Countdown to Windows Server 2003 End of Support

EXECUTIVE BRIEF Countdown to Windows Server 2003 End of Support Sponsored by: Intel Andrew Buss May 2015 Andreas Olah BACKGROUND A decade ago Microsoft made great gains in the datacentre with Windows Server 2003 on standard x86 hardware, gaining traction against the traditional Unix systems with proprietary RISC processors. This opened up departmental computing enormously, but also brought about complexity: businesses ended up implementing a variety of commercial software from major vendors and independent software vendors (ISVs), and bespoke applications developed in-house. Some of these workloads have been upgraded over time, but a significant proportion have been left running even as support has withered. Businesses still relying on Windows Server 2003 now face an urgent challenge as extended support for this venerable platform is finally coming to an end on July 14, 2015 now under 40 days away. Windows Server 2003 accounted for up to 20% of operating systems on servers at the end of 2014, therefore its end of support has major implications for European enterprises. While IDC has seen the worldwide installed base of Windows Server 2003 installations drop from 19.2 million instances in 2009 to 5.7 million in 2013 and 3.0 million in 2014, in 2015 there are still around 1.5 million installations that will face a potential time-bomb unless action is taken. IN THIS EXECUTIVE BRIEF This IDC Executive Brief is a 30-day action plan that discusses the steps businesses need to take to avoid being left with an unsupported, and out of compliance, infrastructure. It looks at the options available, including migrating to a more up-to-date version of Windows Server or suitable alternative, migrating wholly to a cloud-based infrastructure as a service (IaaS) or software as a service (SaaS) solution, or a hybrid on-premises/cloud set-up. We will also address potential issues that may arise during the migration process and what steps to take once the migration is complete. SITUATION OVERVIEW "End of life" sounds like a dramatic way to characterise the halting of the support cycle for a product, but it is an apt metaphor that has been cited across the industry. From July 14, Microsoft will not be producing any further software updates or security patches for the platform. In reality, this is a longplanned event that has been publicly communicated for years after the end of active sales and the expiry of both mainstream and extended support phases lasting over a decade. Windows Server 2003 end-of-life has a number of implications: Any applications running on the platform will be increasingly at risk of security breaches as new vulnerabilities and zero-day exploits will no longer be patched. Businesses still using Windows Server 2003 may not be compliant with regulatory standards. For example, under current data protection legislation in the UK, a business can be fined up to May 2015, IDC #IDCEB01X

500,000 for data loss. Under the proposed EU data protection laws, which could come into force as early as next year, a fine for data loss could be as high as 5% of global turnover, with penalties rising depending on how much the business is at fault. Running an unsupported, outof-date server platform would very likely cause regulators to assign blame to the business and impose higher levels of fines or sanctions. Running an out-of-date, unsupported and non-compliant server infrastructure also raises costs for businesses: paying for custom support is expensive, and it could also be difficult or more expensive to get insurance cover against data loss or other consequential losses. Maintaining old hardware can be pricey: parts become increasingly difficult to get while consultants and IT staff with the required expertise become more scarce and expensive. Ultimately, a creaking IT infrastructure will affect your ability to deliver trusted and valuable services to your employees and customers. BENEFITS OF UPGRADING FROM WINDOWS SERVER 2003 The world of business is becoming increasingly digital, with cloud, mobility, Big Data and social driving innovative new business models and creating new markets. In this world of the 3rd Platform of IT, the pace of business has increased dramatically, and the revenue generation and profitability of many companies is dependent on agile, scalable, reliable and secure IT service delivery. Windows Server 2003 was a huge hit for Microsoft, being very widely adopted. However, it was not designed with the needs of the modern digital business in mind, given the extent of computerisation and the mobility of the modern world. Moving to a modern cloud-focused operating system such as Windows Server 2012 R2 takes full advantage of modern high-performance, scalable and robust server hardware. With recent Azure update packs as well as management tools such as System Center 2012, it supports moving to a hybrid cloud model, as well as making workloads much quicker and easier to deploy. Moore's Law and design improvements mean that the hardware today is immensely more capable of running applications than even a few years ago. Multicore processors with power awareness enable many workloads to be consolidated into fewer racks with reductions in power and cooling. Looking at the leading European x86-based supercomputers, in 2012 the most powerful systems used 140,000 cores and produced around 1,000 TFLOPs at 4,500KW power consumption. In 2015, these now scale up to 460,000 cores and 6,000 TFOPs, while being much more efficient as they only consume half the power, at around 2,300KW, for six times the performance. Modern hardware also supports dense virtualisation, with the IDC Server Tracker showing that average core count per server increased from 6 to 9 between 2010 and 2014 in Western Europe. IDC also forecasts that overall virtual machine density will increase from 9.6 in 2013 to 9.9 in 2014, to 10.3 in 2015, then to 11 by 2018. Operating systems installed during the era of Windows Server 2003 are therefore likely to be outdated in terms of their capabilities in handling servers with higher core density, as well as new technologies like Docker containerisation. By upgrading to Windows Server 2012, customers can benefit from native deduplication capabilities, for which high performance is especially crucial when high data volumes are handled. The latest version also offers "larger" virtual machines that can host the most demanding applications. When running a larger number of virtual machines, licensing can become expensive and complex with older versions of Windows Server. Moving to Windows Server 2012 Datacenter Edition can provide cost savings as its licensing is no longer based on the number of server instances running, but provides a more suitable and predictable license that takes into account the number of processor sockets. 2015 IDC #IDCEB01X 2

Upgrading can have a huge upside when considering ongoing operations costs. IDC predicts that without action, opex will increase by about 6% to 80% of the total datacentre budget by 2018, eating into the amount available to invest in new capabilities and innovation. This represents the continuation of a trend that has emerged over the past two decades of the client/server era. Upgrading your older operating systems can help to reverse this trend and will also facilitate running the latest datacentre monitoring tools including heat sensors and sophisticated cooling management, keeping operating costs at bay. Without taking a new approach, labour costs associated with the manual management and administration of servers whether bare metal but particularly for virtual machines will increase 19% from 2013 to 2018. Therefore there are significant gains to be had in lowering the server or host to admin ratio by using the latest system management tools in conjunction with modern operations systems and hardware. Greater levels of operational automation included in Windows Server 2012 can free up staff resources to focus on developing new apps and tools, while reducing the time spent on routine maintenance or firefighting activities that do not add value but often take up 80% of administrators' time. If you are running outdated packaged application software from an ISV, there is an opportunity to move to a more modern version of the application or to a competitive platform that can take advantage of the performance features, security and capabilities of modern hardware, operating systems and management platforms. CHALLENGES Windows Server 2012 R2 offers relatively good compatibility for most applications that are currently still on Windows Server 2003. The main exception to this is for applications that operate close to the kernel rather than in user mode as 32-bit code has to be run in an emulated mode rather than natively. Custom applications or heavily modified versions of standard applications can be difficult to migrate because the code often needs to be moved forward by the same developers that created the original application. It is usually easier if the application was written entirely in-house but only if the development team can still support this application and has the time to address the migration. Other challenges relate to out-of-support application software, which means products that are no longer supported or for which support will expire soon. A prime example is Microsoft customers that are still using SQL Server 2005, as this database version is also near the end of its extended support life cycle (it will end in early 2016). Therefore it is of limited value to migrate SQL Server 2005 to Windows Server 2008 or Windows Server 2012, only to face another migration a year or two down the line. In this case, it will be best to migrate both Windows Server and SQL Server at the same time to the latest versions. When it comes to Windows Server migrations and application development and migration, there is a very real skills shortage in this area, especially in Europe. It is particularly important to make sure you identify and book the consultants you need as early as possible. Training initiatives in the form of workshops that could be run in partnership with major IT vendors or systems integrators can provide further preparation for your employees and can lead to longer-term upskilling. At this stage, the funding for the migration may not be within the general IT budget: the migration will not be free, so you need to identify all relevant sources of budget and secure the necessary funding both from the general IT budget but also from the responsible stakeholders. 2015 IDC #IDCEB01X 3

WINDOWS SERVER 2003 MIGRATION ACTION PLAN If you are running Windows Server 2003, the time for action is now as there are fewer than 40 days until support ends and compliance headaches begin. Breaking down a big project into stages gives you a sense of the task ahead and allows you to plan and manage the migration effectively. Tackling the migration should be done in three stages: Assess Prepare Execute These three steps should give you a clear sense of the current situation or the scale of the problem and help you prepare the migration process by making plans to bring in consultants and technicians where and when needed, setting in place any procurement processes for buying new hardware or cloud-based services, and planning the detailed steps needed to carry out the migration. STAGE 1 ASSESS There are two stages to the assessment phase. The first step is to understand not only what you already have in place, but what the dependencies are. This stage, which should start immediately if not already underway, will determine primarily the extent of Windows Server 2003 that is still running, but should also include the hardware it runs on and details of any installed software. These audits and assessments are quite intensive to do. Automated discovery tools can greatly speed up the task and increase the coverage and reliability of the assessment over a manual discovery initiative, and IDC recommends using such a tool if at all possible. The discovery process should also look to identify the people or teams responsible for financing and managing all of these items and to prioritise the systems according to the criticality to the business and the extent of use. Once Windows Server 2003 systems have been identified, they should be assessed according to how easy it will be to migrate them to another platform, primarily Windows Server 2012 R2 running on modern 64-bit hardware making use of virtualisation capabilities or a cloud service offering infrastructure as a service or even software as a service. IDC suggests the following four categories: Applications that can be migrated as is or with little effort Applications that will require moderate investment in modification in order to migrate Applications that will need extensive investment to redevelop before migration Applications that are not feasible to migrate and that require either protection to mitigate the impact of end-of-life or to be retired from use This is where you will need to get to grips with the complexity of bespoke code and custom applications running on your infrastructure. If the original developers are no longer employed or available, you will need to factor in finding and funding the specialist skills required or consider developing or purchasing a more modern alternative. You will also need to consider the impact on the business of the migration process. Both applications and people need to function during a migration, so a plan with minimal disruption and a rollback in case of issues will be vital. 2015 IDC #IDCEB01X 4

By the end of this discovery process you should have a clear picture of what your current Windows Server 2003 estate looks like, and a clear view of the actions, resources and costs needed to perform the migration. It is also essential to consider potential disruption to internal structures and processes as a result of infrastructure changes. Potential political conflicts between departments or individual responsibilities should also be addressed where necessary. In some cases it may make sense to centralise IT management, particularly if moving from physical servers to virtual systems. Additionally, executives beyond the CIO need to be convinced of the value and benefits that the upgrades provide in order to secure their support and funding. STAGE 2 PREPARE The issues identified at the assessment stage concerning applications need to be addressed at this point. It may be as simple as moving the existing workload to a more modern platform, fully supported by the software maker. Life is rarely that simple, however, and the likelihood is that some level of work on upgrades or modification will be necessary, or even to switch to an alternative application if available. If modifications are necessary, the initial choice is to determine the suitable platform to host the updated application. Windows Server 2012 R2 is the most up-to-date Windows platform, with virtualisation, manageability and security. It is also a 64-bit operating system supporting huge amounts of memory, which aids performance and scalability. However, if the workload has issues running on a 64-bit operating system and the required changes are too great in the short term, an interim measure may be to migrate to Windows Server 2008. The other choice of platform is to consider a cloud service to host the workload. Hybrid cloud creates flexibility, allowing workloads to be handled either on-premises or in the cloud by adding additional capacity when needed, either temporarily to cope with a spike in workload or for the longer term to cope with the business expanding. The application may be available in the form of software as a service, in which case migrating the information and other data to the cloud can solve the problem. Otherwise using IaaS can help to get workloads up and running on modern platforms as a monthly subscription without having to spend a lot of capital upfront to upgrade the hardware on-premises if your budget is tight. The use of cloud services is becoming much more accepted as part of mainstream IT service delivery, with IDC forecasting that software as a service that delivers fully managed application services will be the key investment approach for many companies that are looking to update or migrate workloads (see Figure 1). 2015 IDC #IDCEB01X 5

FIGURE 1 Apps Increasingly Delivered from the Cloud 30 25 20 IaaS storage IaaS servers 15 PaaS 10 SaaS infrastructure apps 5 SaaS LOB apps - 2012 2013 2014 2015 2016 2017 2018 Source: IDC Western Europe Public Cloud Forecast, 2014 ($B) For applications that can't be updated and migrated, the choice is to either migrate wholesale to an alternative product if available, or end-of-life the application and remove it from service. In the worst case scenario, where neither is possible, then special protective steps such as placing the system behind a protective application firewall or intrusion protection system to protect the system from known attack vectors, even against known but unpatched vulnerabilities, can be taken. Each segment of the new set-up should be audited for risk: assess how critical each process and application is, and in which order problems need to be solved. That risk could be a data breach: hackers routinely probe for chinks in the armour of organisations, and the longer an unsupported installation remains in production, the more likely it is to attract the attention of hackers. An unsupported installation also risks higher fines if it comes to the attention of compliance authorities. While an application might not cause any concerns about compliance, it could, however, be one that is critical for the business. The second phase of preparation is to understand the extent of the work: how long will it take, what skills are required and how much will it all cost. This stage of preparation should include identifying what expertise you will need: if the skills you need are not available in-house you will need to train your IT team or consider hiring external contractors. A note of caution is required, however. As discussed earlier, because of the tight deadline to end of support for Windows Server 2003, experts and consultants are likely to be in high demand during these final days of support, so you will need to identify not just the need for contractors but also find ones that are available and within budget. The relevant costs should also be identified at this point, but the benefits and value of the investment should also be clearly considered and communicated back to the business and relevant stakeholders. This may be a forced migration, but there are definite business value drivers around performance, agility, security and manageability that can easily turn the cost of migration into a net positive outcome 2015 IDC #IDCEB01X 6

for the business. This preparation and planning will result in a Windows Server 2003 Software Assessment Matrix that can be used to manage the migration process. A basic example of such a matrix is shown in Figure 2. FIGURE 2 Windows Server 2003 Software Migration Assessment Matrix Server ID Application Business Impact Migration Assessment Migration Plan Resources Required Estimated Timescale Estimated Cost Status Source: IDC, 2015 STAGE 3 EXECUTE If all has gone well in the assessment and preparation phases, you should now have a clear and detailed picture of your current IT estate and a plan for procuring hardware, software, services and extra pairs of hands to help implement your detailed plan for prototyping, testing and rolling out the new infrastructure and application migrations. You should also be clear about where the money is coming from and who owns the budget. It's time to take a deep breath and get ready for the first stage of execution: prototyping. Prototyping should ideally occur in parallel with the prepare phase in order to give you a clearer sense of how long the whole process will take and the level of difficulty or risk involved, allowing you to tweak timelines or take additional steps while still in the prepare phase. Once the migration has been prototyped and planned, you should perform test migrations. This will prove the methodology and should throw up problems earlier rather than later so that you can deal with them without impacting the business. Dealing with problems can mean anything from fixing small issues to deciding to hold fire and moving to plan B. That plan B should already be in place: it could be moving to a mid-life platform as an interim solution or placing the application in a specially protected environment while the problem is worked on. This testing phase should also identify any extra steps you need to take, or any that can be excluded in the final migration, thus optimising the migration process. It will also give you a sense of how long the final migration will take, so be prepared to revise the timetable at this stage and bring in extra pairs of hands if necessary. The final stage of a migration is optimisation. At this point any interim solutions need to be addressed. With the bulk of the migration complete and the business functioning smoothly, now is the time to look at improving any quick and dirty solutions to bring them into line with current compliance and business requirements. 2015 IDC #IDCEB01X 7

IDC RECOMMENDATIONS For many businesses, the final demise of Windows Server 2003 might feel as if Microsoft and the IT department are holding a gun to their heads. It is always preferable to do a major IT upgrade or migration at the time of one's own choosing rather than having it forced on the business. However, the final few weeks of support also provides businesses with an opportunity to stand back and look carefully at their current IT provision and make some decisions that will benefit the organisation well into the future. Organisations have a range of choices from a wholesale hardware and software refit on-premises or a move into the cloud, and any number of options in between those two extremes. While it is possible to purchase extended support from Microsoft, this should only be seen as a bridging solution for an extreme situation as it is not a cheap option. Our recommendations are that organisations start the migration process as soon as possible by following our assess, plan and execute strategy. It is also crucial to have a migration strategy in place that includes longer-term goals related to competitive advantage in IT and the business overall. This major migration is therefore not just an imminent emergency measure but provides substantial opportunities for increasing IT flexibility, security, mobility and efficiency. You may also need to revise your partnership strategies if you don't get sufficient support from your resellers, system integrators or IT vendors, and may consider migrating your infrastructure to vendors with more holistic solutions that could also run the latest processors and have features such as inmemory computing capabilities for further performance boost and peace of mind. Make sure that you have executive support from the start, and make sure the C-suite is fully aware of why the migration needs to happen what the benefits will be and what the implications of not going ahead would be. 2015 IDC #IDCEB01X 8

About IDC International Data Corporation (IDC) is the premier global provider of market intelligence, advisory services, and events for the information technology, telecommunications and consumer technology markets. IDC helps IT professionals, business executives, and the investment community make factbased decisions on technology purchases and business strategy. More than 1,100 IDC analysts provide global, regional, and local expertise on technology and industry opportunities and trends in over 110 countries worldwide. For 50 years, IDC has provided strategic insights to help our clients achieve their key business objectives. IDC is a subsidiary of IDG, the world's leading technology media, research, and events company. Global Headquarters 5 Speen Street Framingham, MA 01701 USA 508.872.8200 Twitter: @IDC idc-insights-community.com www.idc.com Copyright Notice This IDC research document was published as part of an IDC continuous intelligence service, providing written research, analyst interactions, telebriefings, and conferences. Visit www.idc.com to learn more about IDC subscription and consulting services. To view a list of IDC offices worldwide, visit www.idc.com/offices. Please contact the IDC Hotline at 800.343.4952, ext. 7988 (or +1.508.988.7988) or sales@idc.com for information on applying the price of this document toward the purchase of an IDC service or for information on additional copies or Web rights. Copyright 2015 IDC. Reproduction is forbidden unless authorized. All rights reserved.