Windows Server 2016 end of support: what should RIAs do now?

When is Windows Server 2016 end of support?

Windows Server 2016 end of support is January 12, 2027, when Microsoft's extended support ends and regular security updates stop. Microsoft confirmed the date in its February 2026 planning announcement, and its Extended Security Updates page lists January 12, 2027 as the day "Windows Server 2016 Extended Support ends." Many vendors call this date Windows Server 2016 end of life. The server will keep running, but it will stop receiving security fixes unless the firm pays for Extended Security Updates (ESU).

Many advisory firms still have at least one of these machines. It is often the server in the office closet that runs the domain controller and file shares, an older portfolio accounting or CRM database, or the scan-to-folder destination for the front desk. Each of those roles can put client records on the box. The same review is a good time to check desktops and Office versions, covered in our Office 2021 and Windows 10 ESU guide for RIAs.

Why should a CCO care about a server's support date?

The server likely holds customer information, and Regulation S-P requires written policies and procedures reasonably designed to "protect against any anticipated threats or hazards to the security or integrity of customer information," under 17 CFR 248.30(a)(2)(ii). A published end-of-support date is about as anticipated as a hazard can be.

The rule does not mention unsupported software by name, and it does not prescribe what a firm must do with any particular machine. The SEC's Division of Examinations said in its fiscal year 2026 examination priorities that after the compliance dates it would examine whether firms have developed and implemented the amended Regulation S-P requirements. Those dates have now passed: December 3, 2025 for larger entities and June 3, 2026 for smaller ones. An examiner reviewing your safeguards may ask how a server without security updates fits inside them.

For an SEC-registered adviser, Rule 206(4)-7 also requires an annual review of the adequacy and effectiveness of the firm's compliance policies and procedures. The server decision, and the date it was made, belongs in that review.

What are the options before Windows Server 2016 end of support?

Most firms choose one of three paths for each server, and many use more than one:

• Migrate the workloads and retire the server. File shares can move to SharePoint and OneDrive, sign-in and device management can move to Microsoft Entra ID and Intune, and line-of-business applications can move to the vendor's hosted version where one exists.
• Upgrade to a supported version of Windows Server. Microsoft points customers to Windows Server 2025.
• Buy time with ESU while a migration finishes. Microsoft sells Extended Security Updates for Windows Server 2016: classic licenses are bought in yearly increments, and eligible customers can pay as they go through Azure Arc.

Before choosing, ask each software vendor in writing whether its product is supported on the server version you plan to run. An application that only runs on Windows Server 2016 can force the decision, and ESU only covers the operating system.

What happens to the records stored on that server?

They must stay retrievable after the server is gone. Rule 204-2 requires most adviser books and records to be kept for at least five years from the end of the fiscal year of the last entry, the first two in an appropriate office of the adviser. Records kept electronically must be arranged and indexed to permit "easy location, access, and retrieval of any particular record," with a duplicate copy stored separately for the full retention period. Our guide to Reg S-P recordkeeping under Rule 204-2 lists which records are covered.

Rule 204-2(g)(3) also requires procedures to maintain electronic records "so as to reasonably safeguard them from loss, alteration, or destruction" and to limit access to authorized personnel and the Commission. A migration plan should map where each category of record will live, confirm the duplicate copy, and test retrieval of a sample of old records before anyone wipes the old server.

When the server is retired, its drives still hold client data. NIST SP 800-88 Rev. 2 describes media sanitization methods, and a certificate of sanitization or destruction is the document to keep.

What about servers your vendors run?

Your own office is only part of the picture. The amended Regulation S-P requires written policies and procedures for overseeing service providers, including that a provider notify the firm as soon as possible, and no later than 72 hours, after becoming aware of a breach in security that results in unauthorized access to a customer information system the provider maintains, under 17 CFR 248.30(a)(5). Ask the providers that store or process your client data, including your IT provider, whether any system that touches your data runs Windows Server 2016 and what their plan is for January 12. Our article on Reg S-P service provider notice covers the contract terms to check.

What should an advisory firm do this quarter?

With roughly three months left, a short plan is enough to get every server on a path:

• Inventory every physical and virtual server: operating system version, role, location, and what customer information it holds.
• Ask each software vendor in writing which server versions it supports.
• Decide for each server whether to migrate, upgrade or buy ESU as a bridge, and record the owner and target date.
• Map the books and records on each server, confirm the duplicate copy, and test retrieval before cutover.
• Budget for ESU on any server that will not be finished by January 12, 2027.
• Record the decision in your Regulation S-P risk documentation and your annual Rule 206(4)-7 review.
• Plan sanitization and keep certificates for retired drives.

This article describes what the rules and Microsoft's published dates say. It is not legal advice. Whether a particular server, record set or vendor arrangement meets your firm's obligations depends on your facts, and your compliance counsel can advise on those.

How does s90 help?

s90 works with RIAs, broker-dealers, dual-registered firms, insurance agencies and family offices across Los Angeles and Orange County. We inventory servers, plan and run migrations to Microsoft 365 and Azure, preserve and test books and records through the move, and sanitize retired hardware with documentation for your exam file. Our agreements include 72-hour breach notification and 24-hour evidence production commitments. If you still have a Windows Server 2016 machine in the office, talk with our team about a plan before January.