Windows Server 2003 is a very good operating system from Microsoft, and we're relying on it on a daily basis.
I have heard that I should replace it by something "newer" and more "modern".

Why should I do this?
What are the implications if I don't upgrade?

  • Yah, look at the amount of questions that i've seen for XP (and still see)... – MichelZ Jun 30 '14 at 8:06
  • 8
    It's a perfectly valid question that we'll probably see hundreds of in the year to come. I think it's a good idea to have a dupe target ready for those questions. – pauska Jun 30 '14 at 10:02
  • @ThatGraemeGuy the chap asking describes himself as a CTO, not a professional sysadmin. Your thoughts on an executive's technical skills might correspond to mine :-) however.... he answers the question decently, so give him a bonus. – gbjbaanb Jun 30 '14 at 15:47
  • @MichelZ - what version of windows is running on the desktops? Windows XP? – Matt Jun 30 '14 at 20:26
  • I recently heard that in my country, I think it's the police force are still using Windows XP and were trying to pay MS for extended extended support. I think they will be forced to upgrade very soon. – Matt Jun 30 '14 at 20:27

While Windows Server 2003 was a very good Operating System for quite some time, it will reach its End of Extended Support life on July 14th, 2015.

While mainstream support gives you free security updates, service packs, non-security related hotfixes and a wealth of other stuff, the extended support phase reduces this to security update support and no new features/service-packs.

The end of extended support then basically marks the end of the product lifecycle, where there are no new security updates published by Microsoft for free. Depending on the product, there is the possibility to extend this time period by some time, but it's very expensive.

(Refer to the Product Lifecycle FAQ @ Microsoft)

What does that mean for you?

If a security issue is found in Windows Server 2003 after July 14th, 2015, Microsoft will not issue a patch to fix the issue. Your server will be vulnerable - forever - from that point on forward.

We have seen and learned with Windows XP that even after months of awareness campaigns, that there are still a lot of Windows XP installations out there, even after months of its end of extended support. These systems are and remain vulnerable to current and future threats. Refer to Qualys Blog

It is therefore strongly recommended and definitely best practice to upgrade those systems before July 14th, 2015. Start now.

  • +1 - End of extended support life, that's a very good reason to upgrade. – Matt Jun 30 '14 at 20:25
  • 1
    Months? We knew exactly when XP would reach end-of-life for YEARS. Even Wikipedia had a date for it; in fact, it has end-support dates for everything up to Windows 8.1, and all of these are many years away. There may not have been "awareness campaigns", but it was pretty easy to find out for people who knew where to look (and your company should have been one of them). – trysis Jul 1 '14 at 1:14
  • 2
    I feel there needs to be some mention of the developers moving to newer platforms as well. As the OS ages, less other software will support it, which means greater difficulty and cost in maintaining whatever you want to run on it. For example, the newer versions of .NET (4.5 and up) do not support Windows Server 2003, and developers will continue to move forward onto new .NET runtimes, which contains new features not available in older versions. The .NET runtime is an example of MS itself moving away from developing for the platform; other developers will follow. It's not just security issues. – jpmc26 Jul 1 '14 at 7:11

A word about security (in response to a comment): software out of maintenance does not get security updates so such operating systems and software stacks must be kept carefully separated with this in mind. Such systems and the services they provide should not be directly accessible to users.

This means the answer is different if the servers are performing some back end function or directly serving users. Upgrade file servers, mail servers and others that users directly use or are connected directly to the network. Evaluate back end servers that do back-end tasks and are not directly accessible by users.

In the past the one reason to upgrade an OS was that eventually new hardware doesn't support the older OS and a needed software component doesn't run on the newer OS or misbehaves. Your then left with trying to find hardware that works or doing major changes to the software stack (replacing one component often leads to having to replace others as well).

This is no longer the case for server operating systems for the same reason it hasn't been true for mainframes for decades: virtualization allows you to run older operating systems and software stacks on new hardware.

The other reason is to take advantage of new features in the OS or software components now or in the future. If a software stack ages in place too long it becomes increasingly difficult to upgrade.

  • 4
    You make two interesting points but the entire security aspect as discussed by MichelZ is missing from your answer. Given the tags on this question and its target audience you're giving dangerous advice. – Lilienthal Jun 30 '14 at 15:24
  • You should really replace out of support products, even if they are not networked, not directly accessed by users, and only doing back-end tasks. What if something breaks and you need support? You're screwed. – MichelZ Jul 1 '14 at 12:53

Not the answer you're looking for? Browse other questions tagged or ask your own question.