Windows Server 2012 R2 and Windows Server 2016 still run file servers, domain controllers and line-of-business applications in many organisations. Both are at the end of their lifecycle: 2012 R2's paid security update programme finishes in October 2026, and 2016 leaves extended support in January 2027. This guide sets out the dates, the Extended Security Update (ESU) options, the supported upgrade paths and a practical migration checklist.
| Windows Server 2012 R2 | Windows Server 2016 | |
|---|---|---|
| Mainstream support ended | 9 October 2018 | 11 January 2022 |
| Extended support ends | Ended 10 October 2023 | 12 January 2027 |
| ESU coverage | Final year runs to 13 October 2026 | Up to three years, through 2030, via Azure Arc |
| Direct in-place upgrade to | 2016, 2019 or 2025 | 2019, 2022 or 2025 |
When does support end for Windows Server 2012 R2 and 2016?
Windows Server 2012 R2 extended support ended on 10 October 2023, and its third and final year of Extended Security Updates covers updates up to 13 October 2026; Windows Server 2016 mainstream support ended on 11 January 2022, and its extended support ends on 12 January 2027, according to Microsoft's lifecycle pages.
Microsoft's Windows Server 2016 lifecycle page lists the 2027 date for Standard, Datacenter and Essentials. Dates on lifecycle pages are shown in Pacific Time, so the final day can appear one day later in some time zones.
Cause and effect: after extended support ends, Microsoft stops releasing security updates for that version unless a server is enrolled in ESU. New vulnerabilities then stay open, which matters most for internet-facing roles, domain controllers and anything holding personal data.
What happens when Windows Server reaches end of support?
When Windows Server reaches end of support, the operating system keeps running and stays activated, but Microsoft stops releasing security updates, non-security fixes and technical support for it, unless the server is covered by a paid or Azure-included Extended Security Update programme that delivers critical and important security patches only.
Nothing switches off on the end date. The risk builds gradually as vulnerabilities are published and left unpatched, and as newer software, including backup agents, antivirus and line-of-business applications, stops supporting the old version.
Compliance is the second effect. Many security frameworks, cyber insurance policies and audits expect supported, patched operating systems, so an out-of-support server can become a finding even if it has never been attacked.
Can you get Extended Security Updates for 2012 R2 and 2016?
Yes, with conditions: Windows Server 2012 R2 ESUs run for three years, up to 13 October 2026, and Windows Server 2016 ESUs are available through Azure Arc for up to three years, through 2030, with Software Assurance required for on-premises servers and billing starting on 13 January 2027.
For 2012 and 2012 R2, Microsoft's Extended Security Updates overview explains that workloads moved to Azure virtual machines receive ESUs at no extra charge beyond the VM cost, while other servers need a purchased ESU subscription and a product key installed on each server.
For 2016, Microsoft's Azure Arc ESU documentation states that ESUs cover Standard and Datacenter, can be configured from 3 August 2026, and include critical and important security updates only. ESU is a bridge for a planned migration, not a way to keep an old server indefinitely.
What are the supported upgrade paths from 2012 R2 and 2016?
Microsoft supports in-place upgrades from Windows Server 2012 R2 to 2016, 2019 or directly to 2025, but not to 2022, and from Windows Server 2016 to 2019, 2022 or 2025; Windows Server 2025 allows non-clustered servers to jump up to four versions at once, while earlier targets allow two.
Microsoft's Windows Server upgrade overview also sets these rules:
- The edition stays the same by default; you can move Standard to Datacenter during an upgrade, but not Datacenter to Standard.
- Cluster OS rolling upgrades advance one version at a time.
- Upgrading into an evaluation copy is not supported; evaluation versions need a clean install.
Advanced nuance: an in-place upgrade carries over everything, including old configuration and unused roles. For domain controllers, many administrators prefer adding a new server and moving roles rather than upgrading in place, as covered in our domain controller migration guide.
When does buying a 2012 R2 or 2016 licence make sense?
Buying a Windows Server 2012 R2 or 2016 licence can make sense when a specific application, device driver or vendor certification only supports that version, when you need to license an extra server in an existing environment for a short period, or for an isolated lab, but it is not a sensible choice for a new long-term production server.
If you do choose an older version, plan around its dates. A Windows Server 2016 Standard licence still has security updates until January 2027 and an Azure Arc ESU route after that, while a Windows Server 2012 R2 Standard licence suits only legacy systems that are isolated or being retired.
What we commonly see: buyers choose an older version only because a vendor said so years ago. Ask the vendor whether a newer release is now supported; many have certified 2019 or 2022 since. Downgrade rights under a newer licence depend on how the licence was acquired and Microsoft's terms for that channel, so check them rather than assuming they apply.
How do you plan a migration off Windows Server 2012 R2 or 2016?
Plan a migration by listing every server and the roles, applications and dependencies on it, confirming that vendors support the target version, choosing between in-place upgrade and migration to a new server, testing the move in a lab or on a copy, taking verified backups, then migrating and decommissioning the old server once everything is checked.
- Inventory: record each server's version, edition, roles, installed applications and who uses it.
- Check compatibility: confirm application and driver support for the target version with each vendor.
- Choose the path: in-place upgrade within Microsoft's supported matrix, or a new server with role migration.
- License the target: buy the new server licence and matching CALs; CALs must be the same version as the server or newer.
- Back up and test: take a verified backup and test the upgrade or migration on a copy first.
- Migrate and retire: move the workload, monitor it, then remove the old server from the domain.
For the target, see our Windows Server licence keys and the Standard vs Datacenter comparison. Remember that CALs follow the server: upgrading to 2022 or 2025 generally means CALs of that version, as our CALs guide explains.
Frequently asked questions
Will Windows Server 2012 R2 stop working after ESU ends?
No. Windows Server 2012 R2 keeps running and stays activated after its final ESU year, which runs to 13 October 2026. What stops is the supply of security updates from Microsoft, so new vulnerabilities remain unpatched. Isolate any remaining 2012 R2 servers and migrate them as soon as practical.
Can I upgrade Windows Server 2012 R2 directly to 2022?
No. Microsoft's upgrade matrix lists 2012 R2 to 2016, 2019 or 2025 as supported in-place paths, but not 2012 R2 to 2022. If you need 2022, upgrade to 2016 or 2019 first, or perform a clean installation of 2022 and migrate the roles and data across.
Is Windows Server 2016 still safe to use in October 2026?
Windows Server 2016 is still in extended support until 12 January 2027, so it continues to receive monthly security updates for now. Use the remaining months to plan the upgrade, or enrol eligible servers in Azure Arc ESUs if a migration cannot finish before the end date.
Do I need new CALs when I upgrade from 2016?
Generally yes. Windows Server CALs cover servers of the same version or earlier, so after upgrading a server to 2019, 2022 or 2025, users and devices need CALs of that version or later. RDS CALs follow a similar rule, and the licence server must be at least the CAL version.
Are Windows Server 2016 ESUs free?
Microsoft's Azure Arc documentation describes Windows Server 2016 ESUs as a billed service, with billing starting on 13 January 2027 and Software Assurance required for on-premises servers. For 2012 R2, Microsoft provided ESUs at no extra charge for workloads running in Azure virtual machines.