End of Support 2026: Windows, Office, SQL Server and Runtime Dates
End of support 2026 dates for Exchange Online EWS, Office 2021, Windows Server, SQL Server and runtimes, with what breaks first and how to find what you run.
Luka Abramovic24 min read
Cloud switch-offs, not patch deadlines, are the end-of-support dates in 2026 that break something on the day. From October 1, 2026, Exchange Online switches off Exchange Web Services (EWS) tenant by tenant, in every tenant where the EwsEnabled setting is still blank, which is the default. Every app that uses EWS stops at once. A few days before, Microsoft fills in the tenant's app allowlist from the previous 60 days of EWS use, so turning EWS back on restores only what ran recently. The quarterly or year-end job is the one that stays broken (Exchange Team). Twelve days later, on October 13, Office 2021, Office LTSC 2021 and the last year of Windows Server 2012 Extended Security Updates all reach their final patch.
This is a dated list of end-of-support, end-of-sale and retirement dates from 2025 to March 2028 for software established businesses run: Microsoft 365 services, Windows and Office, servers and databases, and the runtimes custom applications sit on. Each row says what actually stops, what breaks first and the first step. Checked in September 2026 against the vendor sources linked in each row. Products whose dates we couldn't confirm from a vendor source are left out rather than guessed, and the vendor email at the end gets those dates in writing.
Five kinds of end date, and which ones break on the day
"End of support" covers five different events. They fail in different ways, so sort every row in your register into one of them before deciding what to do first.
| Kind | What stops | Examples below | Breaks on the day? |
|---|---|---|---|
| End of sale | New licenses, new users or new instances. What you have keeps running. | Creating new HubSpot legacy private apps; getting SharePoint Add-ins from the SharePoint Store for on-premises farms | No. It breaks the next hire or the next integration. |
| End of security updates | Patches. The software keeps working, often for years. | Windows 10, Office 2016 and 2019, Exchange Server 2016 and 2019, SQL Server 2016 | No. Certification checks and security reviews fail first, then the next unpatched flaw. |
| Service retirement | A vendor switches off a cloud feature. There is usually no extension. | EWS in Exchange Online, SharePoint Add-ins and Azure ACS, SharePoint 2013 workflows | Yes, and whatever depended on it stops with it. |
| Default change | A setting flips. An admin can flip it back until a final removal date. | Basic authentication for SMTP AUTH in Exchange Online; EwsEnabled during the EWS rollout | Yes, for anything nobody listed, such as a scanner that emails PDFs. |
| Paid extension | Free support. Paying buys security fixes for a fixed period. | Extended Security Updates (ESU), Amazon RDS Extended Support, Ubuntu Pro | The bill changes first, and on Amazon RDS it changes by default. |
The last row surprises people. Amazon RDS enrolls MySQL and PostgreSQL databases in paid Extended Support by default, so the day a version leaves RDS standard support, the bill changes without anyone deciding it. Opting out doesn't keep the old version running for free: with the opt-out setting, RDS refuses to create a database on a version past standard support and upgrades a restored one to a newer major version automatically (AWS API reference). For a hosted database, "we'll deal with it later" is a decision to pay, made by a default.
Already ended, and probably still running
These dates have passed, but nothing forced a change on the day, so the software keeps running. Microsoft's dates for Windows Server and SQL Server also appear, with a server inventory script, in our guide to legacy system examples.
On desks: Windows and Office
| Product | Date | What stops | What breaks first | First step |
|---|---|---|---|---|
| Windows 10 (Microsoft) | October 14, 2025 | Free security updates. Version 22H2 was the last one Microsoft supported, and paid Extended Security Updates (ESU) are sold for 22H2 only (Microsoft). | Certification checks: Australia's Essential Eight requires unsupported operating systems to be replaced, even at its lowest level (see compliance). A PC below 22H2 is outside ESU whatever you pay. | List every PC with its version (script below). Upgrade or replace anything below 22H2 first. LTSB and LTSC editions, common on PCs that run equipment, have their own dates on Microsoft's Windows 10 release information page. |
| Office 2016 and Office 2019, including Access (Microsoft) | October 14, 2025 | Security updates, fixes and technical support. The apps still open. | Australia's Essential Eight lists unsupported office suites for removal at its lowest maturity level (see compliance). | If an Access database runs a process, find its rules before you replace Office. Our legacy system examples list the six places they hide. |
Windows 11 has no single end date. Each annual version has its own, and Home and Pro get 24 months of updates, less than Enterprise and Education. Microsoft lists versions 21H2 and 22H2 as unsupported (Microsoft), and 23H2 Home and Pro stopped getting updates on November 11, 2025 (Microsoft). On the same cycle, Home and Pro on 24H2, released in October 2024, reach their end in October 2026. Compare each PC's version and edition from the script below with Microsoft's Windows 11 release information, which gives the end date for each. Updates paused by a policy nobody remembers setting keep a PC on its old version.
On servers and in cloud accounts: databases, operating systems and runtimes
| Product | Date | What stops | What breaks first | First step |
|---|---|---|---|---|
| Exchange Server 2016 and 2019 (Exchange Team) | October 14, 2025 | Security updates for everyone outside Microsoft's paid Extended Security Update program. Its second period runs to the end of October 2026, for 2016 CU23 and 2019 CU14 and CU15 only. | Microsoft's own Exchange Health Checker reports these servers as an error: "Your Exchange server reached end of life" (CSS-Exchange). The server usually faces the internet for mail and Outlook on the web, so a flaw found after its last update stays open. | Run Get-ExchangeServer. Version 15.1 is Exchange 2016. Version 15.2 is 2019 below build 2562, and Exchange Server Subscription Edition (SE) from 15.2.2562.17. |
| SQL Server 2016 (Microsoft) | July 14, 2026. Paid ESU runs to July 17, 2029. | Security updates, unless you buy ESU. ESU isn't sold for the Express, Web or Developer editions. | Line-of-business applications that installed SQL Server Express without anyone noticing. Those instances can't be covered at any price. | Run the SQL query below. On 2016 SP3, a build below 13.0.6500.1 (13.0.7095.1 with the Azure Connect pack) is missing the last public security update, from July 14, 2026 (Microsoft). |
| VMware vSphere 7 (VMware) | October 2, 2025 (end of general support) | General support and routine patches for the hypervisor. Broadcom tells customers past End of General Support to upgrade, and points them to its extended support process for patches. | Every virtual server on those hosts now runs on an unsupported layer, whatever its own support status. | Check the ESXi and vCenter versions in the vSphere Client and add each host to the register. |
| Ubuntu 20.04 LTS (Canonical) | Standard support ended May 2025 | Free security updates. Paid Ubuntu Pro continues to April 2030. | Canonical's free five years only ever covered the "Main" repository. Ubuntu Pro is what adds security coverage for "Universe", so packages from Universe may already have been going without fixes. | Decide per server: upgrade to 24.04, or attach Ubuntu Pro and record the new end date. |
| MySQL 8.0 on Amazon RDS (AWS) | RDS standard support ended July 31, 2026 | Free support on RDS. Instances enrolled by default now pay for Extended Support, which runs to July 31, 2029. | The monthly AWS bill. | Upgrade to MySQL 8.4, which has RDS standard support to July 31, 2029. |
| PostgreSQL 13 (PostgreSQL, AWS calendar) | Community end of life November 13, 2025. RDS standard support ended February 28, 2026. | Community fixes. On RDS, enrolled instances pay for Extended Support, which runs to February 28, 2029. | The bill, as for MySQL. | Skip a version. PostgreSQL 14 ends in November 2026 (part two), so upgrading to 14 buys a few months. |
| Node.js 18 and 20 (Node.js) | April 30, 2025 and April 30, 2026 | Security releases. | Libraries raise their minimum Node.js version, so the next security fix in a package you depend on may not install on the old runtime. | Run node --version on every server and build pipeline. Node.js 22 ends April 30, 2027, and 24 on April 30, 2028. |
| Python 3.9 (PEP 596) | October 31, 2025 | Security fixes. 3.9.25 was the last release. | The same library mechanism as Node.js. | Python 3.10 also ends in October 2026, so move to 3.12 or later. |
| PHP 8.1 (php.net) | December 31, 2025 | Security fixes. | Plugins and libraries that raise their minimum PHP version, as with Node.js. | Since 8.1, PHP branches get four years of security support, extended to December 31 of the final year. 8.2 ends December 31, 2026, and 8.3 a year later. |
In Microsoft 365
These are service retirements, so the feature has stopped working, not just stopped receiving patches. If something here still appears in your processes, it has broken already or never ran on the platform you think it does.
| Product | Date | What stops | What breaks first | First step |
|---|---|---|---|---|
| SharePoint Add-ins and Azure ACS in SharePoint Online (Microsoft) | April 2, 2026 | Add-ins stop working in every tenant and can't be installed. ACS can no longer authorize calls into SharePoint, and remote event receivers registered through ACS stop. | Scripts and integrations that log in with a client ID and secret created at appregnew.aspx. Receivers registered with a Microsoft Entra app keep working until July 1, 2027. | The Microsoft 365 Assessment tool, version 1.10.0 or later, finds these app principals. |
| SharePoint 2013 workflows in SharePoint Online (Microsoft) | April 2, 2026 | Removed from existing tenants. | Approval and notification workflows on lists and libraries. | Rebuild in Power Automate. Record who relied on the notifications, because nobody gets an error when an email stops arriving. |
The next 18 months: October 2026 to March 2028
In date order. October 2026 is the busiest month. The rows most likely to stop a business process are the Exchange Online changes (EWS and SMTP AUTH), because they break integrations and devices rather than desktops.
October to December 2026
| Product | Date | What stops | What breaks first | First step |
|---|---|---|---|---|
| Exchange Web Services in Exchange Online (Exchange Team, Set-OrganizationConfig) | Rollout starts October 1, 2026 | In tenants where EwsEnabled is still blank, Microsoft sets it to False, which blocks EWS for every app. With EwsEnabled set to True, only apps on the EwsAllowedAppIDs list can use EWS. Exchange Server on-premises is not affected. | Every EWS integration in a tenant nobody configured. After an admin sets EwsEnabled to True, any app missing from Microsoft's pre-filled list. The list is built from 60 days of use, so a job that runs quarterly or at year end can be left off. | Check both settings (commands below). If EwsEnabled is blank, write the list and set it to True now. If it is already False, review the list Microsoft filled in, add the rare jobs, then set it to True. Then move each app to Microsoft Graph before April 2027. |
| Office 2021 and Office LTSC 2021 (Microsoft) | October 13, 2026 | Security updates, fixes and technical support. | The same certification checks as Office 2016 and 2019. Unlike Microsoft 365 Apps, a one-time-purchase version never moves itself to a newer version, so it stays until someone replaces it. | Find the PCs with the script below (the entries have 2021 in their names). The replacements are Microsoft 365 Apps or a newer one-time-purchase version, Office 2024 or Office LTSC 2024. |
| Windows Server 2012 and 2012 R2 ESU (Microsoft) | October 13, 2026 | The third and final year of ESU. There is no fourth year. | From that date, everything on those servers is permanently without security updates. | Windows Server 2025 upgrades a nonclustered server in place directly from 2012 R2, up to four versions at once. Test that on a copy of the server first. |
| HubSpot legacy private apps (HubSpot) | October 26, 2026 for existing accounts (September 28 for new ones) | Creating new legacy private apps. HubSpot said existing ones are not affected at the time of the announcement. | The next internal integration someone tries to set up the old way. | Build new integrations on the replacement. Details are in our CRM integration guide. |
| Exchange Server 2016 and 2019 ESU, period 2 (Exchange Team) | End of October 2026 | The last paid security updates for these versions. They cover only 2016 CU23 and 2019 CU14 and CU15. | Any server still running Exchange 2016 or 2019. | Move to Exchange Server SE or Exchange Online. |
| Python 3.10 (PEP 619) | October 2026 | Source-only security releases. | Data scripts and scheduled jobs that run on the server's built-in Python rather than a version the project pins. | Move to 3.12 or later, and pin the version in each project so the next server image doesn't change it silently. |
| .NET 8 and .NET 9 (Microsoft) | November 10, 2026 | Patches for both. .NET 9 was the short-term release, but it ends on the same day as .NET 8, the long-term one. | Custom web apps and APIs built in 2023 to 2025. | Run dotnet --list-runtimes. Move to .NET 10, supported to November 14, 2028. |
| PostgreSQL 14 (PostgreSQL, AWS calendar) | November 12, 2026. RDS standard support ends February 28, 2027. | Community fixes. On RDS, enrolled instances start paying for Extended Support when standard support ends. | The bill, from March 2027. | Upgrade to 16 or 17 rather than 15, which ends in November 2027. |
| PHP 8.2 (php.net) | December 31, 2026 | Security fixes. | Websites and portals on shared hosting. | Move to 8.4 (security support to December 31, 2028). |
| SMTP AUTH with basic authentication in Exchange Online (Exchange Team) | End of December 2026 | Disabled by default for existing tenants, and admins can turn it back on. Tenants created after that date get OAuth only. Microsoft has said it will announce a final removal date in the second half of 2027. | Microsoft's own list of what uses SMTP AUTH: devices that scan to email, workflow applications that send notifications, and POP and IMAP clients (Microsoft). | Find the mailboxes with SMTP AUTH switched on (commands below). Each one is usually a scanner or an application. Move each to OAuth, a relay or an API before the final date. |
January to June 2027
| Product | Date | What stops | What breaks first | First step |
|---|---|---|---|---|
| Windows Server 2016 (Microsoft) | January 12, 2027 | Security updates. ESU is available for up to three years, through 2030. | Hosted servers. ESU isn't available through the hosting-provider license (SPLA), so a server rented with its Windows license included can't be extended. | Ask your hosting provider or managed service provider how each server is licensed. The answer decides whether ESU is even possible (see extensions). |
| .NET Framework 4.6.2 (Microsoft) | January 12, 2027 | Support for the 4.6.2 runtime. 4.7 to 4.8.1 remain supported, and 3.5 SP1 runs to January 9, 2029. | Servers still on the version Windows Server 2016 shipped with. | .NET Framework 4.x updates in place, so installing 4.8 or 4.8.1 normally keeps apps built for 4.6.2 running. Test on a copy first. Check the registry value in the script below. |
| Exchange Web Services in Exchange Online (Microsoft, Exchange Team) | April 2027 | EWS, permanently. Microsoft has said there will be no exceptions. | Anything not yet moved to Graph, including allowlisted apps. | Ask each vendor on your allowlist for the version that uses Graph, and the date you can install it. |
| Node.js 22 (Node.js) | April 30, 2027 | Security releases. | As for Node.js 20. | Move to 24, supported to April 30, 2028. |
| Ubuntu 22.04 LTS (Canonical) | Standard support ends April 2027 | Free security updates. Ubuntu Pro runs to April 2032. | Universe packages, as for 20.04. | Plan the 24.04 upgrade, or budget for Pro. |
July 2027 to March 2028
| Product | Date | What stops | What breaks first | First step |
|---|---|---|---|---|
| SharePoint Online remote event receivers registered with an Entra app (Microsoft) | July 1, 2027 | The receivers stop working. | Custom code that reacts when an item is added or changed. | Microsoft's replacement is SharePoint webhooks or Microsoft Graph change notifications. Both are asynchronous, so code that canceled a change as it happened needs a different design. Our guide to connecting business systems covers building on webhooks. |
| SQL Server 2014 ESU (Microsoft) | July 8, 2027 | The last paid security updates. Extended support ended July 9, 2024. | Everything on the instance. | Check the major version (12 is SQL Server 2014) with the query below. |
| SQL Server 2017 (Microsoft) | October 12, 2027 | Security updates. | Vendor applications whose support matrix stops at 2017. | Ask the application vendor which SQL Server version it supports before upgrading the server. |
| PostgreSQL 15 (PostgreSQL, AWS calendar) | November 11, 2027. RDS standard support ends February 29, 2028. | Community fixes, then free support on RDS. | The same RDS bill as 13 and 14. | Upgrade to 17, which has RDS standard support to February 28, 2030. |
| PHP 8.3 (php.net) | December 31, 2027 | Security fixes. | As for 8.2. | Move to 8.4 or later. |
Just beyond this window: Node.js 24 ends on April 30, 2028, .NET 10 on November 14, 2028 and PHP 8.4 on December 31, 2028. Windows Server 2019 and .NET Framework 3.5 SP1 both end on January 9, 2029. SQL Server 2016 ESU ends on July 17, 2029, and MySQL 8.4 leaves RDS standard support on July 31, 2029.
Paying for more time: what each extension really buys
None of these extensions adds features. They buy security fixes for a fixed period. The catches are in who is allowed to buy and how the billing works.
| Extension | Runs to | How it's charged | The catch |
|---|---|---|---|
| Windows Server 2016 ESU (Microsoft) | Up to three years, through 2030 | Through Azure Arc, configurable since August 3, 2026 and billed monthly from January 13, 2027. Licenses created later are back-billed to January 12, 2027. | Needs Software Assurance or an equivalent Server Subscription for on-premises servers. Not available through SPLA, unlike Windows Server 2012 ESU. Moving over from volume licensing isn't supported. Standard and Datacenter only, and it needs Arc agent 1.62 or later. Deleting and recreating a license doesn't avoid back-billing. |
| Windows Server 2012 and 2012 R2 ESU (Microsoft) | October 13, 2026 | Free on Azure virtual machines, paid elsewhere. | Final. Nothing is available after this date. |
| SQL Server 2016 ESU (Microsoft) | July 17, 2029 | Pay-as-you-go through Azure Arc without Software Assurance, or with Software Assurance through volume licensing. Billing starts July 15, 2026, and subscribing later adds a one-time bill-back to the start of the ESU term. | Not sold for Express, Web or Developer editions. Unlike SQL Server 2014, moving to an Azure virtual machine doesn't make it free. If a virtual machine's ID changes after a rebuild, migration or clone, Arc treats it as a new machine: the old one keeps billing until someone deactivates it, and the new one is back-billed. |
| Amazon RDS Extended Support (AWS) | Up to three years past RDS end of standard support (MySQL 8.0: July 31, 2029; PostgreSQL 13: February 28, 2029) | Automatic. New and restored MySQL and PostgreSQL instances are enrolled unless created with the opt-out, and charges start when standard support ends. | The opt-out at create or restore is --engine-lifecycle-support open-source-rds-extended-support-disabled. RDS then refuses to create an instance on an expired version and upgrades a restored one. The setting can also be changed on an existing instance with modify-db-instance. |
| Ubuntu Pro (Canonical) | April 2030 for 20.04, April 2032 for 22.04 | Subscription. | Covers "Universe" packages as well as "Main", which free standard support never did. |
Windows 10 has its own paid ESU program for version 22H2, with terms on Microsoft's ESU page.
A worked example of the SQL Server 2016 ESU billing rules. The subscription and rebuild dates are illustrative, and the rules are Microsoft's (ESU FAQ):
ESU term starts (billing start) July 15, 2026
You subscribe November 1, 2026
First invoice November, plus a one-time bill-back
for July 15 to October 31 (3.5 months)
The VM is rebuilt and gets a new ID March 1, 2027
Old machine left subscribed keeps billing until someone deactivates it
Rebuilt machine subscribes new subscription, back-billed to July 15, 2026
Months paid twice July 15, 2026 to February 28, 2027 (7.5 months),
plus every month the old machine stays activePut your own dates in. Subscribing late doesn't lower the cost, because the bill-back reaches the start of the term. A rebuild does raise it, unless someone unsubscribes the old machine first. Microsoft's FAQ says to unsubscribe and disconnect the machine from Azure Arc before any change that could alter its ID, so add that step to the rebuild checklist for every server on ESU.
What frameworks and auditors say about unsupported software
This is a practical summary of each framework's wording, checked in September 2026, not compliance advice. The linked texts are the authority. If a customer, insurer or certification body names a different framework, check its wording directly. UK businesses working toward Cyber Essentials should read the current NCSC requirements document, which sets its own rule for unsupported software.
| Where it applies | Rule | What it says | What it means for this list |
|---|---|---|---|
| Australia: Essential Eight, Maturity Level One | ASD Information Security Manual, Essential Eight Maturity Level One baseline, September 2026 release (ASD) | ISM-1501: operating systems that are no longer supported by vendors are replaced. ISM-1704: office productivity suites, web browsers and their extensions, email clients, PDF applications and security products that are no longer supported are removed. ISM-1905: online services that are no longer supported are removed. | Level One is the lowest bar, so Office 2016 or 2019 on any machine fails it. |
| US: businesses handling Controlled Unclassified Information for federal contracts | NIST SP 800-171 Rev. 3, requirement 03.16.02, Unsupported System Components (NIST) | Replace system components when support is no longer available from the developer, vendor or manufacturer. Provide options for risk mitigation or alternative sources for continued support for components that can't be replaced. | ESU, or an isolated segment with documented mitigations, is the route for what can't be replaced yet. Check which revision your contract cites. |
| Anywhere cards are taken | PCI DSS v4.0.1, requirement 12.3.4 (PCI SSC) | Hardware and software technologies in use are reviewed at least once every 12 months. | The register in the last section, with a dated decision per row, is the record of that review. |
Find out which of these you run
Each block is read-only and says who runs it. None of them uses wmic, which Microsoft has deprecated: from Windows Server 2025 it is an optional feature, and Microsoft says it will be removed from Windows in a future release (Microsoft). If your own login scripts or scheduled tasks call wmic, rewrite those calls with PowerShell's Get-CimInstance now. The scripts also avoid the Win32_Product class. Microsoft warns that querying it starts a consistency check that verifies and repairs installed packages (Microsoft), so they read the registry's uninstall keys instead.
Windows PCs and servers (PowerShell, run as administrator or through your management tool)
# Read-only. Writes one CSV per machine to C:\Users\Public.
$out = "$env:PUBLIC\eos-inventory-$env:COMPUTERNAME.csv"
$os = Get-CimInstance Win32_OperatingSystem
$cv = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
$ver = if ($cv.DisplayVersion) { $cv.DisplayVersion } else { $cv.ReleaseId }
$rows = @([pscustomobject]@{ Type = 'Windows'; Name = $os.Caption; Version = "$ver (build $($os.BuildNumber))" })
# Click-to-Run Office: product IDs such as O365ProPlusRetail (Microsoft 365 Apps) or IDs with a year in them
$c2r = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration' -ErrorAction SilentlyContinue
if ($c2r) { $rows += [pscustomobject]@{ Type = 'Office (Click-to-Run)'; Name = $c2r.ProductReleaseIds; Version = '' } }
# .NET Framework 4.x release key: below 460798 = 4.6.2 or earlier; 528040 or more = 4.8 or later
$net = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full' -ErrorAction SilentlyContinue).Release
$rows += [pscustomobject]@{ Type = '.NET Framework release key'; Name = 'Release'; Version = $net }
# Installed software from the uninstall keys (64-bit and 32-bit), filtered to products worth checking
$watch = 'Office|Access|Visio|Project|SQL Server|Exchange|SharePoint|Dynamics|Sage|QuickBooks|Node\.js|Python|PHP|\.NET|Java'
$keys = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
$rows += Get-ItemProperty $keys -ErrorAction SilentlyContinue |
Where-Object { $_.DisplayName -match $watch } |
ForEach-Object { [pscustomobject]@{ Type = 'Installed'; Name = $_.DisplayName; Version = $_.DisplayVersion } }
$rows | Export-Csv $out -NoTypeInformation
$rows | Format-Table -AutoSizeWhat to look for: Windows 10 other than an LTSB or LTSC edition, Windows 11 on 21H2 or 22H2, Windows 11 Home or Pro on 23H2 or 24H2, any Office or Access entry with 2016, 2019 or 2021 in its name, a .NET Framework release value below 460798, and any SQL Server entry. Line-of-business software can install SQL Server Express as part of its own setup.
SQL Server (any account that can connect, in SQL Server Management Studio or sqlcmd)
SELECT SERVERPROPERTY('MachineName') AS server_name,
SERVERPROPERTY('ProductMajorVersion') AS major_version, -- 12 = 2014, 13 = 2016, 14 = 2017, 15 = 2019, 16 = 2022, 17 = 2025
SERVERPROPERTY('ProductVersion') AS build, -- compare with Microsoft's latest-updates list
SERVERPROPERTY('ProductLevel') AS service_pack,
SERVERPROPERTY('ProductUpdateLevel') AS cumulative_update,
SERVERPROPERTY('Edition') AS edition; -- Express, Web or Developer: no ESUSELECT @@VERSION returns the same information in one string, if that's all your tool allows. The property names are documented in Microsoft's SERVERPROPERTY reference.
Exchange Server and SharePoint Server (on a server in the organization or farm)
# Exchange Management Shell: 15.1.x = Exchange 2016; 15.2.x below 15.2.2562 = Exchange 2019; 15.2.2562 or later = Exchange SE
Get-ExchangeServer | Format-List Name, Edition, AdminDisplayVersion
# SharePoint Management Shell
(Get-SPFarm).BuildVersionExchange Online (Exchange Online PowerShell, as an Exchange administrator)
Connect-ExchangeOnline
# EWS: blank = still the default, switched to False during the rollout; False = blocked for every app;
# True = only the apps in EwsAllowedAppIDs (from the October 2026 enforcement, an empty list blocks every app)
Get-OrganizationConfig | Format-List EwsEnabled
Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EwsAllowedAppIDs
# SMTP AUTH: organization-wide setting, then the mailboxes explicitly switched on (usually scanners and apps)
Get-TransportConfig | Format-List SmtpClientAuthenticationDisabled
Get-CASMailbox -ResultSize Unlimited |
Where-Object { $_.SmtpClientAuthenticationDisabled -eq $false } |
Select-Object PrimarySmtpAddressThe allowlist only shows up with the -RetrieveEwsOperationAccessPolicy switch. A mailbox whose SMTP AUTH setting is blank follows the organization setting. The parameters are described on Microsoft's pages for Set-OrganizationConfig and Set-TransportConfig.
To switch EWS on for named apps only, an Exchange administrator runs the command below with the application IDs from Microsoft Entra. The value replaces the whole list, so include every app each time, including the ones that only run at quarter end:
Set-OrganizationConfig -EwsEnabled $true -EwsAllowedAppIDs "<app ID 1>,<app ID 2>"Linux servers, containers and build machines (shell)
grep -E '^(NAME|VERSION)=' /etc/os-release
node --version 2>/dev/null
python3 --version 2>/dev/null
php -v 2>/dev/null | head -1
dotnet --list-runtimes 2>/dev/null
# Databases: ask the server, not the client tools
# PostgreSQL: SHOW server_version;
# MySQL: SELECT VERSION();Run this inside each container image as well as on the host. The runtime in the image is the one that matters.
Amazon RDS (AWS CLI, with read access to RDS)
aws rds describe-db-instances \
--query "DBInstances[].[DBInstanceIdentifier,Engine,EngineVersion,EngineLifecycleSupport,MultiAZ]" \
--output tableEngineLifecycleSupport shows enrollment, not charges. Charges start only once the engine version passes RDS end of standard support. Repeat the command in each region you use.
The register, and the email for vendors without a lifecycle page
Put every result into one register. A row is finished when it has a date, a source and a decision with an owner. The first row below is an illustrative example.
| Product and version found | Where it runs | End date and kind | Source | What depends on it | Decision | Owner and date |
|---|---|---|---|---|---|---|
| SQL Server 2016 SP3 Express, build 13.0.6300.2 | OPS-SRV-02, installed by the scheduling application | July 14, 2026. End of security updates, and no ESU for Express. | Microsoft ESU FAQ | Scheduling application, nightly export to payroll | Ask the vendor for a supported SQL Server version, then upgrade or move to Standard | IT lead, by November 30 |
The decision column has five useful values: upgrade, replace, pay for an extension (with its end date), isolate (with what it's isolated from), or retire. "Monitor" isn't one of them.
Some vendors don't publish lifecycle dates in one place, and we couldn't confirm current dates for the desktop accounting suites from the vendors' own pages for this list. Ask for them in writing. A dated answer from the vendor is also the evidence an auditor or a customer's security review asks for:
Subject: End-of-support dates for [product, edition and version] that we run
Hello [vendor or reseller],
We run [product, edition, version and build] for [number] users at [number] sites.
For our software register and our [Cyber Essentials / customer security review / audit],
please confirm in writing:
1. The date this version stops receiving security updates, and the date it stops
receiving [tax / payroll / regulatory] updates, if that is different.
2. Whether paid extended support exists, what it covers and what it costs per year.
3. Which version we need to be on to stay supported until at least [date two years ahead],
and whether that upgrade is included in our current license or subscription.
4. Which operating system, database and runtime versions that version supports
(for example, which Windows Server and SQL Server versions).
5. The page where you publish these dates, so we can check them ourselves next time.
Thank you,
[name, role, company]Question 4 catches the dependency that decides the order of work. An application that doesn't support a newer SQL Server or Windows Server version holds everything under it on an old version. Put the answer in the "What depends on it" column.
If one of these dates falls on a system your business can't easily move, such as an Access database that runs a department, an integration built on EWS, or a line-of-business application that keeps its SQL Server on an old version, bring the register rows for it and the vendor's reply. We'd start with what depends on it and what the replacement has to keep doing. Our software improvement and rebuild work begins with that assessment.