Law firm document management migration: the Windows Server 2016 deadline

If you run operations at a law firm, the server most likely to still be on Windows Server 2016 is the one behind your document management system. Every matter depends on it, and Microsoft stops patching it on January 12, 2027. A law firm document management migration takes planning and testing, so this is the quarter to put a date on the calendar.

When does Windows Server 2016 support end?

Microsoft ends extended support for Windows Server 2016 on January 12, 2027. After that date the operating system gets no further security updates unless the firm pays for Extended Security Updates (ESUs). The server keeps running, the DMS keeps opening documents, and nothing visibly breaks on January 13. What changes is that each newly discovered vulnerability in the operating system stays open.

That server was usually set up when the firm bought its DMS licenses, and it still works. Moving it means touching every client file the firm holds, which is why the decision tends to slip until the deadline is close.

Why does the database matter as much as the operating system?

The database matters because many on-premises document management systems keep their profiles, metadata and security settings in Microsoft SQL Server, and that database often lost support before the operating system did. Firms that installed their DMS on Windows Server 2016 frequently paired it with SQL Server 2016. SQL Server 2016 left extended support on July 14, 2026, and Microsoft now sells ESUs for it in yearly increments through July 2029.

A firm in that position may already be running an unpatched database and is about to lose operating system updates on top of it. Before choosing a target, ask the DMS vendor which Windows Server and SQL Server versions its current release supports. Upgrading the operating system alone can leave the firm on a DMS release the vendor no longer certifies, which trades one support gap for another.

Does an unsupported server raise an ethics issue?

It can, because California's duties of competence and confidentiality reach the technology a firm uses to store client files, even though no rule names software versions. Comment 1 to Rule 1.1 says a lawyer's duty of competence includes the duty to keep abreast of "the benefits and risks associated with relevant technology." Business and Professions Code section 6068(e)(1) requires a lawyer "to maintain inviolate the confidence, and at every peril to himself or herself to preserve the secrets, of his or her client."

The State Bar's Formal Opinion No. 2010-179 applies those duties to technology choices. Before relying on a technology to store or transmit confidential information, an attorney should evaluate factors that include "the level of security attendant to the use of that technology," "the degree of sensitivity of the information," and "the possible impact on the client of an inadvertent disclosure of privileged or confidential information or work product." A server that can no longer be patched weakens the first factor while the other two stay as high as they ever were.

Separately, Civil Code section 1798.81.5 requires a business that owns, licenses or maintains personal information about California residents to implement and maintain reasonable security procedures and practices, and law firms hold plenty of that information. None of this tells a particular firm what it is obligated to do. It does mean "the server still works" is a thin answer if a client, a carrier or the State Bar later asks how the firm protected the files on it.

What are the options before January 12, 2027?

A firm with its DMS on Windows Server 2016 can upgrade in place, rebuild on a new server, move to a hosted DMS, or buy Extended Security Updates, and many firms combine two of these.

• Upgrade in place. Microsoft's upgrade path guidance allows a nonclustered Windows Server 2016 machine to upgrade directly to Windows Server 2019, 2022 or 2025. This is the quickest route when the hardware has life left and the DMS vendor supports the newer version.
• Rebuild on a new server. Stand up a current Windows Server release with a supported SQL Server version, then migrate the DMS database and file store. It takes more work, and it leaves the firm on clean hardware with years of support ahead.
• Move to a hosted DMS. If your DMS vendor offers a hosted edition, or the firm is prepared to move documents into Microsoft 365, the server goes away entirely. The project becomes a data migration with its own testing, which the next section covers.
• Buy Extended Security Updates. Microsoft sells ESUs for Windows Server 2016 through Azure Arc with pay-as-you-go billing for eligible customers, or through volume licensing with annual billing. ESUs keep operating system patches flowing while a migration finishes. They do not cover the DMS application, and they do not fix an unsupported SQL Server instance unless you buy SQL Server ESUs as well.

What has to survive a law firm document management migration?

A law firm document management migration has to carry across everything that makes the DMS more than a file share. Before moving, list what the firm relies on, and test each item after cutover:

• Client and matter numbers, document profiles and custom metadata fields.
• Ethical walls and matter-level security, so that a screened lawyer cannot see after the move what they could not see before it.
• Version history and audit trails, which the firm may need to show who changed a document and when.
• Email filing from Outlook into matters, including mail filed by assistants on an attorney's behalf.
• Integrations with time and billing, accounting and Office add-ins. If the firm is also moving off Office 2021, check how Office 2021 end of support affects DMS integrations in the same test plan.

Trust accounting records deserve particular care. California's Rule 1.15 requires complete records of client funds and property, and those records have to be kept for at least five years after final distribution. If any of them live in the DMS or on the same server, the migration plan should confirm they arrive complete and readable before the old server is wiped. Closed client files raise their own questions, covered in how long attorneys have to keep files in California.

What should a law firm do this quarter?

This quarter, a law firm should inventory its 2016 servers, talk to its DMS vendor and set a cutover date before January 12, 2027. In order:

1. Identify every server running Windows Server 2016 and every SQL Server 2016 instance, including the ones behind the DMS, the time and billing system and any old file shares.
2. Ask the DMS vendor which operating system and SQL Server versions its current release supports, whether a hosted edition exists for your license, and what its migration process involves.
3. Pick a path and a cutover date. If the work cannot finish by January 12, 2027, price ESUs for the gap and write down when they will end.
4. Build a test plan from the list above, and have a partner and a legal assistant sign off on it after a trial migration.
5. Keep the old server read-only until records are verified, then sanitize its drives and record how and when that was done.

How s90 helps

s90 manages Windows Server and Microsoft 365 environments for law firms across Los Angeles and Orange County. We inventory what is still on 2016, work with your DMS vendor on a supported target, run the migration and the testing, and document the decision so partners and your carrier can see what was done. If a second set of eyes on your plan would help, we are glad to talk it through.