Windows Server 2016 stops receiving security updates on January 12, 2027, and IIS 10 and .NET Framework 4.6.2 on it go with it. In-place upgrade, ESUs through Azure Arc, AWS's End-of-Support Migration Program, containers or Linux: the cost, effort and licensing traps of each on EC2.
Microsoft's extended support for Windows Server 2016 ends on January 12, 2027. The same day, IIS 10 on Windows Server 2016, .NET Framework 4.6.2, Hyper-V Server 2016 and WSUS on 2016 also reach end of support. For an EC2 fleet, that is typically a large share of the Windows instances still running.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
If you bring your own Windows Server licences, Microsoft's October 2019 rule applies: licences bought after October 1, 2019, and versions released after that date (including Windows Server 2022 and 2025), are not eligible for BYOL on AWS dedicated hosts. Upgrading a BYOL server usually means moving to License Included.
Windows Server has no License Mobility, even with Software Assurance. SQL Server, SharePoint and Exchange do.
License Included instances already include the right to run the current version, so on most EC2 fleets the upgrade costs labour, not licences.
Inventory with Systems Manager: OS version, installed software, last login and network connections per instance.
Retire what is unused. Snapshot it, stop it for 30 days, then delete.
Group the rest by application and test one representative instance per group: take an AMI, launch a copy, upgrade the copy, run the application's tests. AWS publishes Systems Manager Automation runbooks that clone and upgrade a Windows instance.
Upgrade in waves with a rollback AMI for each instance.
For the few applications that cannot move by January, buy ESUs for exactly those servers, with an exit date.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
Windows Server 2012 R2's Last Security Updates Ended in October 2026: What to Do This Quarter
The third and final year of Extended Security Updates for Windows Server 2012 and 2012 R2 ended on October 13, 2026. There is nothing left to buy. How to contain the servers still running it, and the fastest ways off: in-place upgrade, rebuild, AWS's End-of-Support Migration Program, or retirement.
Read
Every AWS Service Retiring in 2026 and 2027, and What to Move To
Amazon Pinpoint ended on October 30, 2026, and App Mesh, Proton, WAF Classic and Greengrass V1 before it. Q Developer's IDE plugins, WorkMail, DevOps Guru and Infrastructure Composer end in 2027, and App Runner, Audit Manager, CloudTrail Lake, Kendra, Q Business and the original Bedrock Agents are closed to new customers. The full list from AWS's lifecycle pages, with the replacements AWS names.
Read
As of October 25, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.