Are you ready for the end of Windows Server 2003?

Microsoft had to scream from the virtual rooftops to get people’s attention for the end of Windows XP support, and even then, some people didn’t believe it. Microsoft had delayed the end of life for XP so many times, people didn’t think the company would actually do it last April and were caught off guard when Microsoft kept its word.

Now, history is repeating itself with another major end-of-life for a Microsoft operating system. Windows Server 2003 will no longer receive updates or patches come July 14, and apparently some people think Microsoft won’t do it.

“Some customers anticipated [the end of life for Server 2003] would be pushed out,” says Chuck Smith, vice president of strategic growth and business development at HP. “Once we have that conversation with customers and they understand this is coming, there is no hesitation to do something. The real stumbling block is putting a budget in place, and the time window is relatively short. So now we gotta giddy up.”

How aware are customers? Microsoft has been pushing the news to customers, but has accelerated its efforts at driving awareness over the last six months, says Scott Woodgate, director of product marketing on Microsoft’s cloud and enterprise team. It’s being done through partners, systems integrators and directly with customers.

 + ALSO ON NETWORK WORLD What does the end of mainstream Windows 7 support mean for IT | Dell: For Windows Server 2003, the end is closer than you’d think +

Microsoft estimates there are about 10 million Windows Server 2003 deployments out there, and around 64% of those are on physical machines, according to AppZero, a company that specializes in migrating off Server 2003 to newer versions of Windows Server. That means non-virtualized environments where the OS is likely running a single workload, be it file and print, a database or perhaps Exchange.

First step: Conduct a company-wide assessment

But companies are not just replacing old single-core servers from 2005 with new eight-core, four-socket servers and acting like nothing has changed. Woodgate and Smith both say that companies are taking the time to do complete assessments of what they have and are looking at server consolidation, virtualization, and what, if any, apps should be moved to the cloud and what stays on-premises.

“In most cases, customers are rebuilding their infrastructure,” says Woodbridge. “Some apps are 10 years old. They may not understand or take advantage of the latest technologies. So customers can take this as an opportunity to modernize. A line of apps from 2004 won’t understand mobile. So there’s a real opportunity to drive innovation and not just put the same app on a new OS, but really increase the business value of the overall solution by, for example, providing mobile front ends.”

Mike Smith, HP

The process is neither simple nor cheap. Greg O’Connor, CEO of AppZero, says that most Fortune 1000 companies doing migration have anywhere from 500 to 20,000 machines and he’s seen it as high as 30,000 machines. The top three systems integrators he works with have between 80 and 140 migration deals with corporations that have an average of 4,000 machines.

The typical cost for a systems integrator to migrate a Server 2003 machine to Server 2012 is $2,000 to $3,000 per machine, plus two to three times that in hardware and software, said O’Connor. “So you may be into a $100 million project. Realistically you can move 3,000 to 4,000 machines before EOL. If you have 15,000 machines, you are embarking on a five-year project. Many of our partners are still doing XP modernization,” he says.

AppZero has a migration tool that examines a Server 2003 app for Server 2012 compatibility, packages it in a container and migrates it to Server 2012, fixing DLL dependencies along the way. Once the app is found to be stable, the container is “dissolved,” as O’Connor puts it, and the app runs natively on its new OS.

Most stumbling blocks are 16-bit apps or those with kernel drivers. A 16-bit app won’t run on 64-bit Windows Server 2012, and anything that hooks into the 2003 kernel runs the risk of breakage, since the kernel was significantly changed in Server 2008 and again in 2012.

Microsoft provides some tools for discovery, such as Configuration Manager, which is part of System Center. It can scan the whole network and report back all the Server 2003 machines and what each one is running. From there begins the lengthy assessment of what stays and is migrated and what goes.

It’s in this process customers are finding a lot of abandoned or useless apps, according to Smith. Some 20% to 30% of apps are not of functional use and get retired in a process like this, he said. There are also mini apps running on legacy operating systems that are used by as few as two people. These can also be considered for discontinuation (the apps, not the people).

Determine whether apps belong in the cloud or on-premises

One question customers are asking, and Microsoft, HP and other integrators and consultants are encouraging, is whether replacements for Server 2003 are better suited for the cloud than on-premises.

“For every customer, they will have a set of their data center and look for the best opportunities to innovate, or for an opportunity to move to the cloud,” says Woodgate. “They need to go through discovery and assessment procedures and focus on line-of-business apps early, because it will take more time there. However, every customer is running a unique business, so they must go through discovery.”

“I would really advocate virtualization and/or the cloud,’’ said James Conrad, a Windows and security & training expert with CBT Nuggets, which does IT training. “Most Server 2003 deployments were before virtualization and the cloud. Some may want to outsource it by going to the cloud with IaaS or PaaS or SaaS.”

Part of the core assessment of existing workloads is what you are going to do with workloads sitting on Server 2003, said Smith. “It is part of our assessment that some of those workloads should sit in the cloud. So that’s very much a reality. We have significant offerings, Microsoft is an Azure partner for the SMB and mid-market and enterprise. We think most enterprises will have some measure of on-premises requirements and it becomes a hybrid world,” he says.

SMBs have fewer machines, but also less money and skill, and are also more likely to move to the cloud, says Abbott. One beer company moved 100 Server 2003 machines to the cloud. “This could be the catalyst for the move to the cloud for the SMB market,” he adds.

Don’t put your organization at risk of attack

Companies that either don’t believe Microsoft will end support, can’t afford it, or just don’t take the situation seriously put themselves at great risk. Just last month, the Department of Homeland Security issued an alert about the coming end-of-life for Windows Server 2003, warning IT departments that running unsupported software could open businesses up to elevated cybersecurity risks.

An internal poll by Microsoft of business customers found 83% were aware of the EOL, and 70% of them are planning to move before the deadline, according to Woodgate. Of the 30% not moving, some still don’t believe Microsoft will end support in July. For others, it’s just not a priority or their budget for 2015 is already set and they don’t have the funding for the move.

Smith says HP and Microsoft have ways to help companies mitigate budget challenges like lease financing, alternatives in financing and rebates, just to get people moved. “The key consideration we’re hearing is concern about being compliant, especially after all the security issues in the news these days, and all the underlying issues related to security,” says Smith.

He pointed out that Server 2003 received 38 updates in the last 12 months, which means 11 years later, it still has bugs, and no more patches would be bad news for everyone using it.

Running Server 2003 instances on Server 2012 won’t work because Server 2003 is still vulnerable and the security of Server 2012 won’t help, says Woodgate. “There is still considerable risk they are taking [by running 2003]. Not just for an unpatched Server 2003, but their entire organization. Once [hackers] got in they can take over a lot from there. So keeping these unpatched servers around might be the way hackers get into the organization,” he says.

Companies still running Server 2003 this summer will have to work harder on perimeter networks since the OS will not be secured, says Conrad. “It would be like building a brick wall around a straw house. You need to make sure firewalls are secure, intrusion detection systems are secure. You’ll need to make sure someone is monitoring and aware of alerts that show an attempted penetration,” he adds.

But don’t delay for monetary reasons, said O’Connor. While Microsoft will likely make specialized support for Server 2003 available after the deadline, it will be extremely expensive, and custom support doubles in cost every year, he notes. “So do you pay Microsoft more in four years or get it done now? The Fortune 1000 can’t have thousands of machines running on unsupported operating system. Better to pay the piper now,” he says.

Andy Patrizio is a freelance technology writer based in Orange County, California. He’s written for a variety of publications, ranging from Tom’s Guide to Wired to Dr. Dobbs Journal, and has been on staff at IT publications like InternetNews, PC Week and InformationWeek. He can be reached at andypatrizio@gmail.com.