AboutFree templates
End of support · Windows Server

Windows Server 2016 end of support: upgrade, migrate or extend

Your options before Windows Server 2016 stops receiving security updates: in-place upgrade, side-by-side role migration, a move to Azure, or Extended Security Updates.

Updated 7 phases24 detailed steps12 official sources
Start the planTemplates (6)PDF runbook
Start here

What should you do before Windows Server 2016 support ends?

Short answer

Windows Server 2016 stops getting security updates on 12 January 2027 unless the server is covered by ESU (Extended Security Updates, a paid extension of security fixes for up to three years). This is an upgrade project: each server either moves to a newer Windows Server version, moves to Azure, or is covered by ESU while you finish.

  • Recommended route: A path per server: in-place upgrade, side-by-side migration, Azure, or ESU
  • Order: Fix the deadline risk first, then move the servers others depend on, then the rest.
  • 7 phases: Find servers and choose, Upgrade simple servers, Replace domain controllers, Move file servers, Move DHCP, Move servers to Azure and ESU and clean up.
  • You're done when: Every remaining Windows Server 2016 machine is on ESU with an exit date, or scheduled for retirement.

The recommended route upgrades simple application servers in place, rebuilds domain controllers, file servers and DHCP side by side on a newer version, moves servers due for new hardware to Azure, and buys ESU only for the few that cannot move in time. ESU is only sold for servers licensed with Software Assurance (an add-on to volume licences that gives upgrade rights), a subscription licence or a hosting provider licence (SPLA). Bought through Azure Arc, it is billed monthly. The time depends on how many servers you have and on application vendor testing, so start with internet-facing servers.

Recommended routeA path per server: in-place upgrade, side-by-side migration, Azure, or ESU

Each role gets the method Microsoft supports for it, and old servers stay available for rollback during side-by-side moves.

Other options and when to use them
  • Move everything to Azure with Azure Migrate: Most servers are due new hardware anyway. Azure Migrate can upgrade the OS during the move.
  • Extended Security Updates via Azure Arc for more servers: Many servers cannot be upgraded or moved before 12 January 2027, and they have Software Assurance or subscription licences. Security updates only, for up to three years.
Tools for this plan
Are you ready?22-question readiness checkPlan your datesDated countdown you can add to your calendarCheck your DNSMX, SPF, DKIM and DMARC lookupNew to the jargon?Plain-English migration glossary
Order to migrate in, and why

Fix the deadline risk first, then move the servers others depend on, then the rest. Decide early which servers need ESU, because onboarding takes time and the date is fixed. Old servers stay available until their replacements pass every check, and the steps that cannot be undone come last.

  1. Inventory, retire unused servers, get vendor statements, back up and test a restoreEvery server needs one path and an owner, and the tested backup is the only rollback for an in-place upgrade.
  2. ESU decision and Azure Arc onboarding for servers that cannot move in timeSupport ends on a fixed date. Servers onboarded at the last minute risk missing the first updates after it.
  3. Internet-facing serversThey are the most exposed once security updates stop.
  4. Domain controllers: new ones promoted, roles moved, old ones demotedEvery other server and PC depends on Active Directory and DNS, so these must be healthy before the rest move.
  5. DHCP and DNS settings moved to the new serversClients must get addresses and DNS from the new servers before the old domain controllers are demoted.
  6. File servers with Storage Migration ServiceThe old name and IP move to the new server at cutover, so users and apps keep the same paths.
  7. Application servers: in place, or to Azure if due for new hardwareThese wait on vendor testing, which usually takes longest.
  8. Functional levels raised, old servers retiredOnce functional levels are raised, a 2016 domain controller cannot rejoin, and a retired server is gone. Both wait until everything passes.
Settings checklist: decide these before you copy

Built-in and third-party tools treat these differently. Tick each one off once you have decided.

Download this checklist (Excel)
  • How each tool handles it
    Built-in methodMicrosoft supports in-place upgrades for many roles, but not for domain controllers, and not between Server Core and Desktop Experience. Side-by-side moves keep the old server for rollback.

    Tip: Record one path, an owner and a date per server, starting with internet-facing ones.

    Microsoft Learn: Overview of Windows Server upgrades
  • How each tool handles it
    Built-in methodNon-clustered servers can upgrade from 2016 straight to 2025. Microsoft does not certify your applications: some vendors support only one newer version or need their own upgrade first.

    Tip: Get a written support statement from each vendor for the target version before you book the change.

    Microsoft Learn: Overview of Windows Server upgrades
  • How each tool handles it
    Built-in methodAn in-place upgrade needs media in the same language and an equal or higher edition. It cannot switch between Server Core and Desktop Experience. Microsoft asks you to disable NIC Teaming before upgrading.
    Storage Migration ServiceFor file servers that must change installation type, moves shares, data and security settings to a new server and can take over the old name and IP.

    Tip: Record installation type and language for each server during inventory, and download matching media.

    Microsoft Learn: In-place upgrade of Windows Server
  • How each tool handles it
    Built-in methodClustered servers upgrade one version at a time with a cluster OS rolling upgrade, so 2016 to 2025 is three upgrades.
    Storage Migration ServiceMoves file server cluster resources from a 2016 cluster straight to a new cluster. The cluster itself does not move.

    Tip: For most clusters, building a new one on the target version and moving workloads is fewer change windows.

    Microsoft Learn: Overview of Windows Server upgrades
  • How each tool handles it
    Built-in methodOnce in-place setup finishes, going back means restoring the backup, losing anything written since.

    Tip: Test a restore before the change window, and copy new data off the server before you restore.

    Microsoft Learn: In-place upgrade of Windows Server
  • How each tool handles it
    Built-in methodMicrosoft says never upgrade a domain controller in place: promote new ones and demote the old. Once domain and forest functional levels are raised, a 2016 domain controller cannot rejoin.

    Tip: Fix every error from repadmin /replsummary and dcdiag before you promote anything, and raise functional levels last.

    Microsoft Learn: In-place upgrade of Windows Server
  • How each tool handles it
    Built-in methodDHCP is moved by exporting the configuration and leases and importing them on the new server, which must then be authorised in Active Directory. Clients keep using the DNS servers their DHCP options and fixed settings point to.

    Tip: Update DHCP scope options, router IP helper addresses and servers with fixed DNS settings before demoting the old domain controllers.

  • How each tool handles it
    Built-in methodStorage Migration Service transfers shares, data, security settings and local users, and can re-run the transfer to copy changes. Cutover moves the old name and IP to the new server. It cannot be undone, does not reissue certificates, and cannot run from a domain controller.

    Tip: Open the SMB, Netlogon and WMI firewall rules first, list certificates during inventory, and keep the old server online for two weeks then off for four more.

    Microsoft Learn: Use Storage Migration Service to migrate a server
  • How each tool handles it
    Built-in methodAzure Migrate can upgrade the Windows Server version during a test migration and the real migration, so a server needs only one change window. Network, identity and backup must be designed in Azure first.

    Tip: Choose Upgrade available in a test migration and test the application before using it at cutover.

    Microsoft Learn: Migrate VMware VMs to Azure (agentless)
  • How each tool handles it
    Built-in methodMicrosoft sells ESU only for servers covered by Software Assurance (through programmes such as an Enterprise Agreement or Open Value), with subscription licences (including through a Cloud Solution Provider reseller), or licensed through a hosting provider under SPLA. Microsoft says customers without Software Assurance can get ESU by moving to Azure instead.

    Tip: Servers bought with the licence on the hardware usually have no Software Assurance: plan to upgrade or replace those before 12 January 2027.

    Microsoft Lifecycle FAQ: Extended Security Updates
  • How each tool handles it
    Built-in methodThrough Azure Arc, ESU for Windows Server 2016 needs Connected Machine agent 1.62 or later. Configuration opened on 3 August 2026, billing starts on 13 January 2027, and it is billed monthly through your Azure subscription. Azure VMware Solution and Azure Local VMs get ESU free and should not enrol through Arc.

    Tip: Onboard early, create the licence deactivated, and check azcmagent show reports ESU as Active before end of support.

    Microsoft Learn: Prepare to deliver ESUs for Windows Server through Azure Arc
  • How each tool handles it
    Built-in methodESU gives Critical and Important security updates only, for up to three years after end of support. No new features, non-security fixes or design changes.

    Tip: Give every ESU server an exit date and owner, and review the list every quarter.

    Microsoft Learn: Prepare to deliver ESUs for Windows Server through Azure Arc
The plan, phase by phase
  1. 1

    Find servers and choose

    Now: support ends 12 January 2027

    Watch out: Some vendors support only one newer Windows Server version, or need their own upgrade first.

    Ways around it

    • Send servers with no supported path to rebuild, retire or ESU.
    Show the detailed steps (3) →
  2. 2

    Upgrade simple servers

    Watch out: An in-place upgrade cannot switch between Server Core and Desktop Experience, or change language.

    Ways around it

    • Build a new server and migrate side by side instead.

    Tools that can do it

    • Storage Migration ServiceMoves shares, data and security settings to a new server and can take over the old name and IP. File serving only.

    Watch out: Clustered servers must upgrade one version at a time with a cluster OS rolling upgrade.

    Ways around it

    • Plan one rolling upgrade per version, or build a new cluster and move workloads across.

    Tools that can do it

    • Storage Migration ServiceMoves file server cluster resources from a 2016 cluster straight to a new cluster. The cluster itself does not move.

    Watch out: Once setup finishes, going back means restoring the backup, losing anything written since.

    Ways around it

    • Copy new data off the server before restoring the backup you tested.
    Show the detailed steps (4) →
  3. 3

    Replace domain controllers

    Watch out: Microsoft says never to upgrade a domain controller in place.

    Ways around it

    • Always build new controllers and demote the old ones.

    Watch out: Once functional levels are raised, a 2016 domain controller cannot rejoin the domain.

    Ways around it

    • Keep the old controllers promoted until the new ones pass the health checks.

    Check your DNS records before and after the change

    Show the detailed steps (4) →
  4. 4

    Move file servers

    Watch out: Missing SMB, Netlogon and WMI firewall rules cause access denied errors.

    Ways around it

    • Enable the rules by Group Policy, or install the Storage Migration Service Proxy on destinations.

    Watch out: Cutover cannot be undone, does not reissue certificates, and cannot run from a domain controller.

    Ways around it

    • List certificates during inventory, fix forward if needed, and recreate shares by hand on domain controllers.
    Show the detailed steps (4) →
  5. 5

    Move DHCP

    Show the detailed steps (3) →
  6. 6

    Move servers to Azure

    For servers due new hardware

    Watch out: Network, identity and backup all need designing in Azure, and running costs replace hardware costs.

    Ways around it

    • Model both costs before choosing, and keep that design work in your wave plan.
    Show the detailed steps (2) →
  7. 7

    ESU and clean up

    Well before 12 January 2027

    Watch out: ESU gives Critical and Important security updates only, for up to three years after 12 January 2027. No new features or other fixes.

    Ways around it

    • Give each ESU server an exit date for upgrade or replacement.

    Watch out: Azure VMware Solution and Azure Local (Microsoft-supported on-premises Azure hardware) VMs get ESU free and should not enrol through Azure Arc.

    Ways around it

    • Exclude them from the licence core count.

    Watch out: Servers onboarded at the last minute risk missing the first updates after end of support.

    Ways around it

    • Onboard early, and create the licence deactivated until you are ready. Microsoft says billing starts on 13 January 2027.
    Show the detailed steps (4) →
You are finished when
  • Every remaining Windows Server 2016 machine is on ESU with an exit date, or scheduled for retirement.
  • All five FSMO roles sit on a Windows Server 2019 or later domain controller, with no replication failures.
  • Clients get DNS and DHCP from the new servers, and shares open under the old names.
  • ESU servers show Enabled in Azure Arc, and upgraded servers pass their application tests.

Tools named in this plan are independent third-party products, not endorsed by the platform vendor and not paid placements. Check the tool's own documentation and run a pilot first.

Click by click

What does each step involve?

Open a part when you reach it in the plan. Each step says where to go, what to do and what you should see.

About this migrationWhat it covers, limits at a glance

Windows Server 2016 reaches end of extended support on 12 January 2027. After that date it gets no security updates unless the server is covered by Extended Security Updates (ESU). That includes Hyper-V Server 2016 and IIS 10 on Windows Server 2016.

Most organisations use a mix of approaches: in-place upgrades for simple application servers, side-by-side migration for infrastructure roles, Azure for servers that are due a hardware refresh, and ESU only for the few servers that cannot move in time.

End of extended support12 January 2027 (Microsoft Lifecycle, Fixed policy)
In-place upgrade targetsWindows Server 2019, 2022 or 2025
Domain controllersDo not upgrade in place; promote new DCs and demote old ones
File serversStorage Migration Service in Windows Admin Center
ESUUp to three years through 2030, including via Azure Arc
1What you need before step one
NeedDetailsWhere to get it
Domain Admin (or delegated rights)To query Active Directory, promote and demote domain controllers and authorise DHCP servers.Your directory team
Local admin on each serverFor upgrades, Storage Migration Service (source, destination and orchestrator) and the Azure Arc agent.Your server team
RSAT Active Directory moduleFor Get-ADComputer and the AD DS cmdlets, on your admin PC or a domain controller.Windows: Settings > System > Optional features, or run the commands on a domain controller
Windows Server installation mediaWindows Server 2019, 2022 or 2025 ISO in the same language and an equal or higher edition.Microsoft Volume Licensing Service Center or your licensing partner
Windows Admin CenterLatest version, with the orchestrator on Windows Server 2019 or later for Storage Migration Service.https://learn.microsoft.com/windows-server/storage/storage-migration-service/overview
ESU via Azure Arc (only if needed)An Azure subscription, Software Assurance (or SPLA or Server Subscription licensing), and the Connected Machine agent 1.62 or later.Azure portal > Azure Arc
A tested backup of every serverBefore any upgrade or role move.Your backup console
2Find every Windows Server 2016 machine3 steps
  1. 1

    Query Active Directory

    Where: PowerShell on a domain controller or an admin PC with the RSAT Active Directory module

    List computer accounts running Windows Server 2016, then confirm each one is still in use.

    Get-ADComputer -Filter 'OperatingSystem -like "*Server 2016*"' -Properties OperatingSystem,LastLogonDate,IPv4Address | Select-Object Name,OperatingSystem,LastLogonDate,IPv4Address | Export-Csv .\ws2016-servers.csv -NoTypeInformation
    You should see: ws2016-servers.csv with one row per Windows Server 2016 computer account. Accounts with an old LastLogonDate are candidates to retire.
  2. 2

    Record roles and applications

    Where: Elevated PowerShell on each Windows Server 2016 machine, then your application inventory

    For each server record installed roles, applications, vendor support statements for newer Windows Server versions, and whether the server is clustered.

    Get-WindowsFeature | Where-Object Installed | Select-Object Name,DisplayName
    You should see: A list of installed roles and features per server, copied into the inventory.
  3. 3

    Choose a path per server

    Where: Your Migration wave plan template

    Mark each server as in-place upgrade, side-by-side migration, move to Azure, retire, or ESU. Prioritise internet-facing servers.

    You should see: Every server has one path, an owner and a target date before 12 January 2027.
3In-place upgrade where it is safe4 steps

Microsoft supports in-place upgrades from Windows Server 2016 to 2019, 2022 or 2025. Windows Server 2025 can upgrade non-clustered systems up to four versions at a time, so 2016 can go straight to 2025.

  1. 1

    Check the restrictions

    Where: The server: Settings > System > About (edition), and Server Manager > Local Server (NIC Teaming)

    The edition carries over (Standard to Standard, Datacenter to Datacenter), and you can go up but not down. You cannot switch between Server Core and Desktop Experience, upgrade a server that boots from VHD, or change language. Disable NIC Teaming first. Clustered servers use a cluster OS rolling upgrade, one version at a time.

    You should see: The server is confirmed as non-clustered, not booting from VHD, with NIC Teaming disabled and matching installation media.
  2. 2

    Back up and collect diagnostics

    Where: Your backup console (full backup and test restore), then elevated PowerShell on the server

    Take a full backup and test a restore. Then save the current configuration and copy the files off the server (for example to a network share).

    Get-ComputerInfo -Property WindowsBuildLabEx,WindowsEditionID | Out-File -FilePath .\computerinfo.txt
systeminfo.exe | Out-File -FilePath systeminfo.txt
ipconfig /all | Out-File -FilePath ipconfig.txt
    You should see: A successful test restore, and computerinfo.txt, systeminfo.txt and ipconfig.txt saved off the server.
  3. 3

    Run Setup

    Where: The server: mount the Windows Server ISO in File Explorer, then run setup.exe from the root of the mounted drive

    Select Yes at the User Account Control prompt. Optionally select Change how Setup downloads updates. Enter the product key if prompted, choose the edition, select Accept on the notices and licence terms, select Keep files, settings, and apps, then Install on the Ready to install screen. The installation media method applies only to servers outside Azure. The server restarts several times.

    You should see: After the final restart the server shows the Windows sign-in screen for the new version.
  4. 4

    Verify

    Where: Elevated PowerShell on the upgraded server

    Confirm the version, then test applications and client connections. If setup fails, review the logs in C:\Windows\Panther with SetupDiag.

    Get-ComputerInfo -Property WindowsProductName
    You should see: WindowsProductName shows the new version (for example Windows Server 2025 Standard), and application tests pass.
Never upgrade a domain controller in place. Microsoft says not to use in-place upgrade for servers running AD DS. Build new domain controllers and demote the old ones.
4Migrate domain controllers (AD DS)4 steps
  1. 1

    Check directory health

    Where: Elevated Command Prompt or PowerShell on an existing domain controller

    Fix replication errors before adding new domain controllers.

    repadmin /replsummary
dcdiag /v /c /e
    You should see: repadmin shows 0 in the fails column for every DC, and dcdiag reports passed for each test.
  2. 2

    Promote a new domain controller

    Where: Elevated PowerShell on the new server (Windows Server 2019 or later), joined to the domain

    Build a new server on a supported version, join it to the domain, install AD DS and promote it with DNS. You are prompted for the Directory Services Restore Mode password.

    Install-WindowsFeature AD-Domain-Services -IncludeManagementTools
Install-ADDSDomainController -DomainName contoso.com -InstallDns -Credential (Get-Credential CONTOSO\Administrator)
    You should see: The server restarts as a domain controller, and repadmin /replsummary on it shows no failures.
  3. 3

    Move FSMO roles

    Where: Elevated PowerShell on a domain controller, signed in as a member of Schema Admins and Enterprise Admins

    Transfer the operations master roles to the new domain controller and confirm.

    Move-ADDirectoryServerOperationMasterRole -Identity DC03 -OperationMasterRole SchemaMaster,DomainNamingMaster,PDCEmulator,RIDMaster,InfrastructureMaster
netdom query fsmo
    You should see: netdom query fsmo lists the new domain controller (DC03) for all five roles.
  4. 4

    Update DNS and DHCP options, then demote

    Where: DHCP console (dhcpmgmt.msc) scope options, static server NIC settings, then elevated PowerShell on each 2016 domain controller

    Point clients and servers at the new DNS servers, update DHCP scope options, then demote the 2016 domain controllers and raise the functional levels when all DCs are on the new version.

    Uninstall-ADDSDomainController -Credential (Get-Credential CONTOSO\Administrator)
    You should see: The old server restarts as a member server and no longer appears in the Domain Controllers OU.
5Migrate file servers with Storage Migration Service4 steps
  1. 1

    Prepare Windows Admin Center and the orchestrator

    Where: Windows Admin Center connected to the orchestrator: Server Manager > Storage Migration Service > Install

    Install the latest Windows Admin Center and the Storage Migration Service extension. Use a Windows Server 2019 or later orchestrator; for a single server, the destination can be the orchestrator. Microsoft recommends at least two vCPUs and 2 GB of memory. On each destination, install Storage Migration Service Proxy from Server Manager > Roles and features, which also opens the firewall ports it needs.

    Install-WindowsFeature -Name SMS,SMS-Proxy -IncludeManagementTools
    You should see: Storage Migration Service opens in Windows Admin Center with the option to create a new job.
  2. 2

    Inventory

    Where: Windows Admin Center > Server Manager > Storage Migration Service > New job

    Name the job, choose Windows servers and clusters, and select OK. On Enter credentials enter an account that is an administrator on source, destination and orchestrator. On Add and scan devices select Add a device, find the 2016 server, select Validate and then Start scan.

    You should see: The scan finishes and lists the source server's shares, configuration, network adapters and volumes.
  3. 3

    Transfer

    Where: Same job > Transfer data

    Enter destination credentials, enter the destination server name and select Scan device (or Create a new Azure VM). Map source volumes to destination volumes, clear Include for shares you do not want, choose how to handle local users and groups, select Validate and then Start transfer. You can rerun transfers to copy only changes before cutover.

    You should see: The transfer completes, and the destination shows the shares and files. Save the error log for any skipped files.
  4. 4

    Cut over

    Where: Same job > Cut over to the new servers

    Map network adapters, choose DHCP or a new static IP for the source (on the same subnet), choose how to rename the source, select Validate and then Start cutover. The destination takes the source server's name and IP addresses, so users and apps keep the same paths. Storage Migration Service does not delete source files, and cannot cut over from a domain controller.

    You should see: The cutover completes, and \\oldservername\share opens on the new server.
6Migrate DHCP3 steps
  1. 1

    Export from the old server

    Where: Elevated PowerShell on the new DHCP server or an admin PC with the DHCP Server tools

    Export the configuration and leases from the 2016 server.

    Export-DhcpServer -ComputerName DHCP2016 -Leases -File C:\DhcpMigration\dhcp-export.xml -Verbose
    You should see: C:\DhcpMigration\dhcp-export.xml is created with the scopes and leases.
  2. 2

    Import on the new server

    Where: Elevated PowerShell on the new DHCP server

    Install the DHCP role on the new server, import, and authorise it in Active Directory.

    Install-WindowsFeature DHCP -IncludeManagementTools
Import-DhcpServer -ComputerName DHCP2025 -Leases -File C:\DhcpMigration\dhcp-export.xml -BackupPath C:\DhcpMigration\Backup -Verbose
Add-DhcpServerInDC -DnsName dhcp2025.contoso.com
    You should see: The scopes appear in the DHCP console (dhcpmgmt.msc) on the new server, and Get-DhcpServerInDC lists it as authorised.
  3. 3

    Switch over

    Where: Elevated PowerShell on the old DHCP server, then your routers and switches (IP helper or DHCP relay settings)

    Stop the DHCP service on the old server, update IP helper addresses on routers and switches, and unauthorise the old server.

    Stop-Service DHCPServer
Remove-DhcpServerInDC -DnsName dhcp2016.contoso.com
    You should see: Clients renewing their address (ipconfig /renew) receive leases from the new server.
7Move to Azure instead2 steps
  1. 1

    Rehost with Azure Migrate

    Where: Azure Migrate project > Execute > Migrations > the server > Testing or Completion (Upgrade available option)

    Replicate servers to Azure VMs with Azure Migrate. During test migration and migration you can choose to upgrade the Windows Server OS with Upgrade available. See the VMware to Azure guide.

    You should see: The migrated Azure VM runs the newer Windows Server version you selected.
  2. 2

    Build new and migrate roles

    Where: Windows Admin Center > Storage Migration Service job > Transfer data > Create a new Azure VM

    Windows Admin Center can deploy Azure VMs as Storage Migration Service destinations, so file servers can move and upgrade in one step.

    You should see: A new Azure VM is created as the destination and appears in the job's mappings.
8Use ESU only for servers that cannot move in time4 steps
  1. 1

    Understand what ESU covers

    Where: Microsoft Learn: Prepare to deliver ESUs for Windows Server through Azure Arc, and your licensing assessment

    ESU for Windows Server 2016 provides Critical and Important security updates for up to three years, through 2030. It does not include new features, non-security fixes or general technical support. It covers Standard and Datacenter editions.

    You should see: The servers on the ESU path are listed in the licensing assessment with a planned exit date.
  2. 2

    Check eligibility

    Where: Your Volume Licensing agreement, checked with your licensing partner

    Microsoft says you need Software Assurance through a Volume Licensing program, unless the servers are licensed through SPLA or a Server Subscription. Azure VMware Solution machines and VMs on Azure Local are eligible for free ESUs and should not enrol through Azure Arc.

    You should see: Written confirmation of eligibility for each server on the ESU path.
  3. 3

    Onboard each server to Azure Arc

    Where: Azure portal > Machines - Azure Arc > Onboard/Create > Onboard existing machines, then an elevated 64-bit PowerShell window on the server

    Choose subscription, resource group, region, Windows and connectivity, select Authenticate machines manually, then Download the script and run it as a local administrator. For many servers Microsoft documents Group Policy and Configuration Manager methods. Windows Server 2016 ESUs need the Connected Machine agent version 1.62 or later.

    ./OnboardingScript.ps1
azcmagent version
    You should see: The machine shows status Connected under Machines - Azure Arc, and azcmagent version reports 1.62 or later.
  4. 4

    Create the ESU licence and enable it

    Where: Azure portal > Azure Arc > Licenses > Windows Server 2016 ESU licenses > Create; then the Eligible resources tab

    Enter the resource group, licence name, activation status, region, SKU (Standard or Datacenter) and number of cores, confirm Software Assurance and select Create. On Eligible resources select the servers, then Enable ESUs, choose the licence and the core type, and select Enable. Configuration opened on 3 August 2026, and Microsoft says billing starts on 13 January 2027. Check the vendor's current pricing.

    azcmagent show
    You should see: The servers show Enabled in the ESUs status column, and azcmagent show reports the Extended Security Updates status as Active.
Other channels. Ask your Microsoft licensing partner whether ESU through Volume Licensing suits you better than Azure Arc, and confirm the terms for servers already running in Azure.
Worth knowing

What can go wrong, and how do you avoid it?

The detail behind the plan: options compared, and what experienced engineers check first. Tap any item.

Compare all the ways to do this4 options

In-place upgrade

Low effort

Best for: Simple, non-clustered application servers whose vendor supports the newer version

  • Keeps the server name, IP address, roles and data
  • Windows Server 2025 can upgrade straight from 2016
  • Not for domain controllers; clustered servers cannot jump versions
  • Desktop Experience and Server Core do not convert
Read more →

Side-by-side migration to a new server

Medium effort

Best for: Domain controllers, file servers and DHCP, and servers due a clean build

  • The old server stays available for rollback
  • Storage Migration Service in Windows Admin Center moves file servers, and the destination takes the source name and IP addresses
  • New hardware or VMs to build first
  • Certificates need reissuing after a Storage Migration Service cutover
Read more →

Move to Azure

Medium effort

Best for: Servers due a hardware refresh or already planned for the cloud

  • Rehost with Azure Migrate, and use its OS upgrade option to leave Windows Server 2016 during the move
  • No new hardware to buy for servers due a refresh
  • Network, identity and backup need designing in Azure
  • Running costs replace hardware costs, so model both
Read more →

Extended Security Updates via Azure Arc

Low effort

Best for: The few servers that cannot be upgraded or moved before 12 January 2027

  • Up to three years of security updates, through 2030
  • Enrol and manage from Azure through Azure Arc
  • Each server must be onboarded to Azure Arc first
  • Security updates only: the server still needs upgrading or replacing later
Read more →
Our advice

Choose a path per server from your inventory. Upgrade simple application servers in place, migrate domain controllers, file servers and DHCP side by side, move servers due a hardware refresh to Azure, and keep ESU for the servers that genuinely cannot move in time. Onboard ESU candidates to Azure Arc early so they are covered on 12 January 2027.

Check application vendor support before choosing a versionReduces risk

The OS upgrade is usually easy; the application on top is the risk. Some vendors certify only one newer Windows Server version, or require their own upgrade first.

What to do

Get a written support statement per application for the target version (2019, 2022 or 2025) and record it in the inventory. Servers with no supported path go to rebuild, retire or ESU.

Clustered servers cannot jump versionsSaves time

Microsoft says clustered servers use a cluster OS rolling upgrade one version at a time, while non-clustered servers can go from 2016 straight to 2025.

What to do

Identify clusters during inventory and plan one rolling upgrade per version, or build a new cluster on the target version and move workloads across.

Tools that can get around this

For clustered file servers, Storage Migration Service moves the file server resources from a Windows Server 2016 cluster straight to a new cluster on the target version, so you do not have to step through one rolling upgrade per version.

  • Storage Migration ServiceSupports failover cluster sources (including 2016) and destinations, with the orchestrator on Windows Server 2019 with KB5001384 or Windows Server 2022. Only the file server cluster resources move, not the cluster itself, and Azure Local clusters are not supported as a destination.
Third-party tools, not endorsed by the platform vendor. Confirm in the tool's documentation and run a pilot first.
Microsoft Learn: Overview of Windows Server upgrades
Desktop Experience and Server Core do not convertSaves time

Microsoft says an in-place upgrade cannot switch between Server Core and Desktop Experience or change the language. Choosing the wrong media fails at the edition screen.

What to do

Record the installation type and language of each server and download matching media. If you want to change installation type, plan a side-by-side migration instead.

Tools that can get around this

For file servers, Storage Migration Service is the side-by-side path: it copies shares, data and security settings to a newly built server and can then move the old name and IP across, so a change of installation type or language does not change the paths users and apps rely on.

  • Storage Migration ServiceInventories the source, transfers files, file shares and security configuration, and can cut over the server identity. Covers file serving only, so other roles on the server need their own migration.
Third-party tools, not endorsed by the platform vendor. Confirm in the tool's documentation and run a pilot first.
Microsoft Learn: In-place upgrade of Windows Server
Use Storage Migration Service rather than copying files by handUser impact

Robocopy moves files but not the server identity. Storage Migration Service can transfer shares, settings and local users and then cut over the old name and IP, so users and apps keep the same paths.

What to do

Run a transfer early, then repeat it before cutover to copy only changes. Microsoft recommends keeping the source online for at least two weeks after migration and then powered off for another four before decommissioning.

Microsoft Learn: Use Storage Migration Service to migrate a server
Reissue certificates after a Storage Migration Service cutoverReduces risk

Microsoft notes that renaming during cutover does not reissue certificates. Services on the destination that rely on a certificate for the old name can fail after cutover.

What to do

List certificates on the source (certlm.msc) during inventory, and reissue or import them on the destination as part of the cutover runsheet.

Microsoft Learn: Use Storage Migration Service to migrate a server
Open the firewall rules Storage Migration Service needsSaves time

Microsoft lists inbound File and Printer Sharing (SMB-In), Netlogon Service (NP-In) and WMI rules on source and destination. Missing rules cause access denied errors during inventory or transfer.

What to do

Enable the rules through Group Policy before the first job, or install the Storage Migration Service Proxy on destinations, which opens its ports automatically.

Microsoft Learn: Storage Migration Service overview
Fix replication before adding domain controllersReduces risk

A new domain controller copies the directory from existing ones. Promoting into a forest with replication errors spreads the problem and complicates the FSMO move.

What to do

Run repadmin /replsummary and dcdiag first and fix every failure. Raise the functional levels only after all 2016 domain controllers are demoted.

Onboard ESU servers to Arc earlyCompliance

Configuration for Windows Server 2016 ESUs opened on 3 August 2026, and Microsoft requires Connected Machine agent 1.62 or later. Servers onboarded at the last minute risk missing the first updates after 12 January 2027.

What to do

Onboard and check agent versions well before January, create the licence in a deactivated state if you are not ready to start billing, and activate it before end of support.

Microsoft Learn: Prepare to deliver ESUs for Windows Server through Azure Arc
Do not pay for ESU on platforms that include itCost lever

Microsoft says Azure VMware Solution machines and VMs on Azure Local are eligible for free ESUs and should not enrol through Azure Arc.

What to do

Check where each ESU candidate runs before creating licences, and exclude those servers from the Arc licence core count.

Microsoft Learn: Prepare to deliver ESUs for Windows Server through Azure Arc
Use the Azure Migrate OS upgrade for servers moving anywaySaves time

Azure Migrate can upgrade the Windows Server OS during test migration and migration, so a server due for both a move and an upgrade needs only one change window.

What to do

Select Upgrade available in a test migration first, test the application on the upgraded test VM, then use the same option at cutover.

Microsoft Learn: Migrate VMware VMs to Azure (agentless)
Finish safely

How do you check it worked, or roll back?

Full validation checklist9 checks

Run these before you declare the migration complete. Record the results in the data validation report.

CheckHow to checkWhat good looks like
No Windows Server 2016 machine is left without a plan

Re-run the Get-ADComputer query from Step 1 on a domain controller and compare the new ws2016-servers.csv with your Migration wave plan.

Every remaining Windows Server 2016 computer account is either on the ESU path with an exit date, or scheduled for retirement. Stale accounts have been removed.
Upgraded servers report the new version and apps pass their tests

On each upgraded server run Get-ComputerInfo -Property WindowsProductName, then have the application owner run the acceptance tests in your runsheet.

WindowsProductName shows the target version on every upgraded server, and each application owner signs off their tests.
Active Directory replication is healthy on the new domain controllers

On a new domain controller run repadmin /replsummary and dcdiag /v /c /e.

repadmin shows 0 in the fails column for every domain controller, and dcdiag reports passed for each test.
Operations master roles sit on the new domain controllers

Run netdom query fsmo in an elevated Command Prompt on any domain controller.

All five roles are listed against a domain controller running Windows Server 2019 or later.
Clients get DNS and DHCP from the new servers

On a test client run ipconfig /renew and then ipconfig /all. On the new DHCP server run Get-DhcpServerInDC.

The client shows the new DNS servers and a lease from the new DHCP server. Get-DhcpServerInDC lists the new server and no longer lists the 2016 server.
File shares open under the old name with the right content

From a user PC open \\oldservername\share for each migrated share. In Windows Admin Center, open the Storage Migration Service job and review the transfer error log you saved.

Each share opens on the new server with the expected folders and permissions, and every file in the error log has been fixed or accepted by the share owner.
Certificates and line-of-business connections work on the destination

Open certlm.msc on each Storage Migration Service destination and compare with the certificate list from your inventory. Test each application that connects to the server by name.

Every certificate from the source inventory is present and valid on the destination, and connected applications work without changes.
ESU servers are enrolled and receiving security updates

In the Azure portal open Azure Arc > Licenses > Eligible resources and check the ESUs status column. On each server run azcmagent show.

Each server on the ESU path shows Enabled in the portal, and azcmagent show reports the Extended Security Updates status as Active.
The old servers no longer take part

In Active Directory Users and Computers open the Domain Controllers OU. On the old DHCP server check that the DHCP Server service is stopped. Check that the renamed Storage Migration Service sources are not serving users.

No 2016 server appears in the Domain Controllers OU, the old DHCP service is stopped and unauthorised, and no user or app connects to a renamed source.
Rollback planIf it goes wrong

Roll back if

  • A business application fails acceptance tests after an in-place upgrade and the vendor has no fix inside the agreed change window
  • repadmin or dcdiag reports failures after a new domain controller is promoted that you cannot fix in the change window
  • Clients stop receiving DHCP leases after the switch-over
  • Users or applications cannot open shares after a Storage Migration Service cutover
  • An upgraded server is unstable (repeated crashes or failed services) during the agreed hypercare period

Point of no return

It depends on the path. In-place upgrade: once setup finishes, the way back is a restore of the full backup you tested before the upgrade, and anything written to the server after the upgrade is lost unless you copy it off first. Storage Migration Service: cutover swaps the identities of the two servers, and Microsoft documents no way to undo a completed cutover. The source keeps its files under its new name, which is why Microsoft recommends keeping it online for at least two weeks. Domain controllers: rollback is simple while the 2016 domain controllers are still promoted. Demoting them and then raising the domain and forest functional levels is the real point of no return, because a domain at a higher functional level cannot take a 2016 domain controller back. DHCP: easy to reverse until the old server is decommissioned.

  1. 1

    Restore an in-place upgraded server

    Where: Your backup console, then the restored server

    Copy any data written since the upgrade to a network share. Restore the full backup you took and tested before running setup. Compare the restored server with the computerinfo.txt, systeminfo.txt and ipconfig.txt files you saved.

    Get-ComputerInfo -Property WindowsProductName
    You should see: The server boots as Windows Server 2016 with the same IP configuration as ipconfig.txt, and the application works again.
  2. 2

    Switch DHCP back to the old server

    Where: Elevated PowerShell on the old and new DHCP servers, then your routers and switches (IP helper or DHCP relay settings)

    On the new server stop the service and unauthorise it. On the old server start the service and authorise it again. Put the IP helper addresses back to the old server.

    # On the new DHCP server
Stop-Service DHCPServer
Remove-DhcpServerInDC -DnsName dhcp2025.contoso.com
# On the old DHCP server
Start-Service DHCPServer
Add-DhcpServerInDC -DnsName dhcp2016.contoso.com
    You should see: Get-DhcpServerInDC lists only the old server, and a test client that runs ipconfig /renew gets a lease from it.
  3. 3

    Move operations master roles back before demotion

    Where: Elevated PowerShell on a domain controller, signed in as a member of Schema Admins and Enterprise Admins

    While the 2016 domain controllers are still promoted, transfer the roles back to one of them and point DHCP scope options and static NIC settings back at the old DNS servers.

    Move-ADDirectoryServerOperationMasterRole -Identity DC01 -OperationMasterRole SchemaMaster,DomainNamingMaster,PDCEmulator,RIDMaster,InfrastructureMaster
netdom query fsmo
    You should see: netdom query fsmo lists DC01 for all five roles, and clients resolve names through the old DNS servers.
  4. 4

    Remove a new domain controller you no longer want

    Where: Elevated PowerShell on the new domain controller

    Once its roles have moved back, demote the new domain controller. Then run the health checks again on the remaining domain controllers.

    Uninstall-ADDSDomainController -Credential (Get-Credential CONTOSO\Administrator)
repadmin /replsummary
    You should see: The server restarts as a member server, and repadmin /replsummary on the remaining domain controllers shows no failures.
  5. 5

    Restore file access after a cutover that cannot be fixed

    Where: Elevated PowerShell on the renamed source server, then your User communication pack

    Fix forward on the destination if you can, because the cutover cannot be undone. If the destination is unusable, list the shares on the source under its new name, re-create any that are missing from your inventory, and give users the temporary path until the destination is repaired.

    Get-SmbShare | Where-Object { $_.Special -eq $false } | Select-Object Name, Path
    You should see: Users can open the shares on the source under its new name, and nobody edits both copies.

Agree the triggers and who decides before the go / no-go meeting. Use the rollback plan template.

Common problems and fixes6 errors
In-place upgrade blocked: edition or language mismatch

Cause: The media edition or language does not match the installed server, or you are trying to downgrade the edition.

Fix: Use media in the same language and an equal or higher edition.

Upgrade fails and rolls back

Cause: An incompatible driver, application or role blocked setup.

Fix: Review the logs in C:\Windows\Panther with SetupDiag, remove or update the blocker, then retry.

Storage Migration Service cannot cut over the source

Cause: The source is a domain controller, or the destination is not in the same domain.

Fix: Transfer the files and recreate shares manually, or move the destination into the same domain.

Storage Migration Service transfer fails with access denied

Cause: The migration account is not an administrator on all three computers, or SMB, Netlogon and WMI are blocked.

Fix: Grant local admin rights and open the firewall rules, or install the SMS Proxy service on the destination.

New DHCP server does not issue leases

Cause: The server is not authorised in Active Directory, or IP helpers still point at the old server.

Fix: Run Add-DhcpServerInDC and update the IP helper addresses on routers.

Server not showing as eligible for ESU in Azure Arc

Cause: The Connected Machine agent is older than version 1.62.

Fix: Update the agent and check the server shows as connected before enrolling.

Search the full error library →

FAQ

Frequently asked questions

When does Windows Server 2016 support end?

Extended support ends on 12 January 2027. After that, no security updates are released without ESU.

Can I upgrade Windows Server 2016 directly to 2025?

Yes. Microsoft lists 2016 to 2025 as a supported in-place upgrade path for non-clustered servers.

Should I upgrade domain controllers in place?

No. Microsoft advises promoting new domain controllers on a clean install and demoting the old ones.

How long can I get ESU for Windows Server 2016?

Up to three years after end of support, through 2030, in yearly terms.

Do I need Azure to get ESU?

Azure Arc is one way to buy and manage ESU on-premises. Talk to your licensing partner about other channels and eligibility.

Does Storage Migration Service delete the old data?

No. It never removes files from the source servers, so you can decommission them on your own schedule.

Sources

Official sources

12 official pages this guide is based on

Vendors change limits and features, so confirm details on the source before you rely on them. Last checked 4 Nov 2026.

Microsoft Learn: How cutover works in Storage Migration ServiceMicrosoft Lifecycle: Windows Server 2016Microsoft Lifecycle: Ending support in 2027Microsoft Learn: Overview of Windows Server upgradesMicrosoft Learn: In-place upgrade of Windows ServerMicrosoft Learn: Storage Migration Service overviewMicrosoft Learn: Prepare to deliver ESUs for Windows Server through Azure ArcMicrosoft Tech Community: Plan for Windows Server 2016 end of supportMicrosoft Learn: Use Storage Migration Service to migrate a serverMicrosoft Learn: Deliver Extended Security Updates through Azure ArcMicrosoft Learn: Connect hybrid machines with Azure Arc-enabled serversMicrosoft Learn: Migrate VMware VMs to Azure (agentless)