Exchange Server 2016 and 2019 reached end of support on 14 October 2025. The servers still start every morning, which makes the move easy to postpone, but the last safety net, paid Extended Security Updates (ESU), ends with October 2026. In this post I'll explain what running them now really means, compare your options in one table, and give you an order of work to get every server off them.
Status (October 2026): Exchange 2016 and 2019 have been out of support since 14 October 2025. The Period 2 ESU programme, announced in April 2026 for customers who needed more time, ends with October 2026, and the Exchange team has said there will be no further extension: after that there are no updates at all, even for ESU customers. Re-check the Exchange Team Blog, because guidance can change.
What end of support means in practice#
- No more fixes. There have been no bug fixes since October 2025, security fixes have gone only to paid ESU customers, and after October 2026 there are none for anyone. Because SE RTM is essentially Exchange 2019 CU15 under a new name, many vulnerabilities fixed in SE are likely to exist in 2019 (and often 2016) too, and those servers won't get the fix.
- No Microsoft support. End of support also means no technical assistance from Microsoft for these versions, which hurts most during an incident.
- Mail flow to Exchange Online. Exchange Online throttles and eventually blocks email arriving over the OnPremises connector from Exchange servers below a minimum build. In September 2026 the Exchange team published how this applies to 2016 and 2019, so hybrid organisations should read it.
- Upgrade blockers. Setup for Exchange Server SE CU2 will refuse to install while versions that are unsupported at its release remain in the organisation. Every forgotten 2016 or 2019 server will block that upgrade.
- Hybrid is changing. EWS is being retired in Exchange Online, which affects hybrid rich coexistence. My EWS retirement article covers the cloud side.
Your options at a glance#
| Where you are | Recommended path | What it involves |
|---|---|---|
| Exchange 2019 CU14 or CU15, staying on-premises | In-place upgrade to SE | Run SE Setup over the existing installation, like a CU. Same servers, no mailbox moves. |
| Exchange 2019 CU13 or older | Update to CU15, then in-place upgrade | Two Setup runs per server, or a legacy upgrade if the hardware is due anyway. |
| Exchange 2016 | Legacy upgrade to SE | New SE servers, move namespaces and mailboxes, then uninstall 2016. No in-place path exists. |
| Moving mailboxes to the cloud | Exchange hybrid to Exchange Online | Run the Hybrid Configuration Wizard from an SE server and migrate in batches. |
| All mailboxes already in Exchange Online | SE for remaining hybrid needs, or the SE management tools only | With directory synchronisation, recipients are still managed on-premises, so plan that before removing the last server. |
| Nothing can move before ESU ends | Reduce exposure while you migrate | A stopgap, not a fix: no internet-published OWA or ECP, restricted admin access, close monitoring. |
Whichever path you pick, SE needs an active licensing entitlement. My Exchange Server SE explainer covers licensing and planning.
Step-by-step: getting off Exchange 2016 and 2019#
1. Inventory servers and dependencies#
Get-ExchangeServer | Sort-Object AdminDisplayVersion |
Format-Table Name, ServerRole, AdminDisplayVersion -AutoSize
Get-Mailbox -ResultSize Unlimited | Group-Object Database | Format-Table Name, Count
Get-ReceiveConnector | Format-Table Identity, RemoteIPRanges -AutoSizeVersion 15.1 is Exchange 2016; Version 15.2 with a build below 2562 is Exchange 2019. Custom receive connectors with specific IP ranges usually mean printers, scanners or applications relaying through Exchange, and each one needs a new home before its server goes.
2. Upgrade Exchange 2019 in place#
Servers on CU14 or CU15 can go straight to SE. My in-place upgrade walkthrough covers AD preparation, DAG maintenance mode and post-upgrade checks.
3. Replace Exchange 2016 with a legacy upgrade#
- Install SE on new servers, preferably Windows Server 2022 or 2025.
- Match certificates, virtual directory URLs and connector settings to your current configuration.
- Point client namespaces (DNS and load balancer) at the SE servers.
- Move system mailboxes first, then users, and include audit log and public folder mailboxes (
-AuditLog,-PublicFolder):
Get-Mailbox -Database DB2016 -Arbitration | New-MoveRequest -TargetDatabase DBSE01
Get-Mailbox -Database DB2016 -ResultSize Unlimited |
New-MoveRequest -TargetDatabase DBSE01 -BatchName "2016-to-SE"
Get-MoveRequest -BatchName "2016-to-SE" | Get-MoveRequestStatistics4. Or move mailboxes to Exchange Online#
Use an SE server for hybrid, not a 2016 or 2019 one. Migration batches, statuses and common errors are covered in my hybrid migration batch guide, and my hybrid free/busy article covers coexistence during the project.
5. Decommission properly#
Move send connector source servers and relay connectors to SE, then uninstall Exchange from each old server with Setup in uninstall mode (/Mode:Uninstall). Don't just power servers off: a server that is switched off still exists in Active Directory, and Setup and Exchange still see it.
Verify you're done#
Get-ExchangeServer | Format-Table Name, ServerRole, AdminDisplayVersion -AutoSize
Get-SendConnector | Format-List Name, SourceTransportServers
Get-Queue | Where-Object MessageCount -gt 0Good looks like:
- Every server reports
Version 15.2 (Build 2562.x)or a later SE build, with no15.1entries and no 2019 builds left. - Send connectors list only SE servers, and relay devices have been repointed and tested.
- No queues build up towards Exchange Online or the internet.
- The Health Checker is clean on every SE server, which is also running the latest security update.
Tips and gotchas#
- ESU buys time, not safety. It was always security-only and temporary, and after October 2026 it delivers nothing.
- Hybrid-only servers count too. A server that "only does hybrid" or SMTP relay is still an Exchange server on an unsupported version.
- Find hidden consumers early. Turn on protocol logging on relay connectors and review IIS logs for EWS and other protocol use, so no application breaks when its server is removed.
- Don't plan around CU1. In August 2026 the Exchange team said SE CU1 has no release date yet. SE RTM with the latest security update is a supported target today.
- If you must wait, stop publishing OWA and the Exchange admin center to the internet, limit admin access and watch the servers closely. These measures reduce exposure; they don't make the servers supported.
