Windows Server 2016 vs 2025:
differences and whether to upgrade

The clock is ticking for Server 2016

Windows Server 2016 launched in October 2016 and is based on the Windows 10 1607 kernel. Mainstream support ended back in January 2022, and extended support — with security fixes — ends on 13 January 2027. After that date the system stops receiving patches (outside paid ESU), which for most organisations means a real problem with compliance, cyber insurance and security audits.

This is the most common practical reason to modernise: not "because 2025 is newer", but "because 2016 stops being patched". If you still run WS2016 machines — often physical ones — it's the natural moment to virtualise them onto Proxmox VE and then upgrade to Windows Server 2025 using the official upgrade procedure — with a full rollback on Proxmox (a snapshot taken before the upgrade) in case something goes wrong 🙂.

Support dates at a glance

The key planning number is January 2027 — from then on WS2016 without paid ESU is an unpatched system. Plan the migration with headroom, not in the final quarter before support ends.

The biggest changes in Server 2025

• Hotpatching — most security fixes install without a reboot (typically ~4 restarts a year instead of monthly). On-premises it's a paid subscription activated through Azure Arc.
• SMB over QUIC in the Standard and Datacenter editions — encrypted SMB over port 443 without a VPN (previously Datacenter: Azure Edition only). Plus SMB signing on by default and an SMB firewall.
• Active Directory — the first new forest and domain functional level since 2016, a larger database page (32 KB), optional NTLM removal and stronger Kerberos cryptography.
• Security by default — Credential Guard, VBS, LSASS protection and hardware-enforced stack protection enabled from install.
• Storage and ReFS — ReFS deduplication and compression, thin provisioning, block cloning and markedly higher IOPS on NVMe.
• A modern core — Windows 11 24H2 base, built-in OpenSSH and WinGet, newer .NET and PowerShell, and the "Annual Channel" model.

What sets the two versions apart

When an upgrade makes sense — and when to wait

• Yes, modernise when: WS2016 is approaching end of support (2027); you need SMB over QUIC, the new AD level, hotpatching or stronger security; you're building a new environment from scratch; you have NIS2 / cyber-policy requirements.
• Consider 2022 instead of 2025 when: you don't want a hotpatching subscription, your applications are certified only up to 2022, and support until 2031 is more than enough.
• Wait and test when: critical applications aren't certified on 2025, or drivers and agents (backup, antivirus, monitoring) aren't supported yet — do a PoC on an isolated machine first.

In a Proxmox virtual environment we recommend an in-place upgrade — it keeps the configuration, roles and data and is faster than rebuilding the server from scratch. Your safety net is a VM snapshot taken right before the upgrade: if anything goes wrong, you roll back to the state from a few minutes ago in one click. Consider a clean install only for heavily cluttered, long-running systems where a fresh start is healthier.

Run Server 2025 cleanly on Proxmox VE

Windows Server 2025 runs on Proxmox VE like any modern Windows guest — provided the machine and paravirtio drivers are configured correctly. It's also the cleanest way out of a physical WS2016: a P2V migration and a supported OS straight away.

• A q35 + UEFI (OVMF) machine with an EFI disk; enable TPM 2.0 and Secure Boot — for VBS/Credential Guard and Windows 11 base compatibility.
• virtio drivers from the virtio-win ISO: disk (virtio SCSI), network (virtio-net), balloon and the QEMU Guest Agent.
• CPU type host or x86-64-v3 — see our article on CPU types — for full flags and fast AES/AVX.
• Migration from 2016/2019 — P2V via virt-v2v, then an in-place upgrade to 2025 inside the VM (with a snapshot taken first).

Windows Server licensing on a dense host

The most common question about Windows on Proxmox: if the VM only "takes" 2 vCPU, do I pay for 2 cores? No. Windows Server is licensed by the physical cores of the host, not by the VM's vCPU — and you must cover all cores of the server (a minimum of 16 per server and 8 per processor).

The topic is broad — Standard vs Datacenter vs per-VM, HA cluster licensing, license mobility and current Microsoft catalog prices — so we've expanded it into a separate article for decision-makers.