Something in your server room stopped getting security updates in July

End of support does not announce itself. Nothing reboots, no dialog appears, no invoice changes. The server keeps doing exactly what it did the day before. The only difference is that from that morning on, every new vulnerability found in it stays open permanently.

Three Microsoft products that turn up in small business server rooms crossed that line five weeks ago, on July 14, 2026. A fourth, and the one most likely to be sitting in a closet somewhere in your building, crosses it on January 12, 2027.

If your business does not run any Microsoft server software, and a lot of small businesses genuinely do not any more, you can skip this entirely. If you have a server, or a line of business application that came with a database, or an intranet that somebody set up years ago, it is worth twenty minutes.

The dates

All of these come from Microsoft’s own lifecycle pages, not from vendor marketing.

The Windows Server 2022 row is the odd one out and it is good news. October 2026 is the end of its mainstream support, not the end of support. It moves into extended support, which means security updates keep coming, just not features or non-security fixes, and that runs to October 14, 2031. If you are on Server 2022 you have nothing to do.

Everything in bold is different. That is a hard stop.

Update, August 19, 2026. Our first version of this table listed October 13, 2026 only as the Windows Server 2022 mainstream milestone, which understated that date badly. Two hard stops land on it, and both are under two months away.

Office 2021 and Office LTSC 2021 reach the end of support on October 13, 2026. That covers the perpetual-licence Office you bought once and installed: Home and Student, Home and Business, Professional, the Mac editions, and the volume-licensed LTSC editions. Microsoft’s lifecycle pages list the cutoff as 10/14/2026 at 6:59:59 AM Pacific, which is the end of October 13 for the rest of us. This one is easy to miss because Office does not feel like server software, and the machines running it are often the same ones already caught up in the Windows 10 question. If your office is on Microsoft 365 (the subscription), you are unaffected.

Windows Server 2012 and 2012 R2 ESU ends on the same day. Both are in Extended Security Update Year 3, and Year 3 is the last one. There is no Year 4 to buy. That matters for the Azure point further down: the free-ESU-in-Azure benefit for the 2012 generation is real, and it expires on October 13, 2026 along with the program itself. If a 2012-era server is still running in your environment because “the updates are free in Azure,” that arrangement has a hard end date now.

What “end of support” actually costs you

The practical consequences, in the order they tend to bite:

No patches, ever again. Not “fewer patches.” When the next SharePoint or SQL Server vulnerability is published, and there will be one, there is no update to install. Attackers scan for exposed instances of newly disclosed bugs within hours. We wrote about the July SharePoint cluster when it was still patchable; the next one will not be, for anyone on 2016 or 2019.

Cyber insurance. Read your policy. Running unsupported software is a common exclusion or a condition of coverage, and it is the sort of thing that gets discovered during a claim rather than before one.

Compliance. If you handle health information under PHIPA, card data under PCI DSS, or anything your clients audit you on, “unsupported operating system” is a finding on its own, independent of whether anything bad has happened.

No technical support. Free or paid. If it breaks, you are on your own or on a forum.

The escape hatch, and what changed about it this year

Microsoft’s Extended Security Updates program is the paid stay of execution. It is worth understanding precisely, because two widely repeated pieces of advice about it are now wrong.

SharePoint does not have one. There is no ESU program for SharePoint Server 2016 or 2019. This is the sharpest item in this whole post. If you run on-premises SharePoint on either version, there is no cheque you can write. The options are upgrading to SharePoint Server Subscription Edition, moving to SharePoint Online, or accepting a permanently unpatched internet-adjacent application. Most small businesses running an on-prem SharePoint discover during this conversation that what they actually need is a file share and a handful of pages, which is a much smaller project than a migration.

“Just move it to Azure and ESUs are free” stopped being true on April 1, 2026. That was the rule for the previous generation (Windows Server 2012 and 2012 R2, SQL Server 2014), and it is still true for those, though for Windows Server 2012 and 2012 R2 only until their ESU program ends on October 13, 2026. But Microsoft introduced a pricing consistency policy effective April 1, 2026: any new ESU offering is priced the same regardless of where the workload runs or which channel you buy through. Existing offerings were grandfathered; new ones were not. Microsoft’s SQL Server documentation now says it outright: starting with SQL Server 2016, ESUs are a paid subscription, and migrating to SQL Server on Azure VMs no longer provides free access to them. The same applies on Azure Stack and in Azure VMware Solution, where SQL Server 2014 gets free ESUs and SQL Server 2016 does not.

If your plan for January was “lift the old server into Azure and the updates come free,” verify that with your licensing reseller before you budget it. For Windows Server 2016 specifically, do not assume the old Azure benefit carries over; Microsoft’s free-in-Azure documentation is written about the 2012 generation, and the pricing consistency policy is aimed squarely at new offerings like this one.

What ESU actually is, where it exists:

Three details that catch people out:

• It is cumulative. Enrol late and you are back-billed to the end-of-support date. A SQL Server 2016 customer enrolling in January 2027 gets a one-time bill covering July through December 2026. There is no waiting to see whether anything bad happens.
• On-premises ESU requires Software Assurance through a volume licensing agreement (Enterprise Agreement, Enterprise Agreement Subscription, Enrollment for Education Solutions, Server and Cloud Enrollment, or Open Value) or an equivalent server subscription. SPLA is not available for Windows Server 2016 ESUs. A lot of small businesses bought their server licence once, through a reseller, with no Software Assurance, and are therefore not eligible at all without buying into an agreement first. Azure Arc enrolment is the route around this and is worth asking about specifically.
• It buys nothing but time. No features, no bug fixes, no design changes, no general technical support. Three years, then the same decision again with less runway.

For Windows Server 2016 ESU via Azure Arc, the machine needs the Connected Machine agent at version 1.62 or higher, and both Standard and Datacenter editions are supported.

Finding out what you actually run

Most small businesses cannot answer “what version of Windows Server are we on” from memory, and that is normal. The inventory is the work here, not the upgrade.

The things that hide:

• The server in the closet. Usually running file shares, print, and Active Directory. Frequently the original one, bought when the office moved in.
• The database under a line of business application. Practice management, accounting, dispatch, inventory. It very often ships with a bundled SQL Server that nobody thinks of as a database because the vendor installed it. If that application was deployed between 2016 and 2019, SQL Server 2016 is a live possibility.
• The intranet. An on-prem SharePoint set up once and largely abandoned, still holding documents somebody needs quarterly.
• A virtual machine on a host. Out of sight, still exposed, still patched by nobody.
• The vendor-managed box. A machine your software vendor installed and supports, running an OS version they chose years ago. Their support contract and Microsoft’s lifecycle are unrelated things.

What to do, in order

1. Get the list. Every server, physical or virtual, with its OS version, whether SQL Server is installed and which version, and who is responsible for patching it. If you have an outsourced IT provider they should produce this in a day; it is the same list they need to do their job, and if they cannot produce it, that is its own finding. (Worth being direct about the fact that the tools those providers use are themselves a target.)

2. Sort into three piles. Already out of support (act now, the exposure is live). Out in January (you have five months, which is enough). Supported (nothing to do, note the date).

3. For each item in the first two piles, pick one. Upgrade in place, replace the workload with a hosted service, buy ESU as a deliberate bridge with a dated end, or retire it. All four are legitimate. “Wait and see” is not, because ESU back-bills and vulnerabilities do not queue.

4. Ask the vendor question early. If a line of business application is pinned to an old SQL Server or an old Windows Server, the upgrade path is theirs to define and it is often the long pole. Ask now, not in December.

5. Check the timing against everything else. Hardware is still expensive, for the reasons we went through when RAM roughly doubled, and a lot of businesses are already carrying an unfinished Windows 10 migration. If both land on the same quarter, sequence them rather than discovering the collision in January.

The email to send

To your IT provider, or to whoever the server is somebody’s job:

Can you send me a list of every server we run, physical and virtual, with the Windows Server version, whether SQL Server is installed and which version, and any on-premises SharePoint? For anything on Windows Server 2016, SQL Server 2016, or SharePoint 2016/2019, what is the plan and what does it cost? SharePoint has no extended-updates option and SQL Server 2016 is already out of support and back-bills if we enrol late, so I would like the answer before the end of September rather than in January.

If that comes back promptly with a short list and a clear plan, you are in better shape than most. If it comes back with a longer list than anyone expected, you have found the actual problem, and you have found it in August rather than during an incident.

That is the recurring shape of all of this. Certificates that expire on a schedule, runtimes that fall out of support on a schedule, operating systems that stop getting patches on a schedule. Every one of them is cheap to handle on the calendar and expensive to handle on the day. The only thing that consistently separates the businesses that stay ahead of it from the ones that do not is whether somebody’s name is written next to the date.

Update, August 26, 2026: one more date belongs on the same list, and it is not a support date. Everything above is about software that stops being patched on a schedule. There is a parallel category that behaves identically and that nobody puts on the calendar, which is the date your licensing reprices. Microsoft’s new commercial Microsoft 365 list prices took effect on July 1, 2026, and existing subscriptions do not change on that date. They change at the first renewal after it, which means the increase reaches different businesses on dates spread across the next eleven months, arriving without a notice period and usually without a phone call.

The same lookup discipline this post argues for applies exactly: open the Microsoft 365 admin centre, go to Billing and then Your products, and write the renewal date next to a name. That date is both when your bill moves and the only clean moment to change tiers. It is also worth knowing that on the same day the prices changed, Microsoft’s own buy pages stopped offering the base editions of Business Standard and Business Premium, so the default path at renewal is now a more expensive product than the one you are on. The details, including which tier is actually the best value in the 2026 catalogue, are in the post on the July 2026 Microsoft 365 repricing.

If you want a second opinion on what to upgrade, what to move, and what to quietly retire, send us a note. We would rather tell you that three of your five servers can just be turned off than sell you a migration.