2023 Global Report: Ransomware Trends

Ransomware is a problem that everyone has but no one wants to talk about publicly. These are lessons learned from 1,200 victims.
7 Best Practices for Ransomware Recovery

Ransomware is the worst kind of disaster. That’s why reading this white paper on the seven best practices for ransomware is so critical to your organization.

End of Support for Windows Server 2003

At this point you are obviously finished replacing Windows XP (as XP end of support passed on April 8, 2014) with Windows 7 or Windows 8.1. Wait – you’re not even started? Oh… well, you’re in for a fun year ahead. That’s because you’ll soon understand why you shouldn’t let work pile up. You probably have a project ahead of you that will make the XP replacement seem like it was easy. On July 14, 2015, Microsoft will end support for Windows Server 2003 (W2003) and Windows Server 2003 R2 (W2003 R2).

Windows 2003 End of Support: What Does It Mean?

No, W2003 and W2003 R2 won’t suddenly stop working in July 2015. Planes will not fall out of the sky. NASA won’t be launching rockets to resettle humans on far away planets.
Extended support ended in 2010. That’s when Microsoft stopped developing new stuff specifically for W2003 and W2003 R2. All support ends next year for those legacy server OSes. This means you get no more security updates. Tools such as System Center will no longer be supported for managing those old OSs. In other words, running W2003 or W2003 R2 will become a business risk.

Gaining Perspective

Are you thinking “Why is Microsoft doing this to me?” Well, step back for a moment. Microsoft released W2003 12 years ago on April 24, 2003. W2003 R2 was released 10 years ago on December 6, 2005. That’s an eternity in the IT world. How we worked, server hardware, and the challenges/opportunities in 2003 were completely different to what we face now. When we talked about the cloud in 2003, we were likely talking about the weather. Mobile computing was a laptop. Remote connectivity was VPN. Virtualization was for the adventurous. The IT security challenges for businesses were very basic compared to what they are now.
It is a good practice not to delay upgrades until the very last second when panic sets in. Imagine those large banks and government institutions that gave millions of dollars to Microsoft to maintain support for Windows XP beyond the well-advertised end of support date. The IT staff (or consultants) are under pressure to get upgrades completed before their employers/customers are forced to sign up for another year… and give Microsoft another million-plus dollars. Now they hear that the end date for support of W2003 and W2003 R2 is coming up in just over a year’s time. If only they had moved to Windows 7 two years ago! Then they might have had more time to plan the server upgrades/replacements.
End of support is inevitable. It happens with every product. For example, Mac OS X Snow Leopard (10.6) was released on August 28, 2009, and the end of support date was in February 2014. You might not have heard much about that change from Apple, as Apple doesn’t exactly promote the end of the support dates to their customers. This contrasts greatly with Microsoft, who have been reminding customers in meetings and events of the upcoming dates, years in advance, so you have time to prepare. If only more people actually used that time wisely. Linux distributions also have end of support dates, as RedHat has documented.
So you got 10-plus years of life from Windows Server 2003/R2. That’s a pretty good deal. Now it is time to make the move to a newer version of Windows Server. The question you have to ask now is, what version will you upgrade to?

Do You Upgrade or Rebuild?

Upgrading operating systems might seem like the simple option. But there are some concerns including:

Stability: Microsoft has debated disabling the ability to upgrade Windows. This is because a clean installation of Windows always performs and behaves better. Upgrades bring forward old problems. There are too many third-party variables.
Hardware: If you must run a service on physical hardware, then consider whether your hardware is still supported by the manufacturer. Do you have to trawl the auction sites to get spare parts? Would a new install on new hardware not only resolve support issues, but also perform better, consume less electricity, and be easier to manage?
Application Support: If you have a ten-year-old OS, then there’s a good chance that you haven’t upgraded the software that is installed on it. Will that version of Oracle, Apache, SQL Server, Exchange Server, or Honest-Bobs-CRM work on a newer version of Windows Server? You might have a nightmare of a project for each and every server to upgrade dependencies, software, and database schemas.
Time: An in-place upgrade might seem like the quickest option at first, but it might also be the slowest option when you take account of all considerations.
Architecture: W2003 installations were almost always done with the x86 (32-bit) architectures of the OS, even on x64 (64-bit) processors. Windows Server 2008 was the last 32-bit server OS from Microsoft. You cannot upgrade from 32-bit W2003 to a newer 64-bit OS. This limits you in-place upgrades to W2008 (end of extended support on January 14, 2020). It also limits what Microsoft software you can install because mainstream support (development) ends for W2008 on January 13, 2015, and Microsoft normally only releases 64-bit software for servers now.

Note that WS20212 R2 Hyper-V has a live clone feature to allow you to test/document upgrades of virtual machines (guest OS, software, and so on) without affecting production systems.
On the other hand, you can perform clean installations on new (physical or virtual) machines. This gives you some benefits:

New everything: Not only can you upgrade the OS, but you can upgrade or replace older applications/services.
Apply learned knowledge: You’ve learned lots about your services over the years and how best to configure and tune them. You can apply this knowledge on clean installations to get better performing and more stable services.
Get it right: You have the time to prepare the new services before you perform the final migration of data and switch over clients.
New hardware/virtualization: This is a chance to put in new hardware that is supported if you must remain with physical installations. And for those who are switching to virtualization, this is a chance to reduce (yes, reduce!) your licensing and management costs while increasing IT agility.
Go 64-bit: Who doesn’t like more performance, better security, and increased scalability?

You see, making the jump from an old 32-bit server OS to a newer 64-bit server OS doesn’t need to be a bad experience. Planning, documentation, and using the tools that are available to you will make the switch easier, and may even improve the service that you provide to you internal and/or external customers.

What Version to Use and When to Make the Move

We have had several releases of Windows Server since W2003 R2:

Windows Server 2008 (W2008):
Windows Server 2008 R2 (W2008 R2)
Windows Server 2012 (WS2012)
Windows Server 2012 R2 (WS2012 R2)

As I stated later, if you must stick with a 32-bit OS, then you have no choice: You must go with W2008. Please remember that the end of mainstream support is in January 2015, and that means Microsoft will stop making new software and functionality available for that version. Mainstream support also ends for W2008R2 in January 2015. A move to WS2012 or WS2012 R2 makes more sense if you want continued improvement from Microsoft.
And there are those of us in the media that believe a new version of Windows Server (and desktop) will be revealed at TechEd Europe in October for release in early 2015 (around April). My advice: Don’t wait until April to start migrating servers for a July deadline. That would be insane! Instead, make the move to the newest OS that you can, and get Software Assurance (SA) for Windows Server OS and the associated CALs. That will allow you to perform upgrades/migrations in a calm manner when the time comes around to jump to Windows Server vNext.
Many people react poorly when I talk to them about SA. Large enterprises normally are signed up to Enterprise Agreements that feature SA. Select customers can optionally add SA, but they often choose Select to avoid annuity agreements, and therefore don’t have SA. Small/Medium Enterprise (SME) customers can choose between Open, Open Value, and Open Value Subscription (annuity including SA). We have an unusually high percentage of SMEs opting for OVS over Open in Ireland so they don’t face obstacles when upgrading Windows Server (and CALs). Select and Open customers don’t normally have SA and must pay full price to upgrade. Remember: Microsoft is now releasing new versions every 12 to 18 months. And new features are added to the latest version only (the new UI updates are available for WS2012 R2 RDS but not WS2012 RDS). This is a very good time to reconsider your licensing and to take advantage of SA for upgrade rights, which is just one of a long list of benefits.
I will keep my “which version” recommendations simple:

Always go with the newest version of Windows Server that you can. The newest version is always better.
Consider hardware and software support. This might limit how up to date your server OS can be. Try to encourage those vendors with hints of switching to competitors if they are causing difficulties.

Virtualization

Last year my boss sent a link to a story that cause my jaw to hit the desk. A story in ServerWatch claimed that just 51 percent of Intel/AMD servers are virtualized. This was a survey included “midsized and large enterprises in North America and Europe” and “was concluded in December 2012.” That means that lots of enterprises are not taking advantage of the reduced licensing/hardware/support/power/management costs of virtualization and have minimized their agility and business continuity.
If you have old physical servers that you are migrating to a newer 64-bit OS then this must be the time to check whether it is a virtualization candidate. Most servers are candidates. WS2012 R2 Hyper-V will allow VMs with 64 virtual processors (32-64 cores depending on Hyperthreading), 1 TB RAM, and guest-aware NUMA. Well-designed virtual machines can reach 90 percent of the potential of their physical alternatives but with many more benefits that physical installations can never offer.
And don’t forget that you can reduce the cost of your licensing. Windows Server Datacenter edition allows you to install Windows Server on the host and on an unlimited number of virtual machines that are running on that host. If you’re going to have lots of physical servers, then the sums are easy. Forty physical servers will cost $882 each (maximum of two processor sockets), or $35,280. If you virtualized those machines on two clustered dual socket hosts, then the cost of licensing via Windows Server Datacenter would be 2 * $6,155 or $12,310.
If you wanted to buy a third-party virtualization product, then you would have to account for their Hypervisor, virtualization management, service management, and additional costs. If you went with Hyper-V, then the Datacenter license includes the Management OS and Microsoft’s enterprise hypervisor. You can then add System Center Server Management License Datacenter for $3,607 each ($7,214 for two) giving you all of System Center to manage the hosts and all virtual machines on those hosts. Note that these are Open NL prices, which is the most expensive volume license option. License schemes, price bands, the time of year versus target achievements, currency fluctuations, localized special offers, bundles (Server & Cloud Enrollment), and more can all impact the cost.

Migrating to a New Server OS

Microsoft has lots of tools out there to help you migrate to a newer Server Operating System. My advice is that you upgrade to the latest version of Active Directory that you can, ensuring that you have domain and forest functionality upgraded. This opens up lots of features that Windows Server admins have been begging for, many of which have been available to us since W2008 or W2008 R2.
Get started now. Replacing Windows XP is a relative breeze compared to a mass migration of servers. Think about this: How many OS builds have you got? One? Maybe just a few? Now compare that with your servers. Servers are usually bespoke one-off builds. Maybe you have a farm of identical Citrix or web servers. But each group of machines is custom built by hand. You can automate the Server OS deployment. You might even take the time to look at Desired State Configuration to speed up the customization process. But you must start now because this is going to be a process that will take time.