Verdict

Verdict: Migrate. Microsoft says an in-place upgrade of the Windows Server operating system between major versions with Exchange installed is not supported, and Exchange 2016 cannot be upgraded in place to a newer Exchange, so the only supported road is a new server or Exchange Online.

There is no clever shortcut. Upgrading the operating system under Exchange is the tempting move because it keeps the server name, the databases and the certificates. It is also the one Microsoft's supportability matrix rules out, and Exchange 2016 does not run on Windows Server 2019 or later in any case.

Who this is for and what changes on the end-of-support date

This is for anyone with Exchange Server 2016 (or 2019) servers on Windows Server 2016, including the "leftover" server kept only for mail relay, public folders or recipient management after a move to Microsoft 365.

Start with Exchange, because it is the bigger problem. Microsoft's end-of-support roadmap says support for Exchange 2019 and 2016 ended on 14 October 2025, so Microsoft no longer provides technical support, bug fixes, security fixes or time zone updates for them. The installation keeps running, but nothing fixes it. Microsoft ran an Extended Security Update programme for Exchange 2016 and 2019. Its second period ran from May to October 2026 for customers with an Enterprise Agreement, covering Exchange 2016 CU23 and Exchange 2019 CU14 and CU15. In an update dated 13 October 2026 the Exchange team said it had released the final set of updates, that no more updates will be released for Exchange 2016 or 2019, and that future updates will be for Exchange Server Subscription Edition (SE) only. So there is no ESU path left to buy time for Exchange itself.

For the operating system, Microsoft Lifecycle lists Windows Server 2016 under the Fixed Lifecycle Policy. The Lifecycle table shows the extended support end as 1/13/2027 6:59:59 AM, while Microsoft's extended security updates page names 12 January 2027 and says 2016 ESU starts on that date. Microsoft's Azure Arc documentation says Windows Server 2016 ESU provides Critical and Important updates for up to three years, through 2030, can be configured in the Azure portal from August 3, 2026, is billed from January 13, 2027 and requires Software Assurance or an equivalent server subscription; the pages show no price. That covers the operating system only. Whatever you decide about the operating system, it does not repair an Exchange build that no longer gets fixes.

Exchange servers are commonly reachable from the internet, which is why this role belongs near the top of the list. Finish before 12 January 2027, and treat any Exchange 2016 or 2019 server as overdue now.

Decision table

Exchange Server SE supports Windows Server 2025, 2022 and 2019 in Datacenter and Standard editions, with Server Core recommended, per the supportability matrix. Exchange 2016 supports Windows Server 2016, 2012 R2 and 2012.

Steps, with the rollback point

1. Inventory the organization. In the Exchange Management Shell run Get-ExchangeServer | Format-Table Name, Edition, AdminDisplayVersion, Get-Mailbox -ResultSize Unlimited | Measure-Object, Get-MailboxDatabase -Status, Get-ReceiveConnector and Get-SendConnector. Run Get-OrganizationConfig | Format-List PublicFoldersEnabled and Get-HybridConfiguration. Write down every client, application and device that sends mail through this server by name or address; those are the things that break.
2. Decide the destination. Microsoft 365 if no regulatory or technical reason forces mail on-premises. Exchange SE otherwise. Microsoft's decommission guide says organizations under 2,000 mailboxes should strongly consider a cutover or staged migration over hybrid, and hybrid for larger or longer migrations, because hybrid allows moves in both directions.
3. Know the identity catch. If you keep Microsoft Entra Connect managing accounts from on-premises Active Directory, you must keep at least one Exchange server to change Exchange recipient attributes, because the source of authority is on-premises. Microsoft's roadmap lists upgrading to Exchange SE, or using a management-tools approach, as the supported answers. Plan this before you promise "we will switch Exchange off".
4. Prepare Active Directory. Domain controllers must run versions supported for the target Exchange. If a Windows Server 2025 domain controller holds the Schema Master, Microsoft requires the November 2025 or later cumulative update on it before any PrepareAD operation. If your domain controllers are also on Windows Server 2016, schedule that work first, because Exchange setup depends on a healthy forest.
5. Back up and freeze. Take a verified backup of the Exchange databases, the system and the configuration, record Get-ExchangeCertificate, the virtual directory URLs (Get-OwaVirtualDirectory, Get-EcpVirtualDirectory, Get-WebServicesVirtualDirectory) and the Autodiscover settings, and stop any "just one more change" on the old server. This is your rollback.
6. On-premises route: build and join. Install Windows Server 2019, 2022 or 2025, run Exchange SE setup (the Exchange Server Deployment Assistant generates a tailored checklist), and add the new server to the existing organization. Microsoft warns that SE CU2 setup prohibits coexistence with any Exchange version no longer supported at that release, so plan to remove Exchange 2016 on a schedule rather than leave it indefinitely, and install the newest cumulative update at build time.
7. On-premises route: move. Create target databases, then move mailboxes with New-MoveRequest -Identity user@contoso.com -TargetDatabase DB-NEW, watch Get-MoveRequest | Get-MoveRequestStatistics, and complete in batches. Move arbitration, audit and discovery mailboxes and public folder mailboxes too. Move the namespace last: import or request certificates, repoint the Autodiscover and virtual directory URLs, and update receive connectors and any relay IP lists.
8. Microsoft 365 route: connect. For a cutover or staged migration, follow the migration batch process in the Exchange admin center. For hybrid, run the Hybrid Configuration Wizard from an on-premises Exchange server, then move mailboxes as remote moves. Public folders need their own migration if you use them, and the decommission guide lists the exact check.
9. Cut mail flow. For Microsoft 365, point MX and Autodiscover at Exchange Online, update both internal and external DNS (Microsoft warns about inconsistent client behaviour otherwise), and move relay users to a supported alternative. Rollback point: keep the old server, its databases and its connectors untouched until mail has flowed cleanly through the new path for a full business cycle.
10. Decommission only when allowed. If all mailboxes are in the cloud and you can disable directory synchronization, Microsoft's steps include removing the Hybrid Configuration Wizard connectors and organization relationship, disabling the OAuth intra-organization connectors, setting Get-ClientAccessService | Set-ClientAccessService -AutoDiscoverServiceInternalUri $Null, and then uninstalling Exchange. If you keep synchronization, keep one (preferably two) Exchange servers for recipient management; they need no database availability group.
11. Uninstall the old server. Run Exchange setup in uninstall mode (Setup.exe /mode:Uninstall /IAcceptExchangeServerLicenseTerms_DiagnosticDataON) after mailboxes, public folders, arbitration mailboxes and connectors have moved, then rebuild or retire the Windows Server 2016 machine.

Mistakes that cause outages

• Upgrading Windows underneath Exchange. Microsoft states it is not supported. A failed upgrade usually means a rebuild during business hours.
• Removing the last Exchange server in a synchronized environment. You lose the ability to edit Exchange attributes for cloud mailboxes.
• Forgetting relay. Printers, scanners, line-of-business apps and scripts relay through the server by IP address. Public folders and SMTP relay are the two things Microsoft calls out as reasons not to decommission.
• Changing MX or Autodiscover in only one DNS. Internal and external records both need to move.
• Leaving the certificate for last. The new server needs a certificate with the right names before clients find it.
• Skipping the schema and domain controller checks. A Windows Server 2025 Schema Master without the required cumulative update can cause replication issues during PrepareAD.
• Running Exchange 2016 alongside a newer SE build indefinitely. Microsoft's coexistence rule for SE CU2 and later blocks it.
• Treating hybrid as free. Hybrid adds complexity; Microsoft recommends cutover or staged for smaller organizations.

Checklist

• Exchange servers, versions, mailboxes, connectors, public folders and relay users inventoried
• Destination chosen: Exchange SE or Microsoft 365
• Identity source of authority understood; plan for the last Exchange server written down
• Domain controllers and functional levels checked; Schema Master update confirmed if on 2025
• Backups verified; certificates and URLs recorded
• New server or tenant ready; test mailboxes moved first
• Mail flow and DNS cut over; relay users moved
• Old Exchange uninstalled, Windows Server 2016 host retired
• Finish before 12 January 2027, and sooner for Exchange itself

Related tools and reading

Use the role-by-role Windows Server 2016 end-of-support planner for the other roles on the same host. For the migration itself, see our guides on the Exchange cutover method, Exchange hybrid deployment prerequisites and Microsoft 365 SMTP relay options.

Sources

Checked 6 November 2026.

• Exchange Server supportability matrix
• Exchange Server 2019 and 2016 End of Support Roadmap
• Upgrading to Exchange Server Subscription Edition
• Exchange Server 2016 on Microsoft Lifecycle
• Announcing Period 2 of the Exchange 2016/2019 ESU program
• How and when to decommission on-premises Exchange in a hybrid deployment
• Windows Server 2016 on Microsoft Lifecycle
• Extended Security Updates for SQL Server and Windows Server
• Prepare to deliver Extended Security Updates for Windows Server through Azure Arc
• License provisioning guidelines for Extended Security Updates for Windows Server
• Billing service for Extended Security Updates for Windows Server through Azure Arc
• Upgrade and migrate roles and features

General planning information, not a design for your environment. Pilot with test mailboxes first.

Need a plan for your servers?

We review Windows Server estates against the January 2027 end of support and give a written, roles-first plan. It is read-only: we change no servers. Scope and how to ask: Windows Server end-of-support review.

Originally published at cloudekhosting.com. Free IT admin tools are at cloudekhosting.com/tools.

This report-first method helps teams find unused Microsoft 365 licences without disrupting work. It separates observable signals from decisions and keeps removal under human approval.

Start with evidence, not an automatic removal

A good licence assignment review starts with a dated inventory of users, account state, assigned products and service plans, assignment source, sign-in indicators, mailbox type and business owner. Microsoft Graph's licenseDetails endpoint returns details for licences assigned directly and through licensed-group membership. Its documentation identifies delegated LicenseAssignment.Read.All as the least privileged permission for that operation and says application permissions are not supported. This is a Microsoft API reference; administrators should confirm the current permission model and their approved reporting route before use.

Keep the extract limited to fields needed for the review, store it in an approved location and record when it was generated. A spreadsheet or read-only CSV report is enough to begin. Do not start by removing assignments or by treating a cost estimate as a realized saving.

Four signals worth reviewing

1. Disabled accounts that still have assignments

A disabled account with a paid product assigned is a strong prompt to ask whether the person has left, changed role, or still owns a service, workflow, mailbox or data. Check the account's owner and dependencies, group-based assignment rules, retention needs and any handover period. If the account is an emergency, service or shared workload identity, use the organization's specific policy instead of an employee rule.

2. Long gaps since sign-in

Microsoft 365 sign-in activity is one signal to review. Microsoft Entra's inactive-account guidance explains how sign-in activity can help investigate inactive accounts. It also stresses that an inactivity window depends on context. The documented lastSignInDateTime records an interactive sign-in attempt, which is not the same as proof of successful use. The page notes that displayed activity can take time to update; access to lastSuccessfulSignInDateTime has separate licensing and permission prerequisites.

Use a gap as a review threshold that your organization chooses. Check leave, seasonal patterns, non-interactive workloads and recent successful activity with the service owner. If the evidence is stale or missing, mark the candidate as uncertain rather than inactive.

3. Shared mailboxes

A shared mailbox licence needs its own review category. Microsoft's shared-mailbox guidance says a separate licence is not required in some situations, but lists exceptions tied to mailbox size, archiving, holds and advanced features. Verify the live mailbox configuration and current licensing terms before changing its assignment. A missing interactive sign-in is not a safe removal signal for a shared mailbox.

4. Duplicate or overlapping SKU assignments

Duplicate licence SKUs can look similar while providing different service plans, or the same entitlement can arrive by direct and group assignment. Compare the enabled services with the user's work, confirm the assignment source, and check whether a group rule will restore a removed licence. Label these rows "possible overlap" until an administrator and service owner verify the requirement.

Make the report useful to a reviewer

For each candidate, show the evidence and its date, why it was flagged, what remains unknown, the business or service owner, the next verification step and a status such as review, confirmed needed, approved to change or unresolved. Do not label a row "waste" just because an account is disabled or quiet. Keep the report separate from the action process: no automatic removal, no silent group changes and no unreviewed mailbox changes.

Before anyone acts, check dependent services, retention and legal holds, mailbox features, group membership and subscription commitments. The authorized administrator should make an approved change through the tenant's established process, document the decision and check that the user or service still works afterward. If a reviewer cannot establish the assignment's purpose, leave it in place until the right owner can decide.

Estimate savings carefully

Use the tenant's actual contract price, currency, renewal date and cancellation terms. A public list price may not match a negotiated rate, and a remaining commitment can mean that removing an assignment does not immediately reduce the bill. Keep confirmed changes separate from potential candidates, and state the assumptions behind any estimate.

A practical review checklist

• Export a minimal, dated view of assignments and account signals.
• Separate disabled users, long sign-in gaps, shared mailboxes and possible SKU overlap.
• Confirm the signal with the account or service owner.
• Check group assignments, enabled service plans, mailbox features and retention.
• Verify actual contract and renewal terms before estimating savings.
• Record approval before an authorized administrator changes anything.
• Recheck the dependent service and assignment rule afterward.

Tools that help

The licence waste analyzer reviews a selected CSV locally in the browser. The Microsoft 365 licence cost calculator helps organize cost assumptions. Both are review aids: they do not connect to a tenant or remove licences.

Frequently asked questions

Does a disabled account always mean its licence is unused? No. Confirm its owner, services, group rules, retention requirements and any handover period first.

Does no recent sign-in prove a licence is not needed? No. Sign-in activity is a signal with timing and interpretation limits. Check with the owner and consider workload patterns.

Should a shared mailbox have its licence removed? Not without checking the mailbox's current size, archive, hold and feature requirements against Microsoft's current guidance.

Can duplicate products be removed automatically? This guide recommends human review. Similar names or overlapping assignments do not prove that an entitlement is redundant.

Export the data yourself

A read-only PowerShell exporter that writes the CSV used above is on GitHub: Cloudek-Hosting/cloudek-scripts. It reads user, enabled state, last successful sign-in and licence SKUs through Microsoft Graph, changes nothing, and is MIT licensed. Read it before you run it, and treat the CSV as personal data. It has not yet been run against many tenants, so test it on a non-production tenant first.

Want a second pair of eyes?

We review Microsoft 365 licence use against your needs and give a written list of what to check before anything is removed. Details: Microsoft 365 licence cost review.

Originally published at cloudekhosting.com. Free Microsoft 365 and IT admin tools are at cloudekhosting.com/tools.