1

The company I’m at currently has over 500 Windows 2003 servers remaining globally in production and even though they have a refresh plan they are working through, they are not going to be done anytime soon. Probably not till mid next year considering some of the 3rd party applications and level of effort to migrate those apps to the new servers.

What I would like to know is if there are any solutions that would help reduce the risk of having these boxes on the network for another year or longer. I understand how bad it is, and management also understands but since I can’t snap my fingers and make them go away, are there any steps I can take to minimize the risk? None are running any web services, just different application servers and a few SQL database servers.

(Someone in the firm mentioned a product designed specifically for protecting W2K3 servers, but their local partner was inaccessible.)

  • What risks have you identified? Have you considered paying for extended support from MS for a year to get patches? – schroeder Apr 21 '15 at 19:07
  • @schroeder Extended support ends soon for Win2003... – goodguys_activate Apr 21 '15 at 19:23
3

Realistically, the risk reduction options available will most likely not be cost effective. Especially considering those servers may be upgraded within the year.

Two options that come to mind are network segmentation and application white listing.

Symantec has a nice guide entitled, "Windows Server 2003 Migration: A Guide to Effectively Mitigate Risks".

!! SPOILER ALERT !!

They are going to recommend you take advantage of their product offerings to do so. ;)

  • Thanks K1DBLITZ for that link. Also agree with you on segmentation. I was thinking about using GPO and preventing people from running IE or other browsers on the servers, etc.. I like your idea of application white listing on the boxes. Need to look into that a bit more. – Strum Apr 21 '15 at 19:45
  • Also i think that you should block everything and every ports you don't need with a good firewall policy, disable/remove any services you don't need to run – Freedo Apr 22 '15 at 0:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.