Windows 10 and Server 2016 End-of-Life Checklist

Last updated: October 2026

Windows 10 reached end of support on October 14, 2025. That means mainstream security updates from Microsoft stopped for consumer and most commercial editions unless you buy Extended Security Updates (ESU). Windows Server 2016 reaches end of support on January 12, 2027. If those dates feel abstract, translate them into risk: unsupported systems are harder to insure, easier to exploit, and increasingly incompatible with modern software.

This checklist is practical. It is written for owners and office managers who need a plan, not a lecture. Dates referenced here were verified against Microsoft announcements as of October 2026. Always confirm current terms with Microsoft before you buy ESU or schedule a migration.

What end of support actually means

When Microsoft ends support for an operating system, it stops shipping free security patches for that version. You can keep running the software. The bits do not disappear. What disappears is the stream of fixes that close newly discovered vulnerabilities. Attackers know which versions are abandoned. Automated scanners look for them.

Insurance questionnaires often ask whether endpoints and servers are supported. Partial answers, such as "most of our PCs are fine," create follow-up friction. Cyber insurers and larger customers want a clear inventory and a plan for exceptions.

What ESU is (and is not)

Extended Security Updates are paid, security-only updates for a limited time after end of support. They are a bridge, not a destination. ESU does not restore feature updates, does not fix application compatibility, and does not remove the long-term need to move to a supported OS. For a handful of machines that must wait on a line-of-business vendor, ESU can buy months. For an entire fleet, it becomes expensive noise.

Seven-step action checklist

1. Inventory everything. List every PC and server with hostname, user, OS version, and critical apps. Include laptops that only appear once a week.
2. Run a Windows 11 readiness check. Note TPM, CPU, and RAM blockers. Separate "upgrade in place," "replace hardware," and "temporary ESU" buckets.
3. Prioritize by risk and business impact. Domain controllers, finance PCs, and machines that touch client data move first. Guest or kiosk devices can wait if isolated.
4. Budget hardware and labor together. Device cost without migration labor underestimates the project. Include after-hours cutovers if daytime downtime is painful.
5. Test critical applications early. Old estimating tools, medical imaging viewers, or niche plugins may refuse Windows 11. Discover that before mass migration day.
6. Migrate in waves. Pilot a small group, fix surprises, then move departments. Preserve user data and printers deliberately.
7. Document the final state. Asset list, admin accounts, and backup verification should exist after the dust settles.

Machines that cannot run Windows 11

Not every PC can upgrade. Options include replacement with a modern device, temporary ESU while you wait on a vendor, or isolating an old machine from the internet and sensitive data (a last resort with clear risk). Shared production PCs on a plant floor sometimes fall into this category. Treat them as exceptions with compensating controls, not as the default.

Servers deserve their own track. Moving off Windows Server 2016 may mean upgrading in place, standing up a new server, or migrating file and application workloads to Microsoft 365 or another cloud. Start that conversation well before January 2027.

If you want help turning this checklist into a fixed-price project for your Chicagoland office, book a free 30-minute IT checkup. Bring your rough device count and any apps you cannot live without.