Most year-end software projects start with a purchase order. That is the wrong order. In late 2026 the first operational failure is almost always an incomplete inventory. Teams discover in January that Office 2021 machines are already past their final security update, that a Windows Server 2016 host is weeks from end of extended support, or that a pile of unused Microsoft 365 seats is still billing while critical servers run unsupported code. The friction that gets underestimated is not the cost of new licenses. It is the time and risk created by discovering those gaps after the budget cycle closes.

A proper year-end software refresh checklist forces the inventory and risk ranking first. Only then do you decide what to upgrade, what to retire, and what to buy. The steps below reflect the sequence that actually works in current 2026 deployments.

Start With a Complete Software and License Inventory

Open every source of truth you have: Microsoft 365 admin center, Azure AD device list, on-prem Active Directory, SCCM or Intune reports, volume licensing portal, and the physical or virtual server inventory. Export installed versions of Windows, Office, Windows Server, SQL Server, and any third-party productivity or security tools.

Cross-check against actual usage. Pull last-login or last-activity data for Microsoft 365 seats and note any perpetual licenses that still appear on machines. Many organizations still carry Office 2021 or older perpetual installs alongside Microsoft 365 Apps. After October 13, 2026 those 2021 editions no longer receive security updates.

Record the exact edition and servicing channel for every Windows and Windows Server instance. Windows 10 devices may still be on consumer or commercial Extended Security Updates. Windows Server 2016 reaches the end of extended support on January 12, 2027. Windows Server 2022 moved from mainstream to extended support in October 2026 and continues receiving security updates until 2031, but the support terms change.

Do not skip the CAL count. Remote Desktop Services CALs, Windows Server CALs, and SQL CALs are frequent sources of true-up findings. If you provide remote access, confirm the number of RDS CALs matches concurrent or device usage.

This inventory step routinely surfaces 15–30 percent unused or under-used licenses. Reclaim those seats before you buy anything new. The savings often fund the actual upgrades.

Rank Everything by Security and Support Risk

Create three buckets.

Immediate risk (no more security updates):

• Office 2021 and Office LTSC 2021 (ended October 13, 2026)
• Windows Server 2012 / 2012 R2 after the final ESU year
• Any Windows 10 device not enrolled in an active ESU program
• Unsupported antivirus or endpoint agents that no longer receive definition or engine updates

Near-term risk (weeks to a few months):

• Windows Server 2016 (extended support ends January 12, 2027)
• Older System Center 2016 components and related 2016-era management tools
• Line-of-business applications that only run on the above platforms

Manageable but still on the list:

• Windows 11 versions approaching their own servicing end dates
• Perpetual Office installs that still function but sit outside the supported configuration matrix with current Microsoft 365 services
• Legacy on-premises servers that can be migrated to Windows Server 2022 or 2025

Security updates stop. That is the only metric that matters for the first pass. Cyber-insurance questionnaires and customer security reviews increasingly ask for evidence that no production system is running past end-of-support software. Leaving those systems in place creates both operational and contractual exposure.

Test Compatibility Before You Touch Production

Upgrade one pilot group of users and one non-production server first. Common break points in 2026 migrations include:

• Older accounting, ERP, or manufacturing applications that still expect Office 2016/2019 object models or specific Windows Server roles
• Custom macros and COM add-ins that fail under Microsoft 365 Apps or 64-bit Office
• Printer and scanner drivers that were never updated for Windows 11
• Legacy authentication methods that no longer work once you enforce modern authentication and Conditional Access

Document every application that requires a shim, a virtualized desktop, or a vendor upgrade. Budget time for those fixes. The organizations that skip this step spend January and February fighting help-desk tickets instead of finishing the refresh.

For servers, stand up a parallel Windows Server 2022 or 2025 instance, migrate the roles and data, and validate before decommissioning the old host. In-place upgrades are possible in some cases but carry higher risk when the source is already near end of support.

Decide the Target Stack for Each Workload

Client productivity
Most businesses benefit from moving remaining perpetual Office users to Microsoft 365 Apps. The continuous update model removes the next EOL cliff. Where offline or air-gapped requirements exist, Office LTSC 2024 is the supported on-premises alternative with support into 2029.

Operating system
Windows 11 is the clear client target. Confirm hardware meets the requirements (TPM 2.0, supported CPU, sufficient RAM). Devices that cannot move stay on Windows 10 only if they are enrolled in commercial ESU and a firm replacement date is set. Consumer ESU now runs through October 2027, but commercial environments should treat ESU as a bridge, not a destination.

Servers
Windows Server 2025 is the current LTSC release with mainstream support into 2029 and extended support to 2034. Windows Server 2022 remains fully viable under extended support. Prefer the newer release for new deployments and for any server that will still be in production past 2030.

Security layer
Replace or renew endpoint protection that has reached its own end of support. Pair the OS upgrade with a current EDR or next-gen antivirus that reports into a central console. Unsupported antivirus is one of the quietest ways an environment becomes exposed.

Optimize Licenses and Close Compliance Gaps

Once the target stack is clear, map current entitlements to the new requirements.

• Convert unused Microsoft 365 seats into the editions you actually need or drop them at the next true-up window.
• Confirm Windows Server and RDS CAL counts cover the final user and device numbers after the migration.
• For volume licensing customers, check whether Software Assurance or subscription benefits already cover the upgrades.
• Source genuine licenses through authorized channels. Gray-market or transferred keys create activation and audit problems that surface months later.

DirectDeals maintains current stock of Windows 11 Pro, Windows Server 2022 and 2025, Microsoft 365 subscriptions, Office LTSC, and the associated CALs. Having the exact SKUs and quantities ready before the purchase order is raised shortens the procurement cycle and reduces the chance of ordering the wrong edition.

Execute in Controlled Waves

Roll the changes in this order:

1. Reclaim and reassign unused licenses.
2. Upgrade or replace the highest-risk unsupported systems (Office 2021 clients, Windows Server 2016 hosts).
3. Move pilot users to Windows 11 and Microsoft 365 Apps; collect feedback for two weeks.
4. Expand the client rollout by department or location.
5. Complete server migrations and decommission the old hardware or VMs.
6. Update documentation, backup jobs, and monitoring to reflect the new versions.
7. Run a final license reconciliation and archive the evidence for any future audit.

Keep a short rollback plan for each wave. Snapshot or image critical systems before the change window. Most failures are configuration or driver related and reverse cleanly when the previous state is still available.

Budget and Timeline Realities for Late 2026

Hardware refresh often travels with the software refresh. Devices that fail the Windows 11 hardware check need replacement. Factor that cost into the same budget conversation. Labor for testing, packaging, and user communication is usually the larger internal cost.

Start the inventory no later than mid-November if the goal is to finish major upgrades before the January 2027 Windows Server 2016 deadline. Teams that wait until December discover that packaging, testing, and change windows simply do not fit.

Track three numbers throughout the project: percentage of devices still on unsupported software, number of unused licenses reclaimed, and average time from pilot to full department rollout. Those metrics tell you whether the refresh is reducing risk or simply moving it.

The organizations that treat the year-end software refresh as an inventory-and-risk exercise rather than a shopping list finish 2026 with fewer unsupported systems, cleaner license positions, and a clearer path into 2027.