Slashdot Mirror
Windows Server 2003 Reaches End of Life In July
Several readers sent word that we're now less than six months away from the end of support for Windows Server 2003. Though the operating system's usage peaked in 2009, it still runs on millions of machines, and many IT departments are just now starting to look at replacements.
Although Microsoft publishes support deadlines long in advance -- and has been beating the drum to dump Server 2003 for months -- it's not unusual for customers to hang on too long. Last year, as Windows XP neared its final days of support, there were still huge numbers of systems running the aged OS. Companies lined up to pay Microsoft for extended support contracts and PC sales stabilized in part because enterprises bought new replacement machines. Problems replacing Windows Server 2003 may appear similar at first glance, but they're not: Servers are critical to a business because of the applications that run on them, which may have to be rewritten or replaced.
[In many cases, legacy applications are the sole reason for the continued use of Server 2003.] Those applications may themselves be unsupported at this point, the company that built them may be out of business or the in-house development team may have been disbanded. Any of those scenarios would make it difficult or even impossible to update the applications' code to run on a newer version of Windows Server. Complicating any move is the fact that many of those applications are 32-bit -- and have been kept on Windows Server 2003 for that reason -- and while Windows Server 2012 R2 offers a compatibility mode to run such applications, it's not foolproof.
[In many cases, legacy applications are the sole reason for the continued use of Server 2003.] Those applications may themselves be unsupported at this point, the company that built them may be out of business or the in-house development team may have been disbanded. Any of those scenarios would make it difficult or even impossible to update the applications' code to run on a newer version of Windows Server. Complicating any move is the fact that many of those applications are 32-bit -- and have been kept on Windows Server 2003 for that reason -- and while Windows Server 2012 R2 offers a compatibility mode to run such applications, it's not foolproof.
Does anyone know if I can use the PosReady registry hack that can be used on XP to get support updates until 2019 on Server 2003?
This is stupid. WS 2003 is still the default server platform that most companies deploy. WS 2008 is not even close in comparison. If you want something small that can maximize utilization especially in a virtualization environment, then there's no alternative. Vista on my server, no thx. And the new tablet-version, seriously what were you thinking?
It's a bit late for these businesses, but one of the pro's of Free and Open Source software is that you always have the right to get the source code and pay somebody else to support your operating system version when the official supplier pulls their support. That's something that Microoft makes very clear is illegal for Windows users to do.
OS Software is like love: The best way to make it grow is to give it away.
Software does not have an "end of life". It continues to do what it always did.
"End of life" is a marketing term used so Microsoft can sell more copies of Windows, apparently. My understanding is that fixing newly discovered vulnerabilities in Windows XP or Windows Server 2003 would be fairly inexpensive.
I've explored the issues concerning Windows XP: Microsoft Windows XP "end of life": Conflict of interest.
That was exactly his point: you can hire another company to continue the maintenance.
Exactly what company are you going to hire to perform security audits and patch an ungodly number of packages for a Linux distribution from 2003?
MythicalUniCorp?
Because I hear they're still patching Windows 3.11 for Workgroups. How? Doesn't matter. If you can imagine it, it must be true!
But about once a year or so, there is a vulnerability in Windows that is exploitable over the network remotely without authentication, the sort of thing that Conficker used to spread on (i.e. MS08-067). Wormable vulnerabilities are the highest risk, and the time between the flaw being announced and an exploit being created can just be a matter of days.
So, eventually those Windows 2003 boxes are going to get pwned. It might be weeks or years after 2003 goes EOL, but eventually it will happen.
Never email donotemail@WeAreSpammers.com
"But if you have to rewrite apps, that's not going to happen in time,"
Challenge accepted
Can someone please clue me in as to why this is a problem? I mean we run 32bit software on Windows 8.1 so why should this be any different on the server? I was under the impression that the compatibility issues only really existed for drivers and that backwards compatibility was an issue (64bit apps on 32bit OS) but that forward compatibility is assured.
The hangers on for the Windows XP era had a lot more to do with Internet Explorer and the clusterfuck of web services which depended on it at the time. Is there a legitimate difference on the application level as well that makes this upgrade impossible? I'm not buying what the summary is suggesting.
The reason why a lot of these businesses haven't upgraded is because it usually takes years to make this happen.
If you're a business who IT department or enterprise support vendor is running in full ITIL mode with a few ISO business standards thrown in for good measure, it really does take that long.
The amount of paperwork and busywork that needs to go into something as relatively simple as an OS upgrade is something to be marvelled at when you actually have to work in that environment. There are whole massive bureaucracies and months of meetings, followed by change review boards, and more change review boards and testing and more testing and backout plans, and risk registers, and more meetings, and then you have to wait for the next meeting to come along before going onto the next stage.... and and and......
So to all these people saying "just run open source" have never run a multimillion dollar business and relied on Windows to bring home the bacon. Much less have they ever considered being a large collossal IT support vendor that has to maintain SLAs and can get hit for penalities of millions of dollars if those SLAs are breached. These are not nimble organisations. They are not cowboys. They cover all possible failure scenarios and document everything from multiple support networks before they lay a single mouse click on the box.
READY.
PRINT ""+-0
Wine emulates 32-bit Server 2003 fairly well. Hell, Visual C++ 6 works perfectly. For all your legacy crap, it's time for Wine.
You're stupid! Windows 2000 is still the default server platform that most companies deploy. WS 2003 is not even close in comparison. If you want something small that can maximize utilization especially in a virtualization environment, then there's no alternative. Vista on my server, no thx. And the new tablet-version, seriously what were you thinking?
So you are coerced to cough out more money for Microsoft's newer software.
Which in turn keeps the MSFT shareholders happy.
That's capitalism for you. A constant treadmill of consumption.
You wrote (or used) software that only works on Server 2003 / Windows XP / etc.
Then it's your own fault.
No doubt your replacement project will rely on .NET 4.5 or whatever and then when that stops being supported you'll have to do the same things all over again in a few years.
Or you could, you know, not use software that is tied to any particular manufacturer, technology, etc.
I'm just not sure what most places get out of being tied into MS technologies like this. Sure, if you're doing some heavy Office integration all the time with this, that, the other then you've tied yourself in, but where is that necessary compared to your software churning out some intermediate format and then just having the intermediate format converted to the one you need?
I don't get it, honestly, and supposedly "clever" IT businesses still fall for it every time.
Nobody is saying that software is immortal, but really it's blinkered to still be running stuff that's dependent on - what? ActiveX and IE6? Come on!
There's no excuse now. I get frustrated when I still see CCTV units for £50 sold with ActiveX components to do their web-view, when they have Android apps and all the rest working already. Stop it. Seriously. And that's at the cheap-junk end of the market.
If you can't abandon Server 2003 because of the applications you use, DON'T fall into the trap next time. Get yourself something that runs pretty independent of the OS already. There's very, very, very little that can't be done with web-based stuff (without requiring plugins) or just sheer open-ness at the intermediary layer so you can get someone in in ten years time to write a new "XML -> whatever" interface that bolts on to your existing system to replace the "XML -> Win64" interface you have now.
Seriously, people, stop it. If you're going to break the endless cycle of annual renewal of MS licences, you have to get off their locked-in development tools and technologies too. The same with Apple. But there is NOTHING stopping you making something that will work with Windows, Apple, Linux, Android, iPad, Windows Phone, etc. all in one hit now, and could be run FROM any of the above too if you needed it to.
Virtualised environments mean that someone handing you a VM with a Linux Guest OS as their entire product is not uncommon in my industry (Smoothwall, etc.), and it means you can run anything on anything nowadays.
If you're still on 2003, I judge you on so many levels, but the stupid decisions you may be about to make are COMPLETELY AVOIDABLE here, now, today before you make the same mistake again.
It is utterly unreasonable to expect a software supplier to provide free updates for software "in perpetuity".
Microsoft is a business, they make money from selling new software. If you don't like that they make their software obsolete, ask them to make change their business plan.
Software could be sold with free updates until a "replacement" is released, and then one pays for an "update subscription".
This way one could have chosen whether one upgraded to "Windows Server 2008", or pays a yearly fee for updates "in perpetuity".
Nothing in IT is impossible to accomplish.
However there is such a thing called cost.
The equivalent of impossible in IT is prohibitively expensive.
Software can be recoded, even if it was originally coded 50 years ago. The cost however of reverse engineering it is what keeps them from doing so.
That I went in the direction of the Linux world and got the hell away from Windows in general.
Between licensing costs, patches that break key functionality, etc. who the hell wants to stay on Windoze?
I like the Linux update mechanisms between apt-get on Debian and Ubuntu to yum on RedHat and CentOS. And it's fairly easy to roll back an update too. As opposed to windows where even some of your config data gets hosed in the process.
And if you're worried about things like AD, Domains etc. just install SAMBA on a Linux box and couple auth to LDAP. Life gets lots easier.
If you simply can't live without your Win2003 server and don't plan on paying MS for additional support, make sure you:
* Move everything that can be moved off of that server onto a vendor- or reliable-third-party-supported solution.
* Make and test backups frequently. Make sure you have a way of bringing the server back if your hardware dies or server room goes up in flames/earthquake/flood/whatever.
* Put a vendor- or reliable-3rd-paty-supported hardware* firewall between it and the networks that it is attached to. Make sure the firewall(s) block all in-and-outbound traffic that isn't absolutely necessary.
*"Hardware firewall" could be just a PC or server providing firewall services, it doesn't have to be a box that was designed to be a firewall. If you are running Win2003 server in a VM, your hypervisor/host-OS can act as a firewall. Make sure it is supported by the vendor or a reliable 3rd-party though.
Come to think of it, this is good a good "starting point" even if you are using vendor-supported equipment and software throughout your enterprise. The difference is that if everything is supported, you can probably get away with putting multiple functions including your in-house-custom-apps in one server and (for small-load-situations) enjoy the cost- and speed benefits that come with doing it this way.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
MS should release the copy rights on this OS. They want to retain the rights to the code, but do not wish to live up to any responsibility of that right, since it would cost them money. Worse: it merely wouldn't make them as much money.
The quid pro quo of copy rights were that we'd be able to learn from it and use the copyrighted work ourselves in future.
However, there's no way to get the source code before Microsoft sees to it that every and all copies of the source code is deleted and unusable.
Yet we STILL have to give them the rights that they do not wish to pay for????
The MINIMUM they should be doing is releasing the code.
To head off "They're using some of that code in their latest OS!", HOW THE HELL DO WE KNOW??? That's closed source too! And those getting a new OS are paying for code they already paid for with the obsoleted OS. And this makes the copyright expiry of the NEW OS fragmented. Some of it should be opened years before other bits (if they every get made to live up to the bargain we all signed up for...).
Moreover, SO WHAT? It doesn't open up the code for the new OS by opening up an OS that has some of the same source code lines as it has. So why is it an issue?
Answer: it isn't. It's a "LOOK! SQUIRRELS!!!" cry of those who want rights without having any responsibility.
If MS want to keep the code rights, they should be REQUIRED to support it. They won't let anyone else do it.
What you have heard about, but never understood, since it made a nice "talking point" against linux, hence was all you needed or wanted, the ***KERNEL*** ABI is NOT standardised.
I can still run Heretic and Rune on modern Linux.
Fallout1 and 2 won't work at all on Win7, even with compatibility with 95 or 98 applied.
This is why COBOL and mainframes continue to live on. Applications on them are often 30 or more years old and continue to work.
Companies don't like to pay loads of money for line-of-business apps only to have to pay loads again 12 years later to revamp it for the latest-and-greatest server/language/OS, especially for something with little or no UI.
Microsoft is keeping COBOL and mainframes alive and well.
Table-ized A.I.
I work with a few places that still have 1-2 2003 servers around, and for some of them we'll probably be locking them off from any external access and doing a few other things to restrict them while still keeping them around (possibly mostly powered down except by request). That's because they're legacy systems still running old software that someone occasionally needs to refer back to - primarily old diagnostic imaging or practice management/EMR systems which are long out of support.
I have a few places that are 1-3 doctors, 3-6 staff, and they have an old system that they need to go back and refer to every week or two for things that didn't get migrated when they changed EMRs. Migrating everything out of that old system into something like PDFs for attachment to the current system would be cost-prohibitive; paying for migration ("Sure, we'll be happy to upgrade you to our new version, it'll be just like you're switching back to us, shouldn't be more than $30k or so") is the same. We long ago VM'd almost all of these systems along with upgrading/replacing where feasible, so there's not really an added hardware maintenance cost for keeping the VMs around.
And before people say "you should have migrated everything," the last migration we did, the new vendor wanted and would accept a very specific set of fields - all on a single (large) Excel sheet. Everything migrated was practice management data - demographics, insurance, etc. NOTHING clinical was migrated (possibly for liability reasons - what happens if your import of the peanut allergy info fails because of something stupid). For clinical data, the staff at the practice still goes into the old system, generates a set of reports into PDFs, then attaches those PDFs to the new electronic chart as if the customer was coming from another practice. Migrating all the patients makes no sense, this is a specialist practice where a significant percentage of patients are seen for a year or less, then are not seen again for years if ever.
fencepost
just a little off
I think some folk spotted the real problem, and the normal circlejerk of Linux hurr-durr SGI hurr-durr (really? Irix?). Then open-sourcing windows - really? They're a company too. Screw that. Millions of hours of work in that now, to support systems and companies all over the planet and the diverse tech calls / feature requests they've got to make stuff work. For better or worse, it does the job well enough most of the time, just like OSX or RHEL or VMWare or Riverbed. They've invested billions in R&D and people, who some people just want to sponge off - "... we'd be able to learn from it and use the copyrighted work ourselves..." - really? Get off your arse and go make a company as successful as Microsoft. Some people have done it. Even making a successful phone app can make you a millionaire, but not many do. It's a dog eat dog world.
To the person saying that the default VM guest is Server 2003 - ESX 1.5 was the version out when Server 2003 got released, no hyperV or OVM at that time. So well done, you're using a (to paraphrase) "lightweight, efficient OS" that wasn't even designed for virtualisation. You're completely relying on the drivers at the hypervisor layer to fix whatever incompatibilities occur from hardware. And likely the teams at Microsoft and VMWare (making an assumption about your hypervisor) to keep talking to one another, shaking their heads, trying to figure out timing from the clock up through the stack and not to bork Server 2003 when underneath it's a DL380 G9 (or BL460c G8) and not the original DL380 G3 from when you put that system in around 2004 (or a decade ago). And got physical to virtual migrated some time in 2011 or 2012 rather than a clean install. Which admittedly removed the physical risk (hopefully) but nothing else.
Software wise - I don't know what to say when people say "but why do we need to upgrade (or patch?!)" and then "I do apt-get and upgrade mah OS so easy". So I would say to those still on the "I can't touch these boxes" - at least try it. By now, if you're anything towards responsible you've done an assessment saying "I made a new server, loaded the application and it borked completely", or "looked ok, maybe we can move it to a new box and do a full test".
For all the people complaining that it's an "annual" tax by Microsoft, I disagree. I think the air conditioner analogy above is good, and at home washing machines might give you the same grief. If you're a business, you might buy a car / ute / truck. It has all sorts of uses, and you might customise it, you might not. If you do, yay you. You might have done it yourself, you might have paid someone else to do it according to your wishes or what they recommended based on their similar experiences and feedback from other people needing something special. But anyway, your accountant tells you to depreciate that sucker, and at the end of 5 years, you basically bin it. You get another, and thus the accounting cycle starts again. You might have learned things from using the vanilla car or the modified one. You might want to get something better than a car if you were after a truck all along. You probably suffered using your car that got cut down and ended up with a roof rack and towing a trailer in that cycle. It was a learning experience.
After too long in IT, I'm still mystified why IT people don't do more to say to their business "you know what, this Model T of an IT system we've got, it's getting a bit old. The mechanics (developers/administrators) for it are hard to find. No-one understands it. It could eventually break down leaving you on the side of the road at a really bad time for you. Maybe if we looked at what it did, what it does now, and what we'd like it to do, we could plan what might do the job better. We could tell you how much that would cost and you, the business, could make an informed decision about what to do". Even a victorian era analogue system will need take down, repair, replacement (think a steam train). Why do you think your system is any better? Your server is a colle
The biggest problem I have is there is no upgrade path from 2003 32 Bit to 2008 R2 which is 64 Bit. So each server is a fresh install. Fortunately, file servers that are virtual can have their disks reused. But you still have to define shares, etc. The other major issue is legacy applications that do not support 2008 or greater. There is a huge undertaking to get that stuff migrated to something else.
What I said may be imperfectly expressed. However, we have about 20 Windows XP computers operated by people who are not intense about cooperating. Those computers are guarded only by Malwarebytes and the fact that are all limited users, and we've had no problems.
The point I was trying to make is that, if there is enough attention given, software can be free of vulnerabilities.
"... no longer secure..."
OpenBSD is secure because it was examined carefully for vulnerabilities. Microsoft makes more money if there are vulnerabilities, and if its older products are considered likely to be insecure.
"... when it no longer boots..."
We have corporate users who do the same thing every day on computers installed in 2004. They don't want change.
"... when none of the software you use will still run on the old OS"
Yes, you and I. But some corporate users do specialized corporate work on software that ran under DOS. It does what they want. There is little call for change.
"... when you have to employ tech staff with out-of-date skills..."
The Windows command line windows are mostly just the old DOS. There is nothing out-of-date.
"... when the software is a dead do-do that nobody wants to touch..."
Lots of people do lots of things that have remained stable for decades.
"Sorry, but everything has an end-of-life."
I talked to a guy who makes a lot of money per hour maintaining Cobol programs on old mainframes. Yes, end of life. But possibly decades from now.
"When you can't log into your damn bank because it's said that IE6 is too old..."
The browsers are updated frequently, of course. And computers connected only to an internal network have no outside internet vulnerabilities, if there are no DVD drives. I talked to a woman who worked at Tektronix who could not send an email from her work computer because there was no outside access.
Should employees be allowed to explore the internet during lunch breaks? Sure, on a separate network in the lunch room.
I have the latest hardware and software, a 24-port gigabit switch, and multiple 3 Terabyte RAID drives. But that's because I make a lot more techological demands than the average person.
I don't feel conflict of interest. Unfortunately, conflict of interest is a big factor in the lives of many people who are involved with computer technology. Their minds are persuaded by what would make them more money.
"... runs into the millions."
Yes, but Microsoft is taking in millions from "Enterprise" users. See the sub-heading "Large customers are paying huge amounts" in Microsoft Windows XP "end of life": Conflict of interest.
If you have hardware firewalls that do deep-packet inspection and reject all traffic that doesn't match whitelisted traffic, AND your whitelist is detailed enough so that in practice it rejects all unwanted traffic, you should be okay.
So, unless the traffic of your specific can't-migrate-to-a-supported-OS application is too expensive to distinguish from unwanted traffic, you should be able to firewall a server so well that the fact that the OS is unsupported and otherwise vulnerable to attack is no longer a "must fix now" issue.
That doesn't mean it isn't an issue, and I would still recommend finding some way to phase it out, but it just means you won't have to fully decommission your Windows 2003 server this year or even this decade.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
The same type of "deep inspection" firewall trick can and probably should be at least CONSIDERED for ANY mission-critical machine that is deemed "too risky" to put on the same network with "unacceptably high risk of becoming contagious" machines. In some cases it may even make sense to apply this technique to machines that ARE running supported OSes and which are BELIEVED to be very well protected all by themselves.
For example, if you are running an in-house web site to provide selected employees with a web interface to the corporate back-end data center, it may make sense to put a dedicated security box between the data server and the web server and another dedicated security box between the web server and the company's "office" network. This way if some employee's machine gets infected, the web server is less likely to become compromised, and if the web server is compromised it is less likely to compromise the back-end data server. Also, the security devices can watch for suspicious activity, such as out-of-the-ordinary traffic patterns from the "office" network to the web server or out-of-the-ordinary data requests from the web server to the data server and raise alarms where warranted.
I'm sure by now you are worried about "what if the security boxes get hacked." That is a concern. There are ways of making the security boxes be pass-through boxes which are invisible/non-addressable to the office network, the web server, and to the back-end data center, which would mean that the only ways to deliberately "hack" them would be through a different network connection entirely (such as the connection to a dedicated, otherwise-non-network-connected computer in your security officer's office) or by sending carefully manipulated traffic through them that was designed to "break the XYZ-brand security box that someone told you might be there" or "break the security box that your traffic-analysis pre-hack investigation made you suspect was there."
If you don't care about STOPPING bad traffic but just want to raise alarms, a traffic-splitter that feeds a copy of all traffic to your security boxes will do the job and it will be all but completely invisible to the networks they are monitoring (a splitter will not be completely invisible, but it can be made to look like a non-addressable/dumb repeater, switch or hub from the point of view of the networks it is connected to - the only hint of its existence to someone without physical access to measure voltage levels may be a very slight increase in latency).
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.