2

The company I’m at currently has over 500 Windows 2003 servers remaining globally in production and even though they have a refresh plan they are working through, they are not going to be done anytime soon. Probably not till mid next year considering some of the 3rd party applications and level of effort to migrate those apps to the new servers.

What I would like to know is if there are any solutions that would help reduce the risk of having these boxes on the network for another year or longer. I understand how bad it is, and management also understands but since I can’t snap my fingers and make them go away, are there any steps I can take to minimize the risk? None are running any web services, just different application servers and a few SQL database servers.

(Someone in the firm mentioned a product designed specifically for protecting W2K3 servers, but their local partner was inaccessible.)

Improve this question
2
  • What risks have you identified? Have you considered paying for extended support from MS for a year to get patches?
    – schroeder ♦
    Commented Apr 21, 2015 at 19:07
  • @schroeder Extended support ends soon for Win2003...
    – makerofthings7
    Commented Apr 21, 2015 at 19:23

1 Answer 1

Reset to default
3

Realistically, the risk reduction options available will most likely not be cost effective. Especially considering those servers may be upgraded within the year.

Two options that come to mind are network segmentation and application white listing.

Symantec has a nice guide entitled, "Windows Server 2003 Migration: A Guide to Effectively Mitigate Risks".

!! SPOILER ALERT !!

They are going to recommend you take advantage of their product offerings to do so. ;)

Improve this answer
2
  • Thanks K1DBLITZ for that link. Also agree with you on segmentation. I was thinking about using GPO and preventing people from running IE or other browsers on the servers, etc.. I like your idea of application white listing on the boxes. Need to look into that a bit more.
    – Strum
    Commented Apr 21, 2015 at 19:45
  • Also i think that you should block everything and every ports you don't need with a good firewall policy, disable/remove any services you don't need to run
    – Freedo
    Commented Apr 22, 2015 at 0:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .