Windows Server for nonprofits: is your donated 2016 server ready for end of support?

If your agency's server was set up with donated Microsoft licenses around 2017, it is probably running Windows Server 2016, and that version stops receiving security updates on January 12, 2027. Replacing it is now a budget decision for the executive director and the finance committee, because Windows Server for nonprofits is no longer a free donation in most countries.

When does Windows Server 2016 support end?

Windows Server 2016 reaches end of support on January 12, 2027. Microsoft confirmed the date in its February 2026 planning announcement and on its product lifecycle page. After that day the server keeps running, but Microsoft stops releasing security updates for it unless the organization pays for Extended Security Updates (ESU).

Many nonprofits still run this version for a simple reason: it was current when Microsoft still donated server software. A server set up in 2017 or 2018 with donated licenses often still handles staff sign-in, the shared drive, a donor database or a case management system. In many agencies, nobody now on staff set it up, and the documentation left with the volunteer or consultant who did.

Why is a donated server harder to replace than a purchased one?

A donated server is harder to replace because its replacement is no longer free, and its license may rule out the cheapest stopgap. TechSoup announced that Microsoft on-premises products would stop being available to nonprofits as donations on April 4, 2022, and would move to discounted offers instead. Windows Server donations continue only in countries where Azure is not available.

That change creates three problems for a board that approved the original server as a gift:

• No budget line. The server never appeared as a capital cost, so its replacement may not appear in the next fiscal year's budget either.
• License limits on ESU. Microsoft's Azure Arc ESU documentation requires Software Assurance on the Windows Server licenses, unless they are licensed through SPLA or a server subscription. TechSoup lists most of its current Windows Server 2025 offers as discounted licenses without Software Assurance. Confirm what your own licenses include before counting on ESU.
• Unknown contents. A server that has run quietly for years tends to collect files, scanned intake forms and old exports that no one has reviewed.

Does California law require nonprofits to keep servers patched?

Not in those words, but California's reasonable security requirement applies to nonprofits. Civil Code section 1798.81.5 requires a business that owns, licenses or maintains personal information about California residents to implement and maintain reasonable security procedures and practices appropriate to the nature of the information. Section 1798.80(a) defines business to include an organization "whether or not organized to operate at a profit."

The statute does not define reasonable security, and it does not mention unsupported software. A server that has gone months without security updates is a difficult fact to explain after an incident, and a breach of certain personal information triggers notice duties to affected residents under section 1798.82.

Do federal grants add cybersecurity expectations?

Yes, for awards under the revised Uniform Guidance. The 2024 revision of 2 CFR 200.303 requires recipients and subrecipients to take reasonable cybersecurity and other measures to safeguard information, including protected personally identifiable information. The revised rules apply to federal awards issued on or after October 1, 2024.

For an agency running federally funded programs, a server that holds client records and no longer receives security updates is the kind of item a funder or single audit reviewer may ask about. Having a dated retirement plan on file is a better answer than an open question.

What are the Windows Server options for nonprofits before January 12, 2027?

There are four realistic paths, and most nonprofits combine two of them.

• Move the files to Microsoft 365. Shared drives can often move to SharePoint and OneDrive, which takes the server out of the file role entirely. Microsoft's published limits of 250 GB per file and a recommended ceiling of 300,000 synced items fit most nonprofit document libraries.
• Upgrade in place. Microsoft supports an in-place upgrade from Windows Server 2016 directly to Windows Server 2019, 2022 or 2025 on the same hardware. It requires a new license, and discounted Windows Server 2025 licenses have been available through TechSoup since November 25, 2024. It only makes sense if the hardware itself has several years left.
• Replace the application. If the server exists mainly to run a donor, accounting or case management database, ask that vendor whether a hosted version exists and what it costs. Retiring the application often retires the server.
• Bridge with ESU. Microsoft offers Extended Security Updates for Windows Server 2016 after support ends. Classic ESUs are bought in yearly increments, and workloads moved to Azure receive ESUs for three more years. Through Azure Arc, Windows Server 2016 ESUs can be configured from August 3, 2026, and billing begins January 13, 2027. Treat ESU as a bridge with a written end date.

Whichever path you choose, check what Microsoft's nonprofit program covers. Organizations approved for it can receive a $2,000 USD annual Azure Sponsorship grant for first-party Azure services. The credit must be renewed every year and does not roll over, so price any Azure workload before counting on the grant to pay for it.

What should happen to the old server once it is retired?

Wipe the drives before the hardware leaves your control. Civil Code section 1798.81 requires a business to take all reasonable steps to dispose of customer records containing personal information by shredding, erasing or otherwise making the information unreadable. Whether every donor counts as a customer under that statute is a question for counsel, so many nonprofits treat all personal information the same way.

Before wiping, decide what must be kept. Export the records your retention schedule requires, move them somewhere supported, and purge the rest. Our guide to nonprofit document retention and donor data cleanup walks through that decision. Keep a short record of how the drives were wiped, when and by whom. Old servers are often re-donated or recycled, and that record shows the data did not travel with them.

What should a nonprofit do this quarter?

Start with the inventory, because every other decision depends on it. Our guide to building a hardware and software asset inventory shows a simple way to record it.

• List every server, physical or virtual, with its Windows version. Include the one at the program site and the one under the front desk.
• Write down what each server does: sign-in, files, printing, databases, backups and any scan-to-folder destinations.
• Find the license records and note whether Software Assurance is included.
• Ask each software vendor whether its product supports Windows Server 2022 or 2025, or offers a hosted version.
• Present the replacement cost to the finance committee as a security item with a date attached, so it lands in the next budget.
• Pick a migration date before January 12, 2027. If you need ESU, document the bridge and the date it ends.

If the server also runs your shared drive, the move to Microsoft 365 is a good moment to clean up permissions, an idea we cover with other low-cost steps in five free cybersecurity wins for nonprofits.

How can s90 help?

s90 works with nonprofits and social service agencies in Los Angeles and Orange County to inventory aging servers, move file shares into Microsoft 365 and retire old hardware with a documented wipe. If your board needs a one-page plan and budget for the Windows Server 2016 deadline, we can help you put it together.