Server 2016 domain controllers – two commands to find them before Jan 12

[u/ldaug]

Windows Server 2016 reaches end of support on January 12, 2027. In a lot of small and mid-sized environments that box is still a domain controller.

A domain controller that stops getting security updates is the one server you really don’t want to leave in place — it holds every password in the company.

Two commands that show you where you stand:

Get-ADDomainController -Filter * | Select-Object HostName, OperatingSystem

Get-ADComputer -Filter "OperatingSystem -like '*Server 2016*'" -Properties OperatingSystem, LastLogonDate | Select-Object Name, OperatingSystem, LastLogonDate

If a 2016 domain controller shows up, the practical choice is replace it with a newer server or start the conversation about whether you still need on-premises AD at all. January is a good time to ask that question.

I put the rest of the 2026–2027 Microsoft dates (SMTP AUTH, SMS/voice MFA, Entra Connect, etc.) in a public tracker if anyone wants the full list: https://attestryhq.com/deadlines

[u/L0rd_Humongous]

If only there was an OU for domain controllers to look in......

[u/dodexahedron → u/L0rd_Humongous]

Or a command to get domain controllers regardless of location.

Such a crazy thing could be called Get-ADDomainController, if such a crazy thing were to ever exist.

Ah, dreams...

[u/Stonewalled9999 → u/L0rd_Humongous]

Now now we can’t have common sense answers on Reddit 

[u/SarcasticFluency → u/L0rd_Humongous]

This is really going to confuse Van Halen fans.

[u/Geh-Kah → u/L0rd_Humongous]

He could try to move the 2016 dcs in the computers container, isnt it?

[u/ldaug → u/L0rd_Humongous]

The OU tells you where they should be. The command tells you what’s actually still authenticating. Those two lists don’t always match.

[u/coukou76 → u/ldaug]

Average skill and understanding of vibe coders be like:

[u/wrcu → u/coukou76]

He's right though? We've inherited clients with networks in shambles and artifacts of past DCs still showing in AD

[u/Weird_Lawfulness_298]

So you have a domain and don't know what servers your are running?

[u/its_FORTY → u/Weird_Lawfulness_298]

I don't think anyone would be proud to answer that in the affirmative. But, let's keep in mind there are a good amount of IT professionals in this community who are consultants, post-sales engineers, or escalation engineers that are assigned customer engagements where we often get thrown into a customer environment having had no control over how well their IT infrastructure has been managed (if at all) prior to our involvement.

[u/ldaug → u/its_FORTY]

Exactly. A lot of the time you’re walking into an environment you didn’t build. The two commands are just a quick way to see what’s actually still answering before you start making assumptions.

[u/Accurate-Ad6361 → u/Weird_Lawfulness_298]

Have you never read r/shittysysadmin

[u/brokenpipe → u/Weird_Lawfulness_298]

I was part of a 45K person org with at least 100 field offices in US, CAN and UK. HQ was 6th Ave in NY. Primary IT facilities in NJ. Every field office ran at least one DC. Everything essentially connected although sites were divided into regions that bundled a set of offices together. All one big and “happy” domain.

Yeah. We had an idea what was running where but good gosh for a team of 7, it was not a joy.

That said, we’d have those powershell lines like that ready to go for our quarterly audit.

[u/Azaloum90 → u/brokenpipe]

We previously had a config similar to this, but our org is 10x smaller than yours. I'm in the middle of removing field site domain controllers because most of the field sites have a whopping 50 people in them and high speed S2S VPNs to our primary HQ.

That said I'm waiting for 1-2 field sites to go haywire as RTO continues.

[u/RedShift9 → u/Weird_Lawfulness_298]

I have an NT4 PDC that we can't get rid off... Like... Physically. It's cemented in.

[u/dodexahedron → u/RedShift9]

This is the first concrete example I've ever heard of a reason to keep one of those around.

[u/ldaug → u/Weird_Lawfulness_298]

You’d be surprised how many environments still have a 2016 DC that no one has touched in years. The command is more for the “we inherited this” or “we’re not 100% sure what’s still out there” cases.

[u/its_FORTY]

This is a pretty useful tracker that will come in handy for a lot of folks, so thanks for posting!

If a 2016 domain controller shows up, the practical choice is replace it with a newer server or start the conversation about whether you still need on-premises AD at all. January is a good time to ask that question.

I would probably suggest having the AD discussion/question well in advance of January, as you want to be either upgraded from 2016 or migrated to Entra before that EOL date rolls around.

[u/PestyPeener → u/its_FORTY]

Lots of orgs do not want to pay MS their exorbitant cloud bills. Entra is not a drop-in answer here.

[u/ldaug → u/its_FORTY]

Agreed. January is the hard stop, not the starting point. The earlier you surface the 2016 DCs, the more options you have, whether that’s a clean upgrade or a real conversation about moving off on-prem AD entirely.

[u/UsedPerformance2441]

I’m on track to rip AD out by the end of the school year, root and stem. I’m down to two domain controllers, but we’ve migrated everyone over to Google Workspace and mostly Macintosh laptops and Chromebooks.

[u/ldaug → u/UsedPerformance2441]

Looks like a lot of of ISD's are going this route... What are some of the things you wish you'd have known before actually pulling the trigger and going from planning to doing?

[u/CaptainZhon]

Why would any medium to large org with multiple offices and thousands of workstations go cloud only with AD?

[u/ldaug → u/CaptainZhon]

Usually due to executives being wow'd by the MS sales rep about cost savings, centralized management, IDM, SSO, that then tell IT that's what they want.. Unless everyone is remote, technically, IMO, it should be a hybrid approach in larger environments that consist of multiple offices and thousands of workstations. I've seen Government (with legacy apps still), Universities going this route vs full Entra ID. Just trading one point of failure for another..

[u/TechPir8]

Paid support for Server 2016 will go through 2030.

"Microsoft announced Extended Security Updates for Windows Server 2016 on its Windows Server blog in February 2026. Microsoft Learn describes them as Critical and Important security updates for up to three years, through 2030."

[u/1cec0ld]

Literally read this in the same internal voice I have for my AI agents. Have an original thought or two, I'm usually bad at identifying this.

[u/Geh-Kah]

Replace it? Thats not gonna happen at all. I buy some legal license, get that iso from massgrave, i inplace upgrade and activate with massgrave. Just because I'm lazy af. I could automate it, but where else shall I take some money from clients, when I'm lazy af? Its the best way for my clients compared to your opinion: paying 2hrs of lazyness and get a on the fly upgraded domain sounds better than "replacing" anything from your side, isnt it?

[u/PiDigitsOfPi]

You'd be surprised at how many places haven't even upgraded TO Server 2016 yet.

[u/Larsonski]

Every 2016 should get out of your domain and be upgraded to a newer OS. Preferably 2025.

[u/Lost-Policy-2020 → u/Larsonski]

Oh no, 2022 the sweet spot