Major Microsoft Client and Server Systems Reach End of Life
What will it mean for your business?
Many Microsoft products will reach their end of life on October 14, 2025. While this may seem like long way off from now, it is very important to start to plan on replacing these products and understanding what the consequences are of keeping them around. Support for all versions of Windows 10 will end on this date. Also, all Microsoft Office 2016 and 2019 components will end on this date. This includes all Office suite (Word, Excel, etc) as well as Project and Visio. Even more impactful for some organizations is that this date marks the end of support for Microsoft Exchange Server 2016 and 2019.
As product support ends for these products, businesses need to take steps to mitigate risks. Organizations using these versions must either upgrade to the Exchange Server Subscription Edition or migrate to the cloud (e.g., Microsoft 365).
Cybersecurity Insurance Implications
Once these versions reach end of support, Microsoft will no longer provide the critical support that businesses often take for granted. If something goes wrong, there will not be anyone at Microsoft to help troubleshoot issues. Routine bug fixes will stop and so will security patches, meaning that any problems affecting server stability or usability will remain unresolved. The most concerningly issue is that security patches will cease, making this system an easy target for cybercriminals who actively look for vulnerabilities in outdated software. Even time zone updates will no longer be provided, which may sound minor but can cause scheduling issues in organizations that operate across different regions.
Because Microsoft will not be supporting these expired products using outdated Windows, Office or Exchange versions after October 14, 2025 could void or severely limit your cybersecurity insurance policy. The insurance company may not cover incidents caused by vulnerabilities that were known and unpatched. It is a common practice for cyber insurance policies to require businesses to use current, vendor-supported operating systems with regular security patches applied.
Increased Risk:
Without security updates and bug fixes, your Windows operating systems, Office products, and Exchange servers become prime targets for cybercriminals, increasing the likelihood of breaches, ransomware attacks, and email-based threats.
Compliance Issues:
Many regulations (like GDPR and HIPAA) require businesses to use up-to-date, secure software. When and if an incident occurs, the presence of outdated Windows, Office and Exchange versions could lead to fines and legal consequences.
GRPR (General Data Protection Regulation): This does apply to US companies if the a US company offers goods or services to, or monitors the behavior of, individuals in the European Union, it must comply with GDPR, regardless of the company's location.
HIPPA (Health Insurance Portability and Accountability Act: A US law that outlines specific requirements for protecting the privacy and security of health information within the United States.
Of course if a company is required to follow PCI DSS or a NIST/ISO standard, these have their own requirements for updating systems as well.
Mitigation Strategies for Exchange
Option 1, stay on premise: Microsoft has announced Exchange Server Subscription Edition (Exchange Server SE), a new subscription-based version of Exchange for organizations that require an on-premises email solution. This option is best for businesses that need to maintain compliance-driven, on-prem infrastructure or prefer a hybrid model that integrates with Microsoft 365.
This version, like previous versions of Exchange, will requires periodic upgrades and updates. To remain in support, IT teams must stay on top of this maintenance. Licensing costs are different from previous versions since this version will utilize a subscription model. This means ongoing costs, and organizations will still need to manage and secure their own infrastructure. The path to upgrade from 2019 is fairly straight forward. There is no path to upgrade from Exchange 2016 so this migration will be much more complex and will require new hardware to be purchased before an in-place upgrade can happen.
Option 2: move to the cloud: Moving to the cloud can help you remain secure and compliant while benefiting from modern features and automatic updates. For businesses looking to move beyond on-premises infrastructure, Exchange Online (Microsoft 365) is a compelling option. This cloud-based solution eliminates server maintenance, enhances security and improves scalability, making it ideal for organizations embracing a cloud-first strategy.
There are some key advantages of choosing Exchange Online. There is no more server maintenance since Microsoft handles all updates, patches and infrastructure management. On premise version of Exchange SE are still supported in Hybrid mode if needed. Exchange Online has built-in security and compliance tool. There are automatic security updates, threat protection and compliance tools to meet regulatory requirements. Exchange Online offers scalability and accessibility allowing employees can securely access email from anywhere, with 99.9% uptime and flexible storage options that scale with business needs.
Mitigation Strategies for Windows 10
Microsoft is offering Windows 11 as a free upgrade to computers that are eligible. So, as a first step, it is recommended to determine if current devices meet the Windows 11 hardware requirements.
Microsoft has analysis tools to help you evaluate your devices against the Windows 11 hardware requirements. If you're running Windows 10 Home, Pro, or Pro for Workstations editions, the PC Health Check app can be used to determine Windows 11 eligibility.
Windows 11 has specific hardware requirements. These include minimum processor specifications, video card requirements, and a minimum version of 2.0 for a trusted platform module to be present. If the computer does not meet these requirements Windows 11 will not install and the computer must be replaced.
Migration Strategies for Office Products
Migrating from Office 2016 and 2019 to Microsoft 365 is the best approach. This is especially easy if moving from Exchange on premise to Exchange Online since most offerings include Office applications. Office 365 products are continually updated, office greater security, better team collaboration, and boost office productivity.
Windows 11 Feature Release End of Service
Even though Windows 11 is the current client operating system, it has feature releases that are released yearly and these have their own end of life.
Version 24H2 (2024 Update): This is the current major release, available since October 1, 2024. In general, it will reach end of service on October 13, 2026.
Version 23H2 (2023 Update): Released on October 31, 2023, this version reaches end of service on November 11, 2025.
Version 22H2 (2022 Update): Released on September 20, 2022, this version reached end of service on October 8, 2024.
Version 21H2 (Original Release): Released on October 4, 2021, this version reached end of service on October 10, 2023.
Commonly used Windows Servers Have Reached End of Life
It seems like some version of Windows Server live on forever. Unfortunately, this is a huge security risk. Servers should be updated or replaced as new Server operating systems are released by Microsoft.
Windows Server 2012/2012 R2 reached end of support on October 10, 2023.
Windows Server 2016 will reach end of support on January 12, 2027
Windows Server 2019 will reach end support on January 9, 2029.
Windows Server 2022 will reach end of support on October 14, 2031.
It is advised that any Windows Server operating system older than Server 2016 need to be updated or removed from the enterprise immediately. Server 2016 should have planned upgrades to move to a newer Server OS as soon as possible.
Conclusion
In essence, the end-of-life of these products presents a critical window for businesses to ensure their systems are secure and compliant. Failure to act could lead to significant risks, including financial losses and potential voiding of cybersecurity insurance coverage. It may be advantageous to work with a Managed Service Provider to help you get updated and stay compliant as the product lifecycles are changing and security requirements are becoming more commonplace.