and old and new servers never compete for one host's memory.

Before an in-place host upgrade, run Get-VM | Format-Table Name, Version. A 2025 host starts VMs at configuration version 8.0 or later, so a guest carried over from a 2012 R2 host at 5.0 gets updated while it still sits on 2016. After the upgrade, leave the 8.0 guests alone until the host has run clean for a few weeks, because Update-VMVersion can't be undone.

Who can buy Windows Server 2016 ESU?

Windows Server 2016 ESU is sold only for Standard and Datacenter editions covered by Software Assurance or an equivalent Server Subscription. SPLA licenses from a hosting provider are excluded by name. OEM licenses don't qualify without Software Assurance, and Essentials isn't a supported edition. All three are common in small offices, and at Pell Creek the OEM licenses close ESU on every server.

ESU runs through Azure Arc, with the Connected Machine agent at version 1.62 or later. Enrollment opened on August 3, 2026, and billing starts January 13, 2027. It covers Critical and Important security updates for up to three years, through 2030, and leaves out technical support and nonsecurity fixes.

The agent needs outbound HTTPS to Microsoft Entra ID and the Arc service endpoints, directly or through a proxy or private link, plus www.microsoft.com/pkiops/certs on ports 80 and 443 for certificate updates. An application server with no internet route needs that firewall change before it can enroll. The license rule holds wherever the server runs, so a 2016 VM on hosted hardware can take ESU on its own Software Assurance license and can't take it through the host's SPLA.

At list price, Windows Server 2016 ESU costs $0.007132 per Standard core per hour and $0.041067 per Datacenter core per hour, effective August 1, 2026, with year two and three rates unpublished. Billing counts at least 16 cores per physical server and 8 per VM. A Standard physical-core license covers up to two VMs, and Datacenter covers every VM on the host.

A monthly bill uses 730 hours, which is $5.21 per Standard core. Datacenter undercuts Standard on a 16-core host at 11 VMs when Standard is licensed by physical core (six licenses, $5,997.73 a year), or at 12 VMs of 8 vCPUs or fewer when each VM is licensed by virtual core.

An office on OEM licenses buys new ones: Windows Server 2025 Standard for 16 cores has a suggested price of $1,176 and covers two VMs plus the Hyper-V host, so Pell Creek's four VMs need $2,352 in server licenses plus 2025 CALs, for a version supported to November 14, 2034. If the session host and the application server move into hosting, one $1,176 license covers the two VMs left in the office.

An office with Software Assurance has already paid for the server upgrade, because Software Assurance includes the right to move each covered license to the latest version. Every server that qualifies for ESU is already licensed to run 2025, so ESU buys time and no license. CALs carry their own Software Assurance, so a 2025 server still needs 2025 CALs for every user unless the CALs were covered too.

Microsoft's own pages disagree on whether a 2016 VM in Azure pays for ESU. The Lifecycle FAQ still calls ESU free for Azure VMs, while a March 27, 2026 licensing notice gives every ESU offer released on or after April 1, 2026 the same price in Azure and outside it. Get the answer in writing before a budget counts on it.

Arc bills ESU monthly, so a qualifying server can carry it for the months its rebuild needs. It fits a server pinned to 2016 by its vendor, or one that retires in the spring.

Promoting a new domain controller beside the old one

An in-place upgrade of a domain controller is allowed but not recommended. Promote a clean-installed server, move the roles, and demote the old one. Two checks decide whether a 2025 DC can join at all, so they run before anything is bought.

1. SYSVOL replication. On the PDC emulator, dfsrmig /getglobalstate has to report Eliminated (state 3), meaning SYSVOL replicates with DFSR. FRS was removed in Windows Server 2019, so a domain still on FRS blocks every newer DC. A domain created in the Windows Server 2003 era can still be on FRS if nobody migrated it, and reaching Eliminated can't be rolled back.
2. Functional level. Check with Get-ADForest | Select ForestMode and Get-ADDomain | Select DomainMode. Microsoft's functional levels matrix marks a 2025 DC "Not supported" at the 2012 R2 level, so both levels go to 2016 first, which needs every existing DC on 2016 or later. Microsoft's domain controller upgrade page still says a 2008 forest level is enough; follow the stricter matrix. Raising the forest from 2012 R2 keeps a rollback to 2012 R2.
3. Promotion. Build DC02 on a host that runs 2025 guests, join it, add the AD DS role, and promote it into the existing domain. Adprep runs on its own when the promoting account is in Schema Admins and Enterprise Admins.
4. Operations master roles. Find the holders with Get-ADDomain | FL InfrastructureMaster, RIDMaster, PDCEmulator and Get-ADForest | FL DomainNamingMaster, SchemaMaster, then move all five with Move-ADDirectoryServerOperationMasterRole -Identity DC02 -OperationMasterRole 0,1,2,3,4.
5. Time source. The domain's time follows the PDC emulator. Point DC02 at an outside source with w32tm /config /manualpeerlist:"pool.ntp.org" /syncfromflags:manual /reliable:yes /update, and set DC01 back with w32tm /config /syncfromflags:domhier /reliable:no /update. If w32tm /query /source on DC02 answers VM IC Time Synchronization Provider, it is still taking its time from the Hyper-V host. Set Enabled to 0 under HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\VMICTimeProvider on DC02 and restart the Windows Time service, or turn off DC02's time synchronization integration service from the host with Disable-VMIntegrationService -VMName DC02 -Name "Time Synchronization", then rerun w32tm /query /source.
6. DHCP. From DC02, run Export-DhcpServer -ComputerName DC01 -File C:\dhcp\dhcp.xml -Leases, then stop and disable the DHCP service on DC01 so two servers never lease from one scope. Import with Import-DhcpServer -File C:\dhcp\dhcp.xml -BackupPath C:\dhcp\backup -Leases (the backup path is mandatory) and authorize DC02 with Add-DhcpServerInDC. The imported scopes still hand out DC01's address as the DNS server (option 6). Change it at the server level and in every scope, because a scope-level setting overrides the server-level one.
7. Demotion. Leave DC01 running for a full working week. With the default eight-day lease, clients renew on day four and pick up DC02 as their DNS server inside that week. Once dcdiag and repadmin /replsummary come back clean, demote DC01.

Any device with DC01's IP address typed in as its DNS server stops resolving names the day DC01 is demoted: copiers, printers, the VPN appliance, servers with static settings. List every static DNS entry first, or move DC01's address onto DC02 afterward, which costs its own change window.

Copier scan jobs on a rebuilt file share

PCs follow a rebuilt file server without trouble. Copiers, old NAS boxes and older applications break, because Windows Server 2025 requires SMB signing on every inbound and outbound connection by default, turns off guest fallback, and no longer includes NTLMv1. SMBv1 isn't installed by default on 2019 or later. The fix is signing turned on at the device, or a firmware update or replacement, with signing left on at the server.

Find those devices on FS01 while it still runs 2016:

• Set-SmbServerConfiguration -AuditSmb1Access $true logs every SMBv1 attempt as event ID 3000 in the Microsoft-Windows-SMBServer/Audit log.
• Get-SmbSession | Select-Object ClientComputerName, ClientUserName, Dialect lists each connected client and its SMB dialect.
• Security event 4624 with NTLM V1 in the Package Name field names each device still authenticating with NTLMv1.
• None of these shows whether a device can sign, so send one scan from each copier to a test share on the new 2025 server.
• Keep the audit running across a month end, so the copier that only scans invoices shows up.

Pell Creek's copiers also email scans through an SMTP relay on FS01. Windows Server 2025 removed SMTP Server with no replacement in the operating system, so the relay moves to Exchange Server or a non-Microsoft SMTP service, and each copier gets the new address before the cutover weekend.

Storage Migration Service inventories FS01, transfers files, shares and permissions, then cuts over so the new server takes FS01's name and IP address and mapped drives keep working. The orchestrator and destination should run 2019 or later. FS01 keeps its files in a maintenance state after cutover, which is the way back. Print queues move with Printbrm from %WINDIR%\System32\Spool\Tools: back up with Printbrm -s \\FS01 -b -f C:\temp\FS01.printerExport and restore with Printbrm -s \\FS02 -r -f C:\temp\FS01.printerExport while the new server is still FS02, so the queues take the name at cutover.

An in-place upgrade of Windows Server 2016 on the file server is supported, and it lands the same SMB defaults on the same copiers with no old server to fall back to. A copier that can't sign needs firmware or a replacement, with lead time, so the audit starts in the first week.

Why Microsoft 365 Apps pushes Remote Desktop to 2025

On 2022 and 2025, Microsoft 365 Apps support lasts as long as that version's mainstream support. Both older versions have already lost it:

A 2019 or 2022 session host built in late 2026 starts on a Microsoft 365 Apps build that no longer changes.

Remote Desktop licensing moves with the host. 2016 RDS CALs can't license a 2019, 2022 or 2025 host, and 2025 RDS CALs need a 2025 license server, which also holds older CALs. New hosts get a 120-day grace period. A mixed-version farm isn't supported, so every Remote Desktop server changes in the same window.

If a vendor hasn't added 2025 to the supported list for an application published on the host, that list wins, and 2022 becomes a patched bridge: the operating system is supported to October 14, 2031, with Microsoft 365 Apps security updates to October 10, 2028.

When the application vendor supports nothing newer

If the vendor's supported list stops at Windows Server 2016, the choices narrow to ESU or pressure on the vendor. Ask the vendor for a committed date when a newer version joins the list, and price one ESU year as the cost of waiting. A vendor that supports only 2016, on a license without Software Assurance, leaves the server unpatched after January 12, 2027 wherever it runs. Moving it to hosted hardware leaves its patch status as it was.

When the list names a newer version, a Windows Server 2025 license carries down-version rights, so buy 2025 and install the version the vendor names. Test the application on a restored copy before choosing 2025 over 2022, because 2025 removed SMTP Server, NTLMv1 and Windows PowerShell 2.0 and turns off TLS 1.0 and 1.1 by default. The database needs the same test, since SQL Server 2016 extended support ended July 14, 2026.

We built our cloud to run software that was never designed for one. After a rebuild on a newer version, our engineers tune the environment around the application until it runs well, and the application stays as its vendor built it.

Put the software both offices use in hosting

When the Hyper-V host is as old as the operating system, the rebuilt servers need a new or upgraded host either way. An application server rebuilt in hosting takes the same install work as a VM on a new host in the closet, and it comes off that host's memory, disk and license count.

Trinsic Technologies, INC. has operated since 2005, starting in managed IT, and our engineers came up through that work. We host older business software that companies have decided to keep, such as on-premises accounting and timekeeping applications reached from several sites, on Windows or Linux, on hardware we own.

Our engineers patch the hosted application and coordinate access when its vendor needs to connect, and database work, backups and restores come to us as tickets (hosting for business applications). Before cutover, they design the target environment, present it, and test it repeatedly with the staff who use the application (how Petrichor runs a migration). The domain controller, DHCP, print queues and scan targets stay in the office, and we build hybrid setups that connect them to the hosted systems.

One licensing rule applies: licenses without Software Assurance, such as OEM, can't use Microsoft's Flexible Virtualization Benefit on a provider's shared servers, so Pell Creek's OEM licenses stay with HV01.

Leave a server where it is when:

• The office has one internet link and no backup link, so a hosted application goes down whenever the link does.
• It depends on hardware plugged into the server, such as a USB license key or a serial device.
• A hosted or virtualized install voids the vendor's support.
• It has to survive the loss of an entire facility. Everything we host runs in one data center, so that server belongs with a provider that has several.
• Azure already runs it, and Microsoft confirms in writing that 2016 ESU comes with the VM.

Our engineers say so when hosting a server is a bad idea, and they point you to someone else when the job sits outside what we do.

Cutover weekends, counted back from January 10

We start a customer's migration with the least risky environment and slow down anyone who wants to hand over production on the first day. The same logic orders this calendar: the host goes first because every rebuild needs it, the domain controller promotion adds a server and removes nothing, and the two servers staff work in all day, the application and the session host, come last.

Before the first weekend, record each server's role and license type, start the SMB and NTLMv1 audit, and run the SYSVOL and functional level checks. Confirm the vendor's supported versions, and order the new host if HV01 is being replaced, along with the 2025 licenses, CALs and RDS CALs. Enroll any server that qualifies for ESU in Arc well before January 13. On earlier ESU offers, late sign-ups were back-billed to the start of the term, so waiting saves nothing. Through November, rehearse the application cutover on weekday evenings on a restored copy, with the staff who use it.

Take a restorable backup of each server before its weekend. On the new-host path, HV01 powers off once users sign off on the application and the session host. Ten weekends remain from November 7, and the plan uses six. The spare weekend is there because one failed cutover without it becomes a server running past the date. Starting later, re-date the rows, keep the order, and leave January 9 and 10 empty.

Book a call with a consultant and bring your server list: each machine's role, its license type (OEM, volume licensing with Software Assurance, or SPLA), the age of the host it runs on, and the versions its application vendor supports. The engineer will tell you which servers belong in hosting and which should be rebuilt where they stand.