Key takeaways
- Windows Server 2016 stops receiving security updates on January 12, 2027. If you still run it, plan the replacement now.
- Offices close and fewer people are watching. The FBI and CISA have warned that ransomware attacks increase on holidays and weekends.
- Before December 31, test a backup restore, review who has access, confirm your renewals, and write down who is on call.
A year-end IT checklist is a short set of reviews you finish before the calendar turns: holiday security coverage, systems nearing end of support, backups, user access, and licensing. Done in November and December, it lets you start January with fewer surprises and a budget that reflects what is actually coming.
This guide is for owners, office managers, and in-house IT leads at small and midsize businesses. Helping clients close out one year and open the next is a routine part of how we work at WheelHouse IT, and these are the steps we put at the top of the list.
In this article
- Plan holiday coverage before you need it
- Check for systems reaching end of support
- Test backups by restoring something
- Review who has access
- Line up renewals and the 2027 budget
- Give your team a quick security refresher
- Year-end IT checklist
- Frequently asked questions
Plan holiday coverage before you need it
In a 2021 joint advisory, the FBI and the Cybersecurity and Infrastructure Security Agency (CISA) reported an increase in highly impactful ransomware attacks on holidays and weekends, when offices are normally closed. The agencies recommended practices including offline backups, multifactor authentication, incident response plans, and naming security staff who can be reached during holidays.
Before your office closes, put the holiday plan in writing. Name who is on call, how to reach them, which alerts go to them, and who has authority to take a system offline if something looks wrong. Share it with leadership and with your IT provider.
Check for systems reaching end of support
Microsoft’s extended support for Windows Server 2016 ends on January 12, 2027. After that date, servers on that version stop receiving security updates from Microsoft.
Windows 10 reached end of support on October 14, 2025. In June 2026, Microsoft extended its consumer Extended Security Updates (ESU) program through October 12, 2027. Business devices fall under Microsoft’s separate commercial ESU terms, so confirm your coverage dates with your IT provider.
Pull an inventory of every server and PC with its operating system version. Anything on Windows Server 2016 or Windows 10 goes on a replacement list with a target date.
Test backups by restoring something
A backup is only proven when you restore from it. Pick a file, a mailbox, or a full server, restore it, and confirm the data is complete and how long the process took. Keep at least one copy offline or isolated from your main network, in line with the FBI and CISA recommendation above.
If you have a disaster recovery plan, check that its contact list and steps still match how your business runs today.
Review who has access
Year-end is a natural point to clean up accounts:
- Disable accounts for employees and contractors who left this year.
- Remove administrator rights that are no longer needed.
- Confirm multifactor authentication is on for email, remote access, and admin accounts.
- Change passwords on shared accounts, especially any a former employee knew.
Line up renewals and the 2027 budget
List every renewal that lands in the first quarter: software licenses, domain names, SSL certificates, firewall and security subscriptions, and hardware warranties. True up license counts against current headcount so you are not paying for unused seats or short on seats for new hires.
Then use your end-of-support list to set the 2027 hardware budget. Replacements you plan in December cost less stress than replacements you rush in March.
Give your team a quick security refresher
A short reminder before the holidays is easy to deliver. Ask staff to verify any request to change payment details by calling a number they already have, to report suspicious messages instead of deleting them, and to deny sign-in prompts they did not start. Ongoing employee training keeps these habits current through the year.
Year-end IT checklist
- Written holiday on-call plan, shared with leadership and your IT provider
- Inventory of servers and PCs with operating system versions
- Replacement plan for Windows Server 2016 (support ends January 12, 2027)
- Plan and dates for any remaining Windows 10 devices
- Successful test restore, with at least one offline or isolated backup copy
- Departed users disabled, admin rights trimmed, multifactor authentication confirmed
- First-quarter renewals listed and license counts trued up
- 2027 hardware and security budget drafted
- Security reminder sent to staff
Frequently asked questions
What should be on a year-end IT checklist?
At minimum: a holiday coverage plan, an inventory of systems nearing end of support, a tested backup restore, an access review covering departed users and multifactor authentication, a list of upcoming renewals, and a short security reminder for staff. Together, these cover security, continuity, and cost before the new year starts.
When does Windows Server 2016 reach end of support?
Microsoft’s extended support for Windows Server 2016 ends on January 12, 2027. After that date, Microsoft stops releasing security updates for it. If you still run it, plan the upgrade or migration now, because the applications on those servers usually need testing before a move.
Our Windows 10 PCs are enrolled in Extended Security Updates. Are we covered?
For now. Consumer ESU runs through October 12, 2027, and business devices follow Microsoft’s commercial ESU terms. Either way, ESU is a bridge, not a destination. Use the time to schedule upgrades or replacements so you are not facing the same deadline again next year.
Why does the holiday season matter for IT security?
Offices close and fewer people are watching systems. The FBI and CISA have reported more highly impactful ransomware attacks on holidays and weekends. A written on-call plan, a tested backup, and multifactor authentication lower the chance that a quiet week turns into a long recovery.
Start the new year on solid footing
None of the items on this list is a major project by itself. Finish them before the holidays, and January starts with a clear view of your systems, your risks, and your budget. If you would like a second set of eyes, the WheelHouse IT team is glad to walk through it with you.
Running a business website too? Our companion article from WheelHouse Online covers the year-end website checklist [LINK TO TWIN ARTICLE ONCE PUBLISHED].
Sources
- FBI and CISA, Ransomware Awareness for Holidays and Weekends, joint advisory AA21-243A, August 31, 2021 (archived)
- Microsoft Learn, Windows Server 2016 lifecycle
- Help Net Security, Microsoft gives Windows 10 users an extra year of free security updates, June 26, 2026
