Microsoft is approaching the final support milestones for SQL Server 2016 and Windows Server 2016. Once these products reach End of Support (EOS), they will no longer receive free security updates, creating heightened security, compliance, and operational risks. 

To help organizations transition, Microsoft offers Extended Security Updates (ESU) — a paid, time‑limited program that delivers Critical and Important security patches only. ESU is a temporary risk‑mitigation measure, not a long‑term solution, and should always be paired with a clear upgrade or modernization plan.  

SQL Server 2016

• End of Extended Support (EOS): 14 July 2026
• Extended Security Updates (ESU) availability:

• • Year 1: 15 Jul 2026 – 13 Jul 2027
  • Year 2: 14 Jul 2027 – 18 Jul 2028
  • Year 3: 19 Jul 2028 – 17 Jul 2029

After 14 July 2026, SQL Server 2016 will no longer receive free security updates. ESU provides security patches only and does not include feature updates, performance improvements, or general support.

• Windows Server 2016

End of Extended Support (EOS): 12 January 2027

After this date, Microsoft will stop releasing security updates unless ESU is applied. ESU is designed as a short-term transition option while organizations prepare for an upgrade or migration.

Extended Security Updates (ESU) is a paid security update program offered by Microsoft for Windows Server versions that have reached the end of extended support. It is designed as a temporary transition solution, not a feature upgrade.  

Key characteristics of ESU include:  

• Provides Critical / Important security updates only  

• Does not include new features, performance improvements, or general technical support  

• Available for a maximum of three years, depending on the product version  

• Intended for organizations that are not yet able to upgrade or migrate immediately  

In the Hong Kong market, ESU is commonly adopted as a transitional measure under the following scenarios:  

• Core business systems (such as ERP, property management, or logistics platforms) still depend on legacy Windows Server versions  

• Thirdparty applications have not yet completed certification for newer platforms  

• Systems are subject to regulatory, audit, or compliance requirements that limit shortterm changes  

• IT teams require additional time for upgrade planning, testing, and user training  

Some organizations mistakenly assume that purchasing ESU means the system remains “fully supported.” In reality, this is not the case:  

• ESU does not extend the product lifecycle  

• No day-to-day technical support or non-security fixes are included  

• Costs typically increase year over year  

• Long-term reliance on ESU increases technical debt and operational risk  

For Hong Kong organizations, ESU is not just an IT decision—it is part of a broader risk management and compliance strategy:  

• Regulatory & audit readiness (PDPO, ISO, industry frameworks) 

• Rising cyber threat exposure on unsupported platforms 

• Limited IT resources in SME and mid-market environments 

• Business continuity risks for mission-critical workloads 

Delaying action beyond EOS significantly increases security exposure and remediation cost. 

Highlighted the following supported options for organizations approaching EOS: 

• Upgrade on‑premises 

• Move to supported versions (e.g. Windows Server 2022, SQL Server 2022) 

• Migrate to Azure 

• Azure Virtual Machines and Azure SQL provide a modernization path. 

• In many cases, ESU costs can be reduced or eliminated when workloads are migrated to Azure 

• Adopt hybrid architectures 

• Balance on‑prem and cloud while reducing future EOS exposure 

As a trusted Managed Cloud Service Provider and Microsoft Solutions Partner, Superhub supports organizations through every stage of this transition — from risk assessment and ESU planning to server upgrade, Azure migration, and long-term cloud operations — helping enterprises modernize with confidence while maintaining security, compliance, and business continuity. 

1. Is ESU suitable for all organizations?
   Not necessarily. ESU is suitable for organizations that cannot upgrade in the short term. It is not intended as a longterm solution.
2. Does using ESU still meet compliance requirements?
   In most cases, ESU can support compliance during the covered period, provided risks are properly managed.
3. How long can ESU be used?
   Up to three years, depending on the product version.
4. Is migrating to the cloud mandatory?
   No. However, cloud or hybrid architectures significantly reduce future support and security risks.
5. How can SUPERHUB support this process?
   From risk assessment and upgrade planning to ongoing IT management and security services

Source: Strengthen business resilience with Windows 365 and Azure Virtual Desktop | Windows Experience Blog