BleepingComputer reported on 23 October that Microsoft will end security updates for Windows Server 2016 in January 2027. Microsoft said that month's update will be the last. All editions are covered: Datacenter, Essentials, MultiPoint Premium and Standard. Support for Essentials features, such as Remote Web Access, ends on the same date. Microsoft tells admins to plan a move to Windows Server 2025.
Monthly security updates are how Microsoft ships protection against newly found threats. Microsoft says Server 2016 will stop receiving them after January. So a flaw found in this code later has no fix on that monthly channel. Remote Web Access, an Essentials feature, also loses support. Not known: whether paid extra updates will exist. Neither source says how many servers still run Server 2016.
This is a choice about who owns the risk, not routine upkeep. After January, new flaws get no monthly fix, and Essentials features lose support. BleepingComputer says roughly three months remain. It also says Server 2025 has extended support until November 2034. Leaders should ask: how many servers run 2016, and what depends on them? Which will be upgraded, and which retired? What stays unpatched, and who accepts that?