Windows Server 2016 reaches the end of Extended Support on January 12, 2027. For organizations that still rely on it, the approaching deadline is an opportunity to look beyond individual servers and examine how legacy workloads fit into the broader infrastructure.
This is particularly relevant for Active Directory Certificate Services (AD CS). AD CS may not be as visible as an application server or database, but it can support authentication, encryption, secure communications, and trust across applications, devices, and infrastructure.
For organizations in Singapore and Malaysia managing increasingly hybrid environments, migrating AD CS is therefore about more than moving a Windows Server role. It requires an understanding of the dependencies surrounding the service and a clear view of where it fits within the organization’s future infrastructure strategy.
Microsoft’s Extended Support for Windows Server 2016 ends on January 12, 2027. After this date, organizations will no longer receive regular security updates and fixes for the operating system under standard support.
This creates a decision point for every workload still running on Windows Server 2016. Some may be suitable for an upgrade to a supported Windows Server release. Others may be better candidates for migration to Azure or another modern infrastructure environment. For workloads that cannot be migrated immediately, Microsoft also provides Extended Security Updates (ESUs) as a temporary transition option.
The important consideration, however, is that infrastructure modernization rarely happens server by server. A workload can have dependencies on applications, identity services, databases, network services, and management platforms. Moving the workload without understanding those relationships can introduce disruption even when the underlying migration is technically successful.
AD CS illustrates this particularly well because the service can sit beneath several layers of the IT environment.
AD CS provides the public key infrastructure capabilities that organizations use to issue and manage digital certificates. These certificates can support user and machine authentication, secure communications, network access, and application services.
The Certificate Authority (CA) is therefore more than a server performing a single function. Its database, private key, configuration, and certificate templates form part of the trust infrastructure on which other systems depend.
Those dependencies are not always obvious. Applications may rely on certificates issued by the CA, devices may use automated certificate enrolment, and authentication services may depend on certificate-based trust. A certificate that is not issued or renewed correctly can affect a service that appears to have little connection to the CA itself.
This makes AD CS different from a typical application workload approaching an operating system upgrade. The migration needs to account not only for the CA itself but also for the environment built around it over time.
The technical process of migrating AD CS involves preserving the CA database, private key, and relevant configuration while establishing the service in a supported environment. But the technical migration is only one part of the challenge.
The larger consideration is continuity.
An organization needs to understand which applications, devices, authentication services, and other infrastructure components depend on its certificate environment. It also needs to consider how those dependencies will operate once the CA has moved.
This becomes particularly important in hybrid environments. Organizations may retain core infrastructure on-premises while running applications and services across one or more cloud platforms. Identity and certificate services can continue to connect these environments even as individual workloads change location.
That means there may not be a single answer to where AD CS should reside. Keeping the service on-premises, moving it as part of a broader cloud transformation, or redesigning parts of the surrounding infrastructure may each make sense in different environments.
The right decision depends on the organization’s business requirements, technical dependencies, security considerations, and broader modernization roadmap.
The objective should not be to recreate the legacy environment on a newer server simply because the existing operating system has reached the end of its support lifecycle. A migration is an opportunity to determine what the organization needs to preserve, what can be improved, and how the service should operate within the target infrastructure.
This is where discovery becomes important.
Before deciding how to migrate AD CS, infrastructure teams need a clear picture of the existing CA architecture, the certificates and templates in use, and the systems that depend on them. They also need to understand how certificate enrolment, renewal, and authentication work across the environment.
The purpose is not to create an exhaustive inventory for its own sake. It is to provide enough visibility to make sound decisions about the target state.
For example, an organization may discover that some certificate-dependent workloads are closely tied to on-premises infrastructure, while others already operate across cloud environments. That information can influence where services should run and how they should be managed.
It can also reveal opportunities to address related infrastructure dependencies during the same transformation rather than simply carrying them forward.
This is particularly valuable in hybrid environments, where the goal is not necessarily to move everything to one location. Modern infrastructure increasingly requires organizations to make deliberate decisions about workload placement while maintaining consistent management, security, and operational control across environments.
Windows Server 2016 End of Support provides a natural point for organizations to reassess workloads that might otherwise continue unchanged.
AD CS is one example, but the underlying principle applies more broadly. Legacy infrastructure often remains in place because it works, even when the environment around it has changed significantly. Over time, that can create dependencies that are difficult to see and increasingly difficult to change.
An End-of-Support deadline creates a reason to examine those dependencies.
For AD CS, that means examining the current certificate infrastructure alongside the organization’s broader identity, application, and infrastructure architecture. The goal is not necessarily to replace every component. It is to understand how the pieces work together and determine whether the existing architecture still supports the organization’s requirements.
For organizations across Singapore and Malaysia, this is especially relevant as hybrid infrastructure becomes an increasingly important operating model. The challenge is no longer simply deciding between on-premises and cloud. Organizations need to determine which workloads belong where, how those workloads interact, and how IT teams can manage the resulting environment effectively.
With January 2027 approaching, organizations still have time to plan, but the effort required will vary considerably depending on the environment’s complexity.
The priority should be visibility into the Windows Server 2016 estate and the workloads that have dependencies beyond the individual server. AD CS deserves particular attention because its certificates and trust relationships can span applications, devices, and infrastructure.
Once those dependencies are understood, organizations can make more informed decisions about the target environment. Some workloads may require a straightforward upgrade. Others may benefit from a broader migration or modernization program.
Where immediate migration is not possible, Microsoft’s Extended Security Updates can provide eligible Windows Server 2016 workloads with Critical and Important security updates for up to three years. This can provide additional time to complete a carefully planned transition, but it should be treated as a bridge rather than a replacement for a longer-term modernization strategy.
For infrastructure teams, the greater opportunity is to use the deadline to move beyond server-by-server refreshes and consider the environment as a connected whole. That approach can help organizations modernize legacy workloads while maintaining the continuity, security, and operational control that their business requires.
Anunta helps organizations assess, plan, and execute infrastructure transformation across hybrid and cloud environments, supporting migration, modernization, validation, and ongoing operations. For organizations preparing for Windows Server 2016 End of Support, AD CS can be a useful starting point for a broader conversation about the future of their infrastructure.
Microsoft’s Extended Support for Windows Server 2016 ends on January 12, 2027. After this date, the operating system will no longer receive regular security updates and fixes under standard support.
AD CS can support authentication, encryption, secure communications, and trust across multiple applications, devices, and infrastructure components. Consequently, migrating the underlying Windows Server can have implications beyond the server itself.
No. A migration needs to account for the CA database, private key, and configuration, as well as the applications, devices, and services that depend on CA-issued certificates. The target environment should also align with the organization’s broader infrastructure strategy.
Not necessarily. The appropriate target depends on the organization’s business requirements, technical dependencies, and infrastructure strategy. In a hybrid environment, some services may remain on premises while other workloads move to cloud platforms.
Extended Security Updates can provide eligible Windows Server 2016 workloads with Critical and Important security updates for up to three years. They can give organizations additional time where migration cannot happen immediately, but they are a transition measure rather than a long-term replacement for infrastructure modernization.
