Infrastructure Oct 2026

According to BleepingComputer, Microsoft has announced that Windows Server 2016 will reach end of support in January 2027 and will stop receiving security updates after that. Any vulnerability discovered after that date will stay unpatched on these servers. The servers won't stop working overnight, but each passing month makes them an easier target for attackers.

For the Iranian market this is more than a routine announcement. In many companies here, file servers, domain controllers and accounting or financial software servers have run on one fixed version for years, and nobody touches them until something breaks. These machines usually hold the organization's most sensitive data, so leaving them unpatched is a real business risk, not just a technical one.

The first step is an inventory. List every physical and virtual server with its Windows version, its role, its business owner, how critical it is, and whether it can be reached from the internet or from branch offices. A few forgotten machines usually turn up, such as a server spun up for an old project that is still running. This table is the basis for every later decision and for prioritizing by risk.

The second step is assessing software dependencies, and in practice this is where most of the time goes. For each application, especially financial, warehouse and locally customized systems, ask the vendor or support provider whether it is certified on Windows Server 2022 or 2025. Also check the database version, the .NET version, hardware dongle drivers and any special printers. If a vendor no longer supports the product, you need to know now, because upgrading the application itself may turn out to be the longest part of the project.

Then comes choosing a path. Upgrading to a newer Windows Server release is the simplest route, but for sensitive roles such as domain controllers, a clean install and role migration is usually safer than an in-place upgrade. Virtualizing old servers onto new infrastructure frees up hardware and simplifies management and backup, but it does not solve the operating system's end-of-support problem by itself. Moving to the cloud, domestic or foreign, makes sense when you need the flexibility and when access and payment are actually workable for you. For software that cannot move yet, the stopgap is network isolation, restricted internet access, offline backups and closer monitoring, not carrying on as before.

Sanctions have to be part of the plan from the start. Iranian organizations have limited official access to Microsoft licensing, support and some cloud services, so you cannot count on every option available in the global market. If the licenses on your current servers are not valid or documentable, or if you obtain updates through unofficial channels, clarify that before making any technical decision. Options such as a domestic cloud, or moving certain roles (a file server, for example) to other platforms, should be judged against the same constraints of access and reliability.

Budgeting is not just the license price. It should also cover hardware or cloud capacity, migration labor, application testing, upgrading the financial software, acceptable downtime and team training. Set aside a reserve for surprises and work in phases: first the high-risk, externally reachable servers, then the domain and file servers, and finally the systems tied to legacy software. A phased approach also spreads the cash outlay and reduces the risk of one large cutover.

If you don't yet have an accurate list of your servers, start there; it costs little and clarifies the rest of the plan. Then, with your IT team or managed services partner, write a roadmap with firm dates, and settle software dependencies before anything else. The earlier you begin, the more time you have to test and choose the right option, and the less likely you are to make rushed decisions in the final months.

Start a project