Microsoft has been reminding their customers, for quite a while now, that Window server 2008 and SQL server 2008 will be out of support as per its lifecycle support schedule. With less than a year remaining for the support to expire, many organisations still have their applications hosted on these platforms.

Windows and SQL server 2008 support expires in a year - is that a Threat or Opportunity

Microsoft has been reminding their customers, for quite a while now, that Window server 2008 and SQL server 2008 will be out of support as per its lifecycle support schedule. With less than a year remaining for the support to expire, many organisations still have their applications hosted on these platforms.

What does this mean and why should you act

End of extended support means Microsoft will stop providing any security updates for these products, so any apps hosted on these platforms are vulnerable to security threats. With so many regulations to comply with, and especially with the GDPR in place from 2018, the last thing any organisation want is loss of revenue, reputation resulting from a security breach, hence the need to act now before it is too late.

What options do you have

In 2014, when we were faced with a similar risk - for Windows 2003 and SQL 2005 - we did not have much options. You had to either

a. Upgrade to Windows 2012 OR b. Pay Microsoft to “extend” the extended support OR c. Just pray every day that it is not your organisation in the news for a security breach

Thankfully, it is 2019 and we have much more options and here is a quick summary

1. Do nothing

Given the potential for incidents like WannaCry ransomware attack, this is certainly not an option. Without any commitment from vendors to provide patches for vulnerabilities, you are always at the risk of a security breach when new threats are identified. Time and reputation lost in recovering from a security breach could adversely impact any business.

I still remember that weekend of WannaCry incident, when we had to pull together teams to install the last-minute patch on Windows 2003 servers, for our clients globally. Patches for Win2008 and Win2012 were already released and those servers were updated as part of the patching cycle.

2. Buy more time

Yes, you can get 3 more years of free security updates from Microsoft, if you can find the money and time to migrate all of those 2008 servers to Microsoft public cloud - Azure. With this option, all you are doing is postponing the risk as you still have to spend money and efforts to migrate those apps at a later date. (This option reminds me of how we dumped most of our items in the Garage when we moved to our new home. Though we got some relied on the day we moved, we still had to spend the entire Christmas break sorting and moving things out of Garage, into our new home!)

Microsoft does provide some useful tools to help with the migration, but you still need to evaluate each application and plan the migration to Azure - all in this year!

3. Upgrade to latest Windows 2016 and SQL 2016

This is an option worth considering if you only have few applications that you want to keep beyond 2019 and are already planning to rewrite those applications. Be under no illusion that this is a straight forward project, as you will have to make changes to your application to get it working on the latest OS and DB, that is assuming you still have the knowhow to make changes to those applications.

I was actively involved in a project to migrate Win2003 to Win2012; it took us more than 2 years to rewrite parts of the application, test and migrate to Win2012/SQL2014 and in the end, we still had many servers left in 2003 which could not be upgraded for many reasons!

4. Modernise the landscape through Containerization - my recommendation

With the announcement of Docker Enterprise now supporting Containerization of 2003 and 2008 applications and host them on Windows 2016, with little or very minimal changes to the application, the threat from out-of-support OS/DB suddenly seem like an opportunity to modernise the IT landscape. Docker and Containers have been around for few years, but it is only last year the same technology been used to containerise legacy apps and host them on the newer versions of Windows server OS, and it is worth exploring.

What is Containerization and how do we do it

Containerisation is about packaging your application and all its dependencies together, excluding the OS kernel. For those apps hosted on Win2003/2008, this means that you take one of the base server images provided by Microsoft (windowsservercore, nanoserver…) and add layers of your application components to package them into a single container. Once containerised, you can run this application container on any Windows server 2016 installed with Docker EE, it is that simple!

Why is this -Containerization- such a big deal

1. Reduce your IT footprint and costs

Containers - due to the way in which they are packaged - have much smaller footprint than a virtual machine as it only includes the application and its dependencies, so it requires much less resources to run, manage and of course reduce your IT footprint and licence cost.

2. Increase Availability and Performance of your Apps

With container orchestration tools like Docker Swarm, Kubernetes you can increase availability and performance of your application through features like self-healing, auto-scaling - all of which are available out of the box.

3. Increase Agility

Once you have packaged your application in a container, it presents an opportunity to fully automate your build, test and release process with tools like Jenkins and integrating it with Docker/Kubernetes. With features like auto-deployment of newer container images, you can release application changes as frequently as you wish. That’s true - No more “weekend-only” deployments!

4. Portability - not tied to one server/DC anymore

The process of Containerization ensures you have all the dependent components of your application packaged together, so you could now run these containers literally anywhere i.e. on any Windows server 2016 server on-premise or on your favourite public cloud platform.

What are the next steps

If you haven’t had prior experience with Containers, Docker, Kubernetes in your landscape most of what I mentioned above may feel like - too good to be true. Even for those who have worked with Containers in a Linux environment, the process of Containerizing an app on Win2008 and hosting it on Win2016 server may still be hard to digest!

1. POC in your own landscape

As they say - Proof of pudding is in the eating - so, why not go ahead and do a POC in your own landscape. Select that very application you couldn’t get off 2003 last time around. You could of course build and test the containers on a Windows 10 PC but to get a real feel of some of the benefits I explained above, setup a Docker EE or Kuberntes cluster for testing the containers and the deployment process.

You can get one of these clusters setup in any of the A* or G cloud for less than the cost of a McChicken meal and it gets built before you finish your burger!

2. Build a business case

Containers, like I said, require a fraction of the resources you’ve currently allocated for the VMs. I could boldly say that you’d need only 30% less infrastructure when you Containerise your apps but don’t take my word for it, check it out during POC.

There are also tools available to simplify the process of Containerizing your apps and the efforts will most certainly be less than re-writing parts of application, to make it work on a new Windows 2016 server.

3. Get the migration initiated

Once you are convinced, it is important to get started even with few apps as the clock is ticking. Get the project executed in an Agile way, learn as you migrate apps to your Docker/Kubernetes cluster and improvise along the way.

4. Transition your team and processes too

No point in having modern technologies if your team continue to utilise old methods. Transition the team to a DevOps culture, automate your build, test and deployment processes incrementally. By the end of this project, you’d have modernised not just your landscape but your team too!

Let 2019 be the year, where you did not spend your IT budget just to manage the risks but instead investing on optimising and modernising your IT Infrastructure and team to help your Business stay ahead of the competition.

Good luck.

Sajith Venkit