Windows Server 2016 end of life: is your CPA firm's tax server ready?

When is Windows Server 2016 end of life?

Windows Server 2016 reaches end of life on January 12, 2027, the day Microsoft's extended support ends, and in many CPA firms it is still the server holding the tax database. Microsoft calls this end of support and confirmed the date in its February 2026 planning announcement, and the Windows Server 2016 lifecycle page shows the same end of extended support. The server will keep running after that date, but Microsoft stops releasing security updates for it unless the firm pays for Extended Security Updates (ESU).

For a CPA firm, that date falls in the worst possible window. The 2026 tax software releases install in late fall, busy season follows soon after, and nobody wants to rebuild the server that holds the tax database while returns are in progress.

Why does an old server matter for a tax practice?

It usually holds client tax data, and a tax preparer is a financial institution under the FTC Safeguards Rule. The definition at 16 CFR 314.2(h)(2)(viii) includes an accountant or other tax preparation service in the business of completing income tax returns. Those firms must maintain a written information security program that meets 16 CFR 314.4.

In a small firm, the closet server often does several jobs at once. It hosts the network share for the tax software database, receives scans from the copier, stores the document management files, runs the domain controller that handles logins, and sometimes doubles as the backup target. Each of those roles puts taxpayer data, or the keys to it, on a machine that will stop getting fixes.

The Safeguards Rule does not name operating systems. It requires a risk assessment that identifies reasonably foreseeable internal and external risks to customer information under 314.4(b), and safeguards designed to control the risks that assessment finds under 314.4(c). A server with a published end-of-support date is about as foreseeable as a risk gets.

The rule also requires vulnerability assessments at least every six months unless the firm runs effective continuous monitoring, under 314.4(d)(2). After January 12, those scans will keep reporting findings on the old server that can no longer be patched.

The IRS makes the same point in plainer terms. Publication 4557, Safeguarding Taxpayer Data, tells tax professionals to check with software vendors regularly and install patches that fix vulnerabilities. That advice stops being possible on an operating system that no longer receives patches.

Will tax software still run on Windows Server 2016?

Some packages will for now, and at least one major vendor has already dropped it. Drake Software's system requirements list Windows Server 2019, 2022 and 2025 as supported servers and state that Windows Server 2016 is no longer supported after Drake Tax 2025. Its 2026 requirements sheet lists the same three server versions.

Other vendors still list Windows Server 2016. Thomson Reuters' UltraTax CS system requirements include Server 2016 alongside 2019, 2022 and 2025, and Intuit's Lacerte requirements list it for tax year 2025. Vendor support and Microsoft support are separate questions: a tax program can be certified to run on a server that Microsoft has stopped patching.

Prior-year programs deserve their own check. Most firms keep several years installed for amended returns and notices, and Intuit's Lacerte page warns that users won't be able to sign in to prior-year programs on unsupported operating systems. Check the document management, portal sync and practice management tools that share the server, too.

What are the options before January 12, 2027?

There are four realistic paths, and many firms combine two of them.

• Upgrade in place. Microsoft supports in-place upgrades from Windows Server 2016 to 2019, 2022 or 2025. This keeps the same hardware, so it only makes sense if the hardware will last several more years and every application on the server supports the new version.
• Replace the server. A new server on Windows Server 2025, a fresh install of the tax software and a clean data migration. It takes more work up front and is the usual choice when the hardware is as old as the operating system.
• Move to hosted or cloud tax software. Many vendors offer hosted or browser-based versions. That removes the server from the office, and it makes the vendor a service provider. Under 314.4(f), the firm must select providers capable of maintaining appropriate safeguards, require those safeguards by contract, and periodically assess them.
• Buy time with ESU. Microsoft's Extended Security Updates page describes yearly purchases through Volume Licensing and a pay-as-you-go option through Azure Arc for eligible customers. ESU works as a short bridge for a server that cannot move before January. Plan the exit in the same decision.

Whichever path you choose, the old server's drives still hold taxpayer data. Under 314.4(c)(6), customer information must be securely disposed of no later than two years after it was last used for the customer, unless it is needed for a business or legal reason. Wipe or destroy the drives and keep a record of how and when. Our guide to how long tax preparers keep records covers which files to keep before anything is destroyed.

Why not wait until after April 15?

Because the support deadline arrives first. Waiting means running the busiest months of the year on a server that receives no security fixes, at the time client data on it is most active and most valuable.

A mid-season failure is also harder to absorb. Restoring a tax database onto new hardware in March, with returns in progress and e-file acknowledgments coming back, is a different job from a planned migration in November. A server change is also a material change to your information systems. Under 314.4(g), the program must be adjusted after material changes to operations, and 314.4(d)(2) calls for a vulnerability assessment after material changes too. Doing the work before the season leaves time to update the WISP and run that assessment.

What should a firm do this quarter?

• List every server and what runs on it: current and prior-year tax programs, document management, portal sync, accounting data files, backups and logins. Note the Windows Server version and the hardware age.
• Check each vendor's tax year 2026 system requirements, including the requirements for prior-year programs you keep installed.
• Pick a path for each server and set a cutover date before mid-December, after the 2026 software installs cleanly.
• Test a restore from backup onto the new system before cutover, including a prior-year return.
• Update the WISP: the system inventory, the risk assessment and any new service provider. IRS Publication 5708 walks through what a tax practice WISP should contain, and our guide to updating your WISP before the 2027 filing season covers the rest of the annual refresh.
• Run a vulnerability scan after cutover and file the report with your Safeguards Rule records.
• Sanitize the old drives and record the method and date.

If desktops are on the same list, our guide to workstation fixes before tax season 2027 covers the endpoint side.

How s90 helps

s90 manages servers, workstations and Microsoft 365 for accounting firms in Los Angeles and Orange County, and we schedule server retirements around the tax calendar. We inventory what runs on the old server, confirm vendor support, migrate the data, test restores, and document the change in your WISP and risk assessment. If a Windows Server 2016 machine is still in your closet, we're glad to look at it with you before January.