Windows Server 2003 Migration: Take a Fresh Look at Your IT Infrastructure

(1)

EXECUTIVE BRIEF

Windows Server 2003 Migration: Take a Fresh Look at

Your IT Infrastructure

IDC Opinion

Microsoft will be ending Extended Support for Windows Server 2003 in July 2015. For Microsoft customers, this means that standard, packaged support offerings will no longer be available. In addition, Microsoft will stop issuing security patches for Windows Server 2003 when Extended Support has terminated. Consequently, European organizations will be exposed to significant risk if they stay on the Windows Server 2003 platform beyond July 2015.

Windows Server 2003 is a proven and stable IT infrastructure software platform and is still in widespread use in many European organizations. However, as support for Windows Server 2003 will end in July 2015, IDC advises IT organizations to start planning for a migration to Windows Server 2012 R2 as soon as possible. This will help to ensure that there will be enough time to plan the migration, secure the necessary budget, recruit the needed skills, and implement and test the upgrade.

While carrying out the assessment of the Windows Server 2003 estate, IT organizations are also advised to take a closer look at their entire IT infrastructure. This is because all IT technology layers have undergone a significant evolution in the past 10 years. IT organizations can benefit from updating their server, storage, and data protection and recovery products to the newest available products to achieve lower operational cost with increased performance and better protection.

In This Executive Brief

This IDC Executive Brief analyzes the implications of the termination of Windows Server 2003 support in July 2015 and suggests best practices for European organizations that are planning to migrate to a more up to date IT infrastructure.

Situation Overview: Windows Server 2003 Migration — Why You Need

to Act Now

(2)

However, the time has come to revisit this strategy, as Microsoft extended support for Windows Server 2003 will end in July 2015, which means that standard, packaged support offerings will no longer be available to European IT organizations. This makes Windows Server 2003-based applications very vulnerable to operational and security breaches and introduces a high level of risk for European organizations. While organizations can potentially negotiate custom support agreements with Microsoft to provide security patches beyond the cut-off date, this will inevitably raise support costs significantly. Ultimately, the workloads in question will have to migrate anyway in the near-term so this approach is a stopgap for highly critical applications to keep them available while in transition.

Microsoft will stop issuing security patches for Windows Server 2003 when Extended Support ends. This will mean that applications and services built on Windows Server 2003 will be out of support and also out of compliance unless they are migrated to a newer operating system platform. IDC expects that most organizations will opt to migrate directly to Windows Server 2012 R2, which has rapidly become established as a popular, stable, and proven server operating system that allows organizations to take advantage of up-to-date virtualization technologies provided by Hyper-V 3.

European organizations need to act now to get an overview of all the applications that are running on Windows Server 2003. Once the assessment is underway, the applications need to be

prioritized, and a plan devised for migration. This might take quite some time, especially in the development and testing phases. The critical issues are time, skills and budget, as developing and testing a new system architecture and application design is not a trivial task.

This is made more challenging because Windows Server skills are in high demand. There is a shortage of software developers that can readily redesign and adapt custom applications for the new operating system and administrators/consultants that can migrate applications and operating systems.

While application migration and operating system updates are the most pressing issues, organizations also need to reassess other aspects of their IT infrastructure. IT technology has moved on significantly since Windows Server 2003 was introduced over a decade ago.

Virtualization has emerged as the de-facto standard for server and application deployments, with more than three times the amount of virtual servers out there than physical servers. This trend alone creates new requirements for adjacent technologies like management, networking, storage, backup, and disaster recovery.

Consequently, IDC encourages European organizations to start the assessment process as soon as possible and develop a migration strategy that they can begin executing immediately as July 2015 is approaching very quickly indeed.

Risks Associated With Staying on Windows Server 2003

The biggest risk from staying on Windows Server 2003 is that Microsoft will no longer provide any security patches and updates to address vulnerabilities that are detected for operational systems. This is not a trivial fact, as Microsoft still issues double digit numbers of critical patches every year under the standard support model. Consequently, Windows Server 2003 installations will

(3)

standard industry regulations around data protection or standards such as the PCI DSS. This in turn will inhibit their ability to do business effectively.

Staying on Windows Server 2003 will not only expose European organizations to security threats and vulnerabilities and create a non-compliance situation, but also to potential system failure and higher system management cost, as the IT infrastructure is not optimized for modern workloads. IT architectures have evolved quite significantly since the days when Windows Server 2003 was released over a decade ago. Windows Server 2003 lacks both server virtualization — which has become the foundation for building private cloud architectures — and also lacks the modern management frameworks or APIs built into newer Windows Server releases that enable the automation and orchestration necessary for cloud management. This leads to higher cost of operations generally and silos of management within the IT infrastructure

Windows Server 2003 runs in 32-bit only mode, which cannot adequately address the memory requirements of modern server workloads. This means it cannot make use of the advanced 64-bit modes and large memory support of modern hardware platforms to accelerate performance. In addition, the ongoing cost of maintaining an outdated server platform and the sustained operating expense required for additional security to isolate the servers from suspect traffic, malware and advance persistent threats will add up quickly, making it more cost efficient to migrate to a modern server architecture sooner rather than later.

Finally, all adjacent technologies in the IT infrastructure have also evolved quite significantly since 2003. Storage technologies have evolved, with software defined storage now becoming

mainstream and storage virtualization well accepted. Data volumes continue to grow as more of the business becomes digitized and supported by applications and information.

Data protection and recovery technologies have progressed significantly to address the capacity and performance requirements of modern businesses as well as focus on the protection of virtual infrastructures. Organizations running Windows Server 2003 are running the risk that their data protection process and technologies are out of date and not suited to the needs of modern business continuity and risk management requirements.

Benefits of Migrating From Windows Server 2003 in Due Time

By starting the migration planning process now, European organizations will have a chance to dedicate budget and resources to the migration process and actually execute it before Windows Server 2003 extended support ends in July 2015. Additional benefits are:

 Security risks are mitigated and compliance with standards such as PCI DSS maintained. By moving to a modern IT infrastructure based on a current server operating system such as Windows Server 2012 R2, organizations can ensure that they have a support contract with Microsoft and get ongoing access to vital security patches. This is necessary to achieve compliance with industry standard regulations.

(4)

upgrade their hardware platform to the latest 64-bit server designs, as well as their data protection and recovery tools to ensure higher levels of infrastructure resilience and recoverability.

Best Practices for Windows 2003 Migration — Take a Fresh Look at Your

Entire IT Infrastructure

IDC recommends a set of best practices to migrate off the Windows Server 2003 operating system and onto a newer server operating system like Windows Server 2012 R2, which provides all the features and functions that are necessary to run a modern cloud-like IT infrastructure. These best practices are:

 Evaluate your current installed base for Windows Server 2003. The first step to understanding the magnitude and complexity of the migration exercise is to get an overview of the number and criticality of applications dependent on servers running Windows Server 2003.

 Evaluate the technology options for your new IT architecture. Points to take into account are new server hardware platforms, current server operating systems, a potential move from physical to virtualized environments such as Hyper-V, and the data protection and recovery products to ensure resilience and recoverability of the infrastructure.

 Plan for system development and workload migration. Once you have made your technology choices, you need to design your new IT infrastructure and plan the system migration, including migrating from physical to virtualized environments such as Hyper-V.  Assign a criticality to workloads still running on Windows Server 2003. Prioritize those that

have to be moved, and develop a plan to mitigate risk for workloads that do not need to be migrated.

 Plan the migration, including any tools that will be needed for data migration and transformation as part of the exercise. Some data protection and recovery products can actually help with the migration from physical to virtual infrastructure and take out risk from the migration process by ensuring that you can fail back to an older version of the

infrastructure, application, and data if something goes wrong.

 Update, verify, and test any applications before migrating them, as many of them are custom developed for Windows Server 2003 and must be redeveloped or modified for the new operating system. This step might take longer than you expected due to the

complexity of the application, skills shortage, and limited user bandwidth to test the new applications.

 Upgrade your data protection strategy across backup, restore, and archiving to be the best fit for your new look IT infrastructure. Data volumes have also increased significantly since the inception of Windows Server 2003, and it is crucial to choose a data protection and recovery tool that manages data efficiently, keeps the data footprint manageable, and ensures rapid recovery performance and efficient operations, for it to be a good fit for your new IT infrastructure.

How a Data Protection & Recovery Solution Can Support You Before,

During, and After the Windows Server 2003 Migration Process

(5)

 Restore data for test and development purposes. You can create multiple copies of your production environment for the software developers in order to test changes to any applications that are being adapted to run on Windows Server 2012 R2.

 Migration from physical to virtual environments. If you decide to migrate from a physical Windows Server 2003 environment to a consolidated and virtualized Windows Server 2012 R2 environment with Hyper-V, the data protection and recovery solution can facilitate the conversion of physical servers into virtual machines.

 Ability to roll back. Once you have embarked on the migration, should you run into any unexpected challenges with the new deployment, you can implement a planned rollback using your data protection and recovery solution.

IDC believes that a modern data protection and recovery solution provides important features that can help before, during, and after the migration process and provide greater flexibility and reduce risk for IT organizations going through this transition.

Conclusion

Microsoft will end the extended support phase for Windows Server 2003 in July 2015. European organizations need to act now and put a comprehensive migration plan in place for affected applications, covering all the various aspects of the migration, ranging from hardware and operating system choices all the way to choice of data protection tools. Leaving the migration too late may mean it never gets the attention it needs as other initiatives take priority, leaving the business exposed to elevated risk.

IDC strongly encourages European organizations to act now, as migration takes time, money and additional skills on top of the day-to-day operations activities. Skills shortages and the need to redevelop custom applications (that may not have been modified in years), can mean that the process of preparation, planning, development, testing, and implementation often takes much longer than originally anticipated.

(6)

About IDC

International Data Corporation (IDC) is the premier global provider of market intelligence, advisory services, and events for the information technology, telecommunications and consumer technology markets. IDC helps IT professionals, business executives, and the investment community make fact-based decisions on technology purchases and business strategy. More than 1,100 IDC analysts provide global, regional, and local expertise on technology and industry opportunities and trends in over 110 countries worldwide. For 50 years, IDC has provided strategic insights to help our clients achieve their key business objectives. IDC is a subsidiary of IDG, the world's leading technology media, research, and events company.

IDC U.K.

Chiswick Tower

389 Chiswick High Road

London W4 4AE, United Kingdom 44.208.987.7100

Twitter: @IDC

idc-insights-community.com www.idc.com

Copyright Notice

This IDC research document was published as part of an IDC continuous intelligence service, providing written research, analyst interactions, telebriefings, and conferences. Visit www.idc.com to learn more about IDC subscription and consulting services. To view a list of IDC offices worldwide, visit www.idc.com/offices. Please contact the IDC Hotline at 800.343.4952, ext. 7988 (or +1.508.988.7988) or [email protected] for information on applying the price of this document toward the purchase of an IDC service or for information on additional copies or Web rights.