Windows Server 2016 Ends 12 January
Windows Server 2016 loses security updates on 12 January 2027. What Monaco offices running a file, accounting or website server should decide now.
On 12 January 2027, Microsoft stops releasing security updates for Windows Server 2016. The server in the cupboard will carry on running the next morning, so nothing visibly breaks. What changes is that every vulnerability found after that date stays open on that machine for good.
That matters in Monaco more than many owners realise. A lot of offices in the Principality still run a small server set up eight or ten years ago, usually Windows Server 2016 or its Essentials edition. It holds shared folders and client files, runs the accounting or property software, provides remote desktop access, or quietly hosts an older website or intranet. You have about ten weeks to decide what happens to it, and given the year-end break, the real working window is closer to seven.
What exactly ends, and what doesn't
Microsoft's lifecycle page for Windows Server 2016 (Datacenter, Standard, Essentials and MultiPoint Premium) gives the end of extended support as 12 January 2027, Pacific time. Mainstream support already ended in January 2022. After January 2027 there will be no more free security patches, bug fixes or technical support.
Microsoft has said that organisations unable to migrate in time can buy Extended Security Updates (ESU) for up to three years. ESU covers critical and important security fixes only, with no new features or support. Reported pricing so far has been per core and inconsistent between sources, so get a written quote from your licensing partner before you budget around it.
Two related products are already past their end date. Exchange Server 2016 lost support in October 2025, and SQL Server 2016 in July 2026. If your server runs either of them, the deadline has effectively already passed.
Why a Monaco business should treat this as a priority
The data on these servers is usually the most sensitive you hold. For a family office, fiduciary, law firm, real estate agency or yacht broker, the file server typically contains identity documents, contracts, bank details and correspondence about very wealthy clients. That is exactly what attackers look for, and old Windows servers exposed through remote desktop are among their favourite ways in.
Your legal obligations don't pause. Monaco's Law No. 1.565 of 3 December 2024, supervised by the APDP, requires security measures appropriate to the risk, and it brings breach notification duties with it. After a breach, "we knew the server was unsupported and kept it running" is a hard position to defend. We aren't lawyers, so confirm your own obligations with a qualified adviser. Our APDP data protection page sets out the wider framework.
Monaco takes unpatched software seriously. In October 2026 the Government, the Palace and the Mairie took their own websites offline as a precaution when critical PHP flaws (PHP2Shell) were disclosed, rather than run them unpatched. That is a useful benchmark for what a careful organisation does. Automated attacks scan the whole internet, and they don't check the size of your company first.
Step one: find out what you actually have
Many owners don't know whether they run Windows Server 2016 at all, especially when the setup was done by a provider who has since left. Ask your IT provider for a one-page answer to five questions:
- Which servers do we have, physical or virtual, in the office or at a hosting provider, and which version of Windows Server does each one run?
- What does each one do? Common answers are file sharing, accounting software, a CRM database, remote desktop, printing, backups, or hosting a website or intranet on IIS.
- Is it reachable from the internet? Remote desktop, VPN gateways and web servers carry the most risk.
- Where are the backups, and when was a restore last tested?
- Who has administrator access, and does that include anyone who no longer works with you?
Pay attention to websites in particular. Older ASP.NET sites and client portals are often hosted on a company's own Windows server. If yours is, the operating system underneath it is part of your website's security, not a separate IT question.
Your four realistic options
1. Upgrade to a supported Windows Server version. If the hardware is recent enough and the business software is certified for it, an upgrade to Windows Server 2022 or 2025 is the most direct route. Check vendor compatibility first, especially for accounting and property-management software.
2. Move the workload to the cloud. For many small Monaco offices, the server exists mainly to share files and run email. Microsoft 365 with SharePoint and OneDrive can replace that entirely and leave nothing in the cupboard to patch. Where data location matters, as it often does for regulated or very private client data, look at hosting options in the Principality before you assume an overseas data centre is acceptable.
3. Retire it. Sometimes the honest answer is that the server runs one forgotten application and a few old folders. Archive the data properly, move what is still in use and switch the machine off.
4. Buy ESU as a bridge. This makes sense when a business-critical application cannot move before January and you have a dated plan to replace it. It doesn't make sense as a way to avoid deciding, since you will face the same decision a year later at a higher price.
If the server also hosts your website, moving it to modern, managed hosting is usually cheaper and safer than keeping it in-house. Our web development team regularly migrates sites like this, and ongoing website maintenance keeps the new platform patched without anyone having to remember.
A timetable that survives the holidays
- By mid-November: complete the inventory and decide which option applies to each server.
- Late November to mid-December: order hardware or licences, run migrations and test restores. Lead times and staff availability get worse in the second half of December.
- Before Christmas: close internet-facing access (remote desktop in particular) on any server that will still be on Windows Server 2016 in January.
- First week of January: confirm that either the migration is complete or ESU is active, and record the decision with your other compliance documents.
This is also a good moment to look at the bigger picture: which systems you depend on, who maintains them and what each one costs. Our digital strategy work often starts with exactly this kind of inventory, and it regularly finds savings as well as risks.
Not sure whether your website or client portal still depends on an old Windows server? Get in touch and we'll tell you what you're running and how to move it safely before 12 January.
