Nothing visible changes today, but Windows Server 2003 gets no more security fixes after this month's updates. List everything the server does, move what faces the internet first, and plan to switch it off within months.

The last updates arrive today

Today is the last day Microsoft supports Windows Server 2003. After today's monthly security updates, no more are planned.

Plenty of small offices still run it, often on a tower in a closet: shared folders, printers, the logins for every computer, and sometimes the office email and an old website.

Tomorrow morning it will start, run and share files exactly as it did today. Nothing visible changes.

What changes is slower. Every flaw found from now on stays open, on a machine that is usually connected to everything else in the office.

What it is usually doing

The fourth is the exposed one. A website answers requests from anyone on the internet, so it is where a newly discovered flaw would be tried first.

What changes over the coming months

Attackers do not stop studying old software. Flaws found in newer versions of Windows often exist in 2003 as well, and from now on only the newer versions get fixed.

Makers of antivirus, backup and accounting software will drop it over time, each on its own schedule.

If card payments touch the server, the card industry's security standard, PCI DSS, expects security patches to be applied. A system that can no longer get them cannot meet it.

And the hardware has aged with the software. Most of these machines are well past the age when disks and power supplies start to fail.

The website on it

IIS 6 cannot offer TLS 1.1 or 1.2, the newer versions of the encryption that protects secure pages. It stops at older ones.

The card standard, revised in April, says SSL and early TLS should be gone by the middle of next year. A checkout served from this machine cannot meet that.

Every other secure page on it, such as a login for staff or customers, is stuck with the same older encryption.

The pages themselves can usually move to a newer Windows server, which still understands classic ASP. Old database drivers and components written for 32-bit Windows need checking before the move, not after.

Moving, not upgrading

There is no direct upgrade from 2003 to the current version, Windows Server 2012 R2, which runs only on 64-bit hardware.

So the job is a move, best planned with whoever looks after your website and office computers: each role picked up and set down somewhere else, then the old machine switched off.

Some roles go to a new server in the office. Others no longer need one.

Email can move to a hosted mail service, and the website can move to proper hosting.

Before you touch anything

Write down everything the server does, by walking round the office and asking. The list is usually longer than expected: a scanner that saves to it, a shared calendar, an old fax-to-email setup.

Find the administrator password, the licence keys and the installation files for any software on it. Servers set up by someone who has since left often hold the only copy.

Then check that a backup actually restores. A move is when you find out whether it does.

The order to move things in

Start with what faces the internet: the website, the email and any remote access. Anyone can reach those, so they carry the most risk on an unpatched machine.

Next, the business software, because it needs the most notice. Ask the vendor which server versions it supports now and what a move involves.

Then shared folders and printers, which mostly mean copying files and remapping drives on each computer.

Logins come last. Handing over the Windows domain, the system that decides who can sign in to which computer, affects everyone in the office and is best planned for a quiet evening.

A worked example

A native plant nursery outside a small town grows several hundred species for home gardeners, landscaping crews and restoration projects. Its office server, bought in 2006, ran Small Business Server 2003.

It handled staff logins, shared folders and email. It also served the website, whose plant availability pages were written in classic ASP and read straight from the inventory database on the same machine.

The website was the exposed part, answering the internet from the office's own connection. With spring the busiest season, the owner planned the move for the quieter weeks of late winter.

The website went first, to hosting, with the availability list exported from the inventory system each Monday and published as a page. Email moved to a hosted service the same month.

The inventory and till software went to a new server once its maker confirmed which version it supported, and the shared folders went with it. The old server ran disconnected for a month, then its disks were wiped.

If it cannot move this month

Take it off the internet where you can. Close the firewall openings that expose the website and remote access, and serve the website from somewhere else, even temporarily.

Stop browsing the web or reading email on the server itself. Its browser is as old as the rest of it.

Keep its antivirus current for as long as the maker supports it, and keep a backup stored away from the server. None of this makes it safe; it buys months, not years.

The counter-case

A server on an isolated network, doing one internal job and never touching the internet, carries far less risk than one serving a website. Some offices keep such a machine for an old program while they plan its replacement.

A server nobody uses any more can simply be switched off once its files are copied and checked.

Neither changes the direction. Move each role, starting with whatever faces the internet, and switch the old server off within months.

This week

  1. List every job the server does.
  2. Find the passwords and licence keys.
  3. Test that a backup actually restores.
  4. Move the website and email off it first.
  5. Ask your software vendor about supported servers.
  6. Plan logins and files for a quiet week.
  7. Set a date to switch it off.

Step four cannot wait for a quiet week. The website and email are the parts anyone on the internet can reach, and from today a new flaw in them stays open.

Sites written for the same generation of Windows servers are covered in old ASP pages on a Windows server.

Frequently asked questions

Will my server stop working today?

No. It will start, run and share files exactly as before. What stops is the security fixes, so every flaw found from now on stays open.

What usually runs on these servers?

Shared folders, office logins, printers, sometimes Exchange email from Small Business Server 2003, a website on IIS 6, remote access, and the database behind the accounting or job software.

Can it be upgraded to a newer version?

Not directly. There is no upgrade path from 2003 to Windows Server 2012 R2, which also needs 64-bit hardware, so each role moves somewhere new instead.

What should move off it first?

Whatever faces the internet: the website, email and remote access. Anyone can reach those, so an unpatched flaw there carries the most risk. Logins and files come later.

Does a website on it affect card payments?

It can. IIS 6 cannot offer the newer encryption versions, and the card industry standard expects security patches and the retirement of SSL and early TLS by the middle of next year.

Can I keep it for one old program?

For a short while, if it is taken off the internet and does nothing else. Ask the program's maker what it supports now and plan the move.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Still running Windows Server 2003?

Tell us what the server does. We will list what should move first and where each part can go.

Start a Conversation