SQL Server 2016 end of support arrived on July 14, 2026. That date has passed. If you are still running it without Extended Security Updates, your database has been receiving no security patches for over a month.

Most articles on this subject were written before the deadline and tell you how to prepare for it. This one is about what to do now that it is behind you — including one billing detail that costs money the longer you wait to decide.

We have run SQL Server for U.S. businesses since 2003, including operations databases for electric utility and recycling companies that have been in continuous production for over twenty years. Here is the honest picture.

What SQL Server 2016 End of Support Means Now

Three things ended, and the third surprises people.

Security updates stopped. Any vulnerability discovered in SQL Server 2016 from that date forward stays open on your instance permanently unless you are covered by ESU.

Bug fixes and technical support stopped. Those actually ended five years earlier, when mainstream support finished in July 2021. Since then it has been security patches only.

You can no longer open a support case. This is the one that catches businesses out. For SQL Server 2016 you cannot log a support ticket with Microsoft even if you hold an active support plan — unless you subscribe to ESU, and then only for issues relating to the updates themselves. Paying for support does not buy you support on this product any more.

Meanwhile the database keeps running perfectly. Nothing fails. That is precisely why unsupported SQL Server instances sit in production for years.

Extended Security Updates, and the back-billing trap

ESU is available for SQL Server 2016, and it runs in annual terms out to July 17, 2029 — three years past the deadline. SQL Server 2014 has its own ESU coverage running to July 2027.

Two features of the program are worth understanding before you treat it as a comfortable option.

SQL Server ESU covers Critical updates only. This is narrower than the Windows Server ESU program, which includes Critical and Important. SQL Server does not ship a general monthly security update, so coverage is on-demand for critical bulletins. You are buying a thinner layer of protection than the Windows equivalent.

Late enrolment is back-billed. If you enrol after the end-of-support date, you are charged a one-time upfront amount covering the months you missed. A business enrolling in January 2027, for example, receives a back-bill for July through December 2026 in its first month. Waiting does not save money — it defers the same cost and leaves you unprotected in the meantime.

There is one genuine exception worth knowing: instances running on Azure virtual machines receive ESU at no additional cost. If a migration to Azure was already on your roadmap, that changes the arithmetic considerably.

Confirm current terms in Microsoft’s Extended Security Updates FAQ for SQL Server before committing either way.

SQL Server 2017 is only fifteen months behind

If your answer to 2016 is “upgrade to 2017,” stop.

SQL Server 2017 reaches end of extended support on October 12, 2027 — fifteen months after the 2016 date. Moving from one to the other buys you barely a year and commits you to running the same project again almost immediately.

Later versions carry substantially longer runways, extending into the 2030s. Whichever you choose, look up the actual lifecycle dates rather than assuming, and pick based on how long you intend the system to live rather than on how small the version jump feels.

The Windows Server constraint that decides your options

This is where a database upgrade becomes an infrastructure project, and it is the part most plans discover too late.

Newer SQL Server versions require newer Windows Server versions, and the reverse also applies — newer Windows Server releases drop support for older SQL Server versions. If the server underneath your database is also aging, you may not be able to upgrade one without the other.

That matters right now for a specific reason: Windows Server 2016 reaches its own end of support on January 12, 2027, roughly six months after the SQL date. A significant number of businesses are running SQL Server 2016 on Windows Server 2016, which means two deadlines six months apart on the same machine.

Treat that as one project. Our guide to Windows Server 2016 end of support covers the infrastructure side, and planning both together is meaningfully cheaper than planning them twice.

How to upgrade without breaking the application

The database is rarely the hard part. The application on top of it is.

Check compatibility level, not just version. Upgrading the instance does not automatically change a database’s compatibility level, and leaving it at the old setting preserves old query optimizer behaviour. That is sometimes deliberate and sometimes an accident that leaves performance gains unclaimed.

Expect query plan changes. The optimizer has changed considerably across versions. Most queries get faster. A few get dramatically slower, and those are the ones that generate the angry call the morning after go-live. Query Store, available since SQL Server 2016, records plans over time and lets you force a previous one — turn it on before the upgrade so you have a baseline to compare against.

Test with production-like data volumes. A query that performs fine against a copy of last year’s data can behave completely differently against forty million current rows.

Confirm vendor support. If a third-party application sits on the database, its vendor has a supported-version matrix of its own. Check it before choosing a target, not after.

Verify your backups restore first. Not that backup jobs report success — that a restore actually works, onto different hardware. Our guide to data backup and recovery covers why that distinction matters.

The compliance and insurance angle

Regulatory frameworks including PCI DSS and HIPAA require supported software. An unsupported database engine can produce a failed audit whether or not anything was breached.

Cyber insurance is sharper. Many policies allow a claim to be denied where a breach occurred on unsupported software. If you are relying on ESU rather than upgrading, confirm in writing that your insurer treats an ESU-covered instance as supported. Do that before a claim, not during one.

What to Do After SQL Server 2016 End of Support

1. Inventory every SQL Server instance, including Express editions and instances bundled inside third-party applications. These are the ones nobody remembers.
2. Record the version, edition, and the Windows Server version underneath each one.
3. Decide per instance: upgrade, ESU, migrate to Azure, or retire. Some instances support applications nobody uses any more.
4. If you are choosing ESU, enrol now rather than later — the back-bill accrues either way and you are exposed in the meantime.
5. Map the dependencies before scheduling anything. This is where the surprises live.

Where ITsoft fits

Our Microsoft SQL Server database development work covers upgrades, migrations, performance, and long-term support for businesses whose operations depend on the database rather than merely using one. Our guide to SQL Server consulting explains how we approach a diagnosis before recommending anything.

If you are unsure which SQL Server versions you are running, that uncertainty is the finding — and it is a quick one to resolve.

Talk to Mike Treat about a SQL Server upgrade assessment — we will inventory your instances, check the Windows Server dependencies, and give you a written path with costs and sequencing. The report is yours regardless.

Related reading: SQL Server consulting · Windows Server 2016 end of support · Windows Server 2012 R2 end of life · data backup and recovery