Research and Recommendations

Transcription

1 Research and Recommendations Windows Server 2003 Custom Support Agreements Paul DeGroot Senior Consultant Software Licensing Advisors

2 Who Are Software Licensing Advisors? Mission: The Customer s Advocate Too many customers rely only on Microsoft or a reseller, who focuses on what they want to sell Leaves most customers with software they don't deploy or don't need SLA focuses on value and fit While projects or investments with demonstrable ROI beg for funds What you need to buy and the best way to buy it Align IT spending and strategies with corporate objectives and constraints "Your "Yourteam teamhas hasbeen beenabsolutely absolutelyfabulous..." fabulous..." --Fortune 500 consumer products --Fortune 500 consumer productsfirm firmthat that reduced reducedea EAspend spendby by60% 60% We Weexceeded exceededour ourexpectations expectationsfor forthese these negotiations. negotiations.because Becausewe wehad hadyour your intelligence, intelligence,we weknew knewwhat whattotohang hangon onfor. for. You really showed us the art of the You really showed us the art of the possible. possible. --Global --Global25 25resource resourcecompany company Personnel Your Yourfinancial financialmodels, models,worksheets, worksheets,and and strategies strategieswere wereinvaluable. invaluable.outstanding Outstanding work. Steve Kelley work. --Global --Global pharmaceutical pharmaceuticalfirm firm that reduced 3-year EA spend by more that reduced 3-year EA spend by more Microsoft sales for 5 years, insider knowledge of Microsoft s negotiating process than than$60 $60million million Paul DeGroot World-renowned expert on Microsoft licensing, previously with Directions on Microsoft Steve O'Halloran SAM technical expert, creator of AssetMetrix (now built into SCCM) "I've "I'velearned learnedfar farmore morefrom fromthis this engagement engagementthan thani Iexpected. expected.you Youreally really made madeaadifference.." difference.." --High-tech --High-techmanufacturing manufacturingfirm firmthat that reduced reducedea EAspend spendby by50% 50%

3 Selected Customer Engagements

4 The Issue: End of Support for Windows Server 2003 Availability of service packs, updates, hotfixes, and patches depends on a product's life-cycle phase Guidelines, not guarantees Phase Duration Updates Costs $0 Mainstream 5 years after release, or 2 years after release of successor, whichever is greater All: Service packs, program patches, updates, hotfixes, security patches Extended 5 years after the end of Mainstream Security patches, custom hotfixes Web 2+ years after the end of Extended Web access to previously released updates, knowledge base articles Custom 2 years after the end of Extended Same as Extended Security patches: $0 custom hotfixes require Extended Hotfix Service Agreement $0 Custom Support Agreement, with per device pricing

5 Why Not Upgrade Windows Server 2003? The vast majority of our customers who will not upgrade from Windows Server 2003 by July have a significant barrier to doing so. No one takes the issue casually A custom application still hasn't been/can't be rewritten Application vendor's product specifies this version Will require a costly upgrade to a newer version of a vendor's application Will void warranty/support on associated application, equipment Upgrade drivers Regulatory compliance requirements Need to replace hardware but new hardware is not well supported by Server 2003 HIPAA, PCI, etc. Drivers, storage subsystems, faster networks Want to avoid purchasing a Custom Support Agreement (CSA) What's your situation? What are other people doing? Fill out our survey (Google logon required) at m?usp=send_form

6 The Hitch A Custom Support Agreement is very expensive First year: ~ the cost of the original license For Windows Server 2003 Standard that is about $700 per license We have seen quotes for $600 Second year: double year 1--$1,200 per device Third year: double year 2 $2,400 per device Not clear what, if anything you will get out of it Patches may apply to only a few, or even none of your systems You don't run.net applications Administrators do not browse the Web or run user applications ( , Word, Media Player) from the server console Your device is not accessible over the network, or to the Internet You are not running vulnerable services on your servers No significant patches may appear in the next year or two You just need a few more months to de-commission your remaining Server 2003 instances

7 What kind of risks without a CSA Microsoft has multiple definitions of update severity Critical non-security updates Critical security updates Remote Code Execution Escalation of Privilege Denial of Service (DOS) Without user prompts Important security updates System may become unavailable Could compromise confidentiality of user data Some may prompt the user for action, others not Many Windows XP critical updates are also applied to Server 2003 Share much of their code But XP user activities (Web browing, media playing) and common practice of users with admin rights create more opportunities for compromised systems than servers No admin logged on much of the time Consumer features less available

8 What our research found Critical updates are declining in frequency Windows Server 2003 Critical Security Updates Many critical updates address narrow, specific configurations that may not be typical.net applications Telnet Use Windows Media Office Paint

9 Non-Security Updates by Type Type Application compatibility issue Number Most Recent 3 04/05/12 Comment SharePoint and Microsoft time stamps Feature update 3 10/11/10 Primarily to implement Extended Protection for Authentication in the Server Functionality issue that does not affect live data 1 12/10/12 Volume Shadow Copy issues Functionality issue, with available workaround 1 04/05/12 Templates from Server 2003 VMs Internet security issue with manual workaround 6 10/08/12 Untrusted security certificates from Comodo, Microsoft; t00-short cryptographic keys Primarily a desktop issue 12 02/10/14 Rendering Web pages, Office and Windows client compatibility Server Web browser issue 1 04/05/12 Limited to Small Business Server 2003 R2 Updates security capabilities 1 04/05/12 Limited to Small Business Server 2003 R2 WSUS Updates 1 08/29/12 Moot, since no further updates will be delivered via WSUS

10 Microsoft's Solution: the CSA Provides Critical and Important updates beyond extended support Plus problem resolution, some support assistance, account management Custom hotfixes only for critical problems Significant business loss or degradation of service Cause products to crash, lose data, function unpredictably No changes for additional functionality, eg time zones, daylight savings Payment is always retroactive to the start of support

11 An Alternative: Custom Support Essentials Covers critical hotfixes only (nothing for important severity Can substantially reduce costs if few critical hotfixes are released One critical hotfix is included, at a fixed price Payment is a fixed fee plus a per device fee. As older systems taken out of service, hotfix costs go down

12 CSA Strategies Don't purchase a CSA immediately Consider Custom Support Essentials You can always buy it later By then you may have taken many vulnerable servers out of service, reducing your cost Cost will be the same if you buy it later For a few critical hotfixes that apply to you it will be less Risk reduction Servers with.net applications should be upgraded first Control administrative activities at the console Turn off unnecessary services, like Telnet Take our poll to see what others are doing: