Skip to content
Menu

Infrastructure and networks · Guide

Windows 10 ESU, Server 2016 and SQL Server 2016: the dates to 2027.

Three dates fall in the next 100 days: 13 October 2026 for Windows 10 ESU Year One and Office 2021, 10 November for Windows 11 Enterprise 23H2 and 12 January 2027 for Windows Server 20161234. Decide each system before its date: upgrade, replace, isolate with a written exit date or buy ESU as a dated bridge.

Written by
NetScale IT Services
Published
Sources checked
Read
11 minutes
On this page

The facts

Which support dates fall between now and October 2027?

Take an estate with Windows 10 on the desktops, Windows Server 2016 under the file and application servers and SQL Server 2016 under the ERP. Every one of them meets a date in this window. SQL Server 2016 left extended support on 14 July 20265. Year One of Windows 10 Extended Security Updates (ESU) ends on 13 October 20261, and Windows Server 2016 follows on 12 January 20274.

Windows 10 is still common in India. Statcounter’s figures for September 2026 put it at 41.17% of desktop Windows in India, against 58.56% for Windows 116. Statcounter counts page views on the websites that carry its code7, so read this as browsing share, not as your asset register.

Microsoft’s lifecycle tables give most end dates as 06:59 Pacific Time on the morning after the last day8. For Windows Server 2016 that is 13 January 20278. Microsoft’s ESU guidance names the day before: “Windows Server 2016 reaches end of support on January 12, 2027”4. The table below uses that last full day.

Table 1. End-of-support dates from October 2025 to October 2027, by last full day of support
Last dayProductWhat ends, and what is left
2 October 2025VMware vSphere and vSAN 7.xEnd of general support. No product support, security patches or updates after it910. VMware refers customers to Broadcom on the availability of Extended Support10.
14 October 2025Windows 10End of support. Paid ESU for Enterprise, Education and Pro in commercial use, for up to three years111.
14 October 2025Exchange Server 2019 and Office 2019End of extended support1213.
14 July 2026SQL Server 2016End of extended support. Paid ESU Year 1 runs to 13 July 2027 and Year 3 to 17 July 20295.
13 October 2026Windows 10 ESU Year OneYear One ends. Year Two runs to 12 October 2027 and Year Three to 10 October 20281.
13 October 2026Windows Server 2012 and 2012 R2The final ESU security update. ESU licences enabled by Azure Arc deactivate at midnight UTC on 14 October4.
13 October 2026Office 2021 and Office LTSC 2021Office 2021 retires and Office LTSC 2021 leaves support214.
10 November 2026Windows 11 Enterprise and Education, version 23H2End of servicing for that version. Version 24H2 is serviced to 12 October 20273.
12 January 2027Windows Server 2016End of extended support. ESU through Azure Arc, billed from 13 January 2027, for up to three years84.
12 January 2027Windows 10 Enterprise LTSC 2021End of support. Long Term Servicing editions are outside the Windows 10 ESU programme1516.
12 October 2027Windows 10 ESU Year Two, Windows 11 Enterprise 24H2, SQL Server 2017Year Two ends, 24H2 leaves servicing and SQL Server 2017 leaves extended support1317.
October 2027VMware vSphere 8VMware says vSphere 8 “will be supported until October 2027”, with an optional two-year Extended Support period available for purchase18.

The facts

What does Windows 10 ESU cost in Year Two?

Microsoft sells commercial ESU through volume licensing at US$61 per device for Year One11. “The price doubles every consecutive year, for a maximum of three years”11. Applied to US$61, that rule gives US$122 per device for Year Two and US$244 for Year Three.

ESU is cumulative. A device that joins in Year Two pays for Year One as well11, which by the same arithmetic comes to US$183 per device. Year Two covers updates to 12 October 20271.

Each device must run Windows 10 version 22H2 with KB5066791 or later, and then install the licensing preparation package KB507265316. Windows 10 running in Windows 365, Azure Virtual Desktop, an Azure virtual machine or several other Azure services gets ESU at no extra cost11.

The facts

What changes for servers, databases and VMware?

Microsoft offers ESU for Windows Server 2016 Standard and Datacenter through Azure Arc: Critical and Important security updates for up to three years, through 20304.

Configuration opened in the Azure portal on 3 August 2026, and billing starts on 13 January 20274. You need Software Assurance or an equivalent Server Subscription, and the Services Provider License Agreement route is not available for 20164.

A non-clustered Windows Server 2016 machine can upgrade in place straight to Windows Server 2025 from installation media19. Each Windows Server upgrade needs its own licence19.

SQL Server 2016 is already past its date. On premises, you subscribe to its ESU by connecting the instance to Azure Arc, with Software Assurance or a pay-as-you-go option20. Moving SQL Server 2016 to an Azure virtual machine no longer brings free ESU, as it did for SQL Server 201420.

Microsoft releases a SQL Server ESU, if needed, once a vulnerability is rated Critical, so there is no regular release cadence20.

On VMware, vSphere 7 left general support on 2 October 20259. VMware had said in March 2025 that after that date customers “will not be able to receive product support, security patches and updates”10.

The facts

What patch times does CERT-In ask for in 2026?

CERT-In’s advisory CIAD-2026-0020 of 26 April 2026 says to “sharply reduce the time taken to apply patches” on internet-facing systems, web browsers and operating systems21. Its target for those systems is to “treat critical patches as urgent and aim to apply them within 24 hours of release”21. It also asks you to “maintain a current inventory of your IT assets and the software they run”21.

CERT-In’s blueprint of 25 May 2026 sets indicative timelines22. The shortest is 12 hours, for a known exploited flaw on internet-facing and crown-jewel systems, “where feasible”22. If no patch is available, it expects temporary mitigation: “isolation, access restriction, WAF/API protection, enhanced monitoring, or feature disablement until remediation becomes available”22.

Verizon’s 2026 Data Breach Investigations Report covers incidents from November 2024 to October 202523. It found that vulnerability exploitation had overtaken stolen credentials as the most common way in23.

Patching was slow even where patches existed. Only 26% of the known exploited vulnerabilities in CISA’s catalogue had been fully remediated by the organisations in the data23. The median time to a full patch was 43 days23.

What it means

What does an unsupported system do to your patch window?

A 24-hour or 12-hour target assumes there is a patch to apply. After the last day in the table, security patches stop unless the product has an ESU programme and you are enrolled in it. CERT-In’s fallback for “no patch available” lasts “until remediation becomes available”22. On an unsupported product no fix is coming, so the temporary mitigation lasts until you upgrade or replace it.

Microsoft closes one shortcut in its own FAQ: “Third party application control solutions are not a replacement for product security fixes”1. Windows 10 ESU also costs more the longer you stay, because the price doubles every consecutive year11. Server 2016 ESU is billed from the day after support ends4.

Every system in the table needs a decision before its date. You cannot patch in 12 hours, or isolate, a system you do not know you run, so the inventory comes first. What to check this week:

  1. Export every Windows device with its edition, version and build from Intune, Configuration Manager or your remote management tool. Flag Windows 10, Windows 10 Enterprise LTSC 2021 and Windows 11 Enterprise or Education 23H2.
  2. List every server with its operating system, edition, role and owner. Flag Windows Server 2012, 2012 R2 and 2016.
  3. Run SELECT @@VERSION on every SQL Server instance and record the application it serves. Flag 2016 and 2017.
  4. Record the ESXi version on every host and the version of each vCenter Server. Flag 7.x as past support and 8.x as due in October 2027.
  5. Mark each system that faces the internet or holds personal or financial data. Those rows go to the top.
  6. Count the Windows 10 devices you plan to keep, and check each against the ESU prerequisites before you price Year Two.
  7. Confirm your Software Assurance or Server Subscription position before you count on Server 2016 ESU4.
  8. Give each flagged system an owner, an outcome and a date earlier than its row in the table.

Our view

Upgrade, replace, isolate or bridge: how should you choose?

Decide system by system, not for the estate as a whole. For each one past support, or about to be, pick one of the four outcomes below and write down why.

Table 2. Four outcomes for a system at or past its end of support
OutcomeWhen it fitsWhat it costsWhen it ends
Upgrade in placeThe hardware and the application support the new version, as with Server 2016 to 202519.A new Windows Server licence for each upgrade19, plus a tested change window.When the new version is in production.
ReplaceThe hardware cannot run a supported version, or the application has a successor.Capital, migration effort and a cut-over plan.When the old system is switched off.
IsolateThe system cannot move this year and has no ESU, such as a PC tied to a lab instrument.Segmentation, access restriction and monitoring22, plus a written exception.On a written exit date, reviewed each quarter.
Bridge with ESUThe system cannot move before its date, and Microsoft sells ESU for it.A fee that rises each year: US$61, then doubling, for Windows 1011.When the migration it buys time for is done.

Our view: ESU is priced to make you leave. Microsoft’s ESU FAQ calls the programme “a last resort paid option” and “a temporary bridge”1. Buy it for the systems you cannot move this year, with a migration date behind every licence.

Rank by exposure first, then by age. An internet-facing Server 2016 host that publishes an application goes first. A SQL Server 2016 instance behind two firewalls, feeding one report, can sit on ESU while its application is upgraded.

The simpler course is to buy ESU for every Windows 10 device and stop thinking about it. On a small fleet with a booked refresh, that works. It stops working when Year Two becomes Year Three because nobody owned the exit.

The four outcomes assume the choice is yours. Where an equipment maker certifies the operating system, as on some lab, medical or plant PCs, the maker sets the date. Isolate those devices and press the maker for a supported build.

Limits

What does this calendar leave out?

This calendar covers Microsoft and VMware dates as published on 8 October 2026. Vendors move dates, as VMware did when it pushed vSphere 7 back by six months10, so check each lifecycle page before you budget. Network devices, firewalls, storage and Linux distributions are not covered; each has its own vendor dates.

Microsoft publishes the US$61 Year One price and the doubling rule11. The later-year figures are our arithmetic, and your rupee price depends on your licensing agreement.

CERT-In’s advisory and blueprint are guidance. Whether running unsupported software breaches a sector regulator’s rules is a legal question: applicability is for your counsel.

Where we fit

Can NetScale build the server inventory with you?

Our IT infrastructure assessment is an inventory of your servers and storage, the hardware that Windows Server, SQL Server and vSphere run on. It lists end-of-support dates, single points of failure and what an outage of each would cost. An engineer runs it with your team. It costs nothing, and the written findings are yours whether we work together or not.

Questions readers ask

How much does Windows 10 ESU cost per device in Year Two?

US$122 per device, by our arithmetic from Microsoft’s rule that the US$61 Year One price doubles every consecutive year11. ESU is cumulative, so a device that joins in Year Two also pays for Year One11: US$183 in all. Year Two covers updates to 12 October 20271. Your rupee price depends on your licensing agreement.

When does Windows Server 2016 support end?

12 January 2027 is the last day4. After it, security updates come only through ESU14. Microsoft offers it through Azure Arc for Standard and Datacenter editions, billed from 13 January 2027 and running through 20304. You need Software Assurance or an equivalent Server Subscription4. Microsoft says applicable virtual machines hosted in Azure get ESU free of charge1.

Do we get free ESU for SQL Server 2016 if we move it to Azure?

No. Starting with SQL Server 2016, moving to an Azure virtual machine no longer brings free ESU; that applied to SQL Server 201420. You can still subscribe to ESU on Azure or through Azure Arc20. Microsoft releases a SQL Server ESU, if needed, once a vulnerability is rated Critical20.

Can we keep an unsupported server if it is not on the internet?

It can stay as a dated exception with controls around it. Where no patch exists, CERT-In’s blueprint expects temporary mitigation such as isolation, access restriction, enhanced monitoring or feature disablement22. Microsoft says third-party application control does not replace security fixes1. Write the exit date into the exception and review it each quarter. If a sector regulator covers you, applicability is for your counsel.

Does Windows 11 version 23H2 need action this year?

Yes, on Enterprise and Education: version 23H2 leaves servicing after 10 November 20263. Move those devices to 24H2, serviced to 12 October 2027, or 25H2, serviced to 10 October 20283. Servicing for version 26H2 began on 29 September 20263.

References

  1. 1Microsoft Learn. Lifecycle FAQ - Extended Security Updates. 24 August 2026. learn.microsoft.com (opens in a new tab)
  2. 2Microsoft Learn. Office 2021 - Microsoft Lifecycle. Undated. learn.microsoft.com (opens in a new tab)Checked
  3. 3Microsoft Learn. Windows 11 Enterprise and Education - Microsoft Lifecycle. Undated. learn.microsoft.com (opens in a new tab)Checked
  4. 4Microsoft Learn. Prepare to deliver Extended Security Updates for Windows Server through Azure Arc. 5 October 2026. learn.microsoft.com (opens in a new tab)
  5. 5Microsoft Learn. SQL Server 2016 - Microsoft Lifecycle. Undated. learn.microsoft.com (opens in a new tab)Checked
  6. 6Statcounter Global Stats. Desktop Windows Version Market Share India. September 2026 data. gs.statcounter.com (opens in a new tab)Checked
  7. 7Statcounter Global Stats. FAQ. Undated. gs.statcounter.com (opens in a new tab)Checked
  8. 8Microsoft Learn. Windows Server 2016 - Microsoft Lifecycle. Undated. learn.microsoft.com (opens in a new tab)Checked
  9. 9Broadcom. End of General Support for vSphere 7.0 (Article ID 415405). 13 August 2026. knowledge.broadcom.com (opens in a new tab)
  10. 10VMware Cloud Foundation (VCF) Blog, Broadcom. Reminder: vSphere 7 to reach End of Service on Oct 2, 2025. 31 March 2025. blogs.vmware.com (opens in a new tab)
  11. 11Microsoft Learn. Extended Security Updates (ESU) program for Windows 10. 17 November 2025. learn.microsoft.com (opens in a new tab)
  12. 12Microsoft Learn. Exchange Server 2019 - Microsoft Lifecycle. Undated. learn.microsoft.com (opens in a new tab)Checked
  13. 13Microsoft Learn. Microsoft Office 2019 - Microsoft Lifecycle. Undated. learn.microsoft.com (opens in a new tab)Checked
  14. 14Microsoft Learn. Office LTSC 2021 - Microsoft Lifecycle. Undated. learn.microsoft.com (opens in a new tab)Checked
  15. 15Microsoft Learn. Windows 10 Enterprise LTSC 2021 - Microsoft Lifecycle. Undated. learn.microsoft.com (opens in a new tab)Checked
  16. 16Microsoft Learn. Enable Windows 10 Extended Security Updates (ESU) for physical machines. 22 April 2026. learn.microsoft.com (opens in a new tab)
  17. 17Microsoft Learn. SQL Server 2017 - Microsoft Lifecycle. Undated. learn.microsoft.com (opens in a new tab)Checked
  18. 18VMware Cloud Foundation (VCF) Blog, Broadcom. SAP Customers Running on VMware vSphere 7 – Call to Action! 1 August 2025. blogs.vmware.com (opens in a new tab)
  19. 19Microsoft Learn. Plan your Windows Server upgrade. 14 April 2026. learn.microsoft.com (opens in a new tab)
  20. 20Microsoft Learn. What are Extended Security Updates for SQL Server? 22 June 2026. learn.microsoft.com (opens in a new tab)
  21. 21Indian Computer Emergency Response Team (CERT-In). Defending Against Frontier AI Driven Cyber Risks (CERT-In Advisory CIAD-2026-0020). 26 April 2026. cert-in.org.in (opens in a new tab)
  22. 22Indian Computer Emergency Response Team (CERT-In). Blueprint for Reducing Exposure and Defending against AI-Assisted Vulnerabilities Exploitation in Digital Infrastructure (CISG-2026-02, Version 1.0). 25 May 2026. cert-in.org.in (opens in a new tab)
  23. 23Help Net Security, reporting the Verizon 2026 Data Breach Investigations Report. Verizon DBIR: Vulnerability exploitation is the dominant initial access vector. 20 May 2026. helpnetsecurity.com (opens in a new tab)

Changes

  • First published.

Written by NetScale IT Services. How these guides are written

  1. Security operations10 minutes

    How to meet CERT-In’s 12-hour patch window.

  2. Security operations10 minutes

    Ransomware in India: who to report to, how fast and how to recover.