Is Active Directory (on-premises) Still Supported? (2026)
Short answer
Active Directory (on-premises) is supported and new versions continue to ship; the newest version is supported until 14 Nov 2034. CISA’s Known Exploited Vulnerabilities catalog lists 3 vulnerabilities in Active Directory (on-premises).
Active Directory Domain Services is a Windows Server role, so on-premises Active Directory is supported only as long as the Windows Server version running its domain controllers.
Legacy Technology Tracker · Status as of 16 Oct 2026. Data checked 7 Oct 2026; refreshed monthly, with quarterly snapshots kept unchanged.
Risk rating
Low: supported, with new release lines continuing; no licence change recorded in the last 24 months; 3 vulnerabilities on CISA's KEV list (supported versions receive security fixes). How ratings work
Key facts
Every value links to its source and shows when we last checked or retrieved it. Data checked 7 Oct 2026; status as of 16 Oct 2026.
| Fact | Value | Source | Checked |
|---|---|---|---|
| Support status | SupportedActive Directory Domain Services is a Windows Server role; its lifecycle follows the host Windows Server LTSC release (semi-annual channel releases excluded). | ||
| End of mainstream support | |||
| Newest version supported until | |||
| End of paid extended support | |||
| Known exploited vulnerabilities (CISA KEV) | 3 CVEs all time; 0 added in the last 24 monthsNewest added 18 Aug 2022Matched by vendor and product name in the KEV catalog. | ||
| Job postings and salaries | Not published: the job-posting source is on hold pending a data licence. | — | — |
Versions in scope
Active Directory Domain Services is a Windows Server role; its lifecycle follows the host Windows Server LTSC release (semi-annual channel releases excluded). Dates per version, each with its source.
| Version | Status | Standard support ends | Extended support ends | Latest release | Source | Checked |
|---|---|---|---|---|---|---|
| 2012 | Unsupported | 6.2.9200 | ||||
| 2012-r2 | Unsupported | 6.3.9600 | ||||
| Windows Server 2016 | Supported | 10.0.14393 | ||||
| 2019 | Supported | — | 10.0.17763 | |||
| 2022 | Supported | — | 10.0.20348 | |||
| 2025 | Supported | — | 10.0.26100 |
If you still run Active Directory (on-premises)
Active Directory has no lifecycle of its own, so audit the Windows Server version on every domain controller. The earliest deadlines are 13 October 2026 for any domain controller still on Windows Server 2012 or 2012 R2, and 12 January 2027 for Windows Server 2016.
The realistic options:
- Replace the domain controllers. Add controllers running a current Windows Server release, move the roles across, and retire the old ones. Windows Server 2022 and 2025 are supported to 2031 and 2034. This keeps Active Directory and removes the operating-system deadline.
- Cover older controllers with ESU while you move. Available for Windows Server 2012 until 13 October 2026 and for Windows Server 2016 through Azure Arc. See the pages for Windows Server 2012 and Windows Server 2016.
- Move identity to Microsoft Entra ID. This changes the identity model, not only the version, and affects applications that depend on Kerberos, NTLM, LDAP or group policy.
Inventory which applications authenticate against the directory before choosing. That list decides whether a controller refresh is enough or an identity migration is justified.
Related pages: Active Directory to Entra ID migration, suppliers in security and identity modernization companies, and cost ranges.
Frequently asked questions
Is on-premises Active Directory still supported?
When does support end for domain controllers on older Windows Server?
Can I get extended support for Active Directory?
Only through the host operating system. Microsoft's ESUs cover Windows Server 2012 and 2012 R2 until 13 October 2026, and Windows Server 2016 for up to three years after 12 January 2027. Active Directory has no separate extended support of its own.
What can replace on-premises Active Directory?
Microsoft Entra ID is the usual cloud direction, often run alongside on-premises Active Directory during a hybrid phase. It does not replace every on-premises function one for one, for example group policy and legacy authentication, so migrations are scoped application by application.