Joey on SQL Server

End of Support: SQL Server 2008 and Windows Server 2008 Upgrade Options

It's not 2008 anymore. Joey details the ins and outs of upgrading these aging Microsoft servers, including licensing changes, support options and potential pitfalls.

• By Joey D'Antoni
• 08/07/2019

It was a simpler time. A decade ago, Windows 7 had just been released and Microsoft introduced new versions of its database and server operating system software.

Both SQL Server 2008 and Windows Server 2008 had ground-breaking new features like transparent data encryption and data compression, and massive improvements to existing features like Windows Server Failover Cluster. These products represented big leaps forward and have withstood the test of time for many application stacks.

However, all good things must end. Earlier this summer, SQL Server 2008 and SQL Server 2008 R2 fell out of extended support from Microsoft. Next January, Windows Server 2008 and Windows Server 2008 R2 will go off extended support, as well.

Microsoft, always interested in helping customers move to its Azure cloud platform, has offered three additional years of support -- ending on July 2022 for SQL Server and January 2023 for Windows Server -- to give customers time to move workloads to Azure. Under this Extended Security Updates (ESU) option, Microsoft will continue to provide security updates for the servers without requiring users to have a migration plan in place, the way it did with Windows Server 2003 support in Azure. The other benefit to moving older workloads to the cloud is that subsequent migrations can go a lot easier, since the public cloud provides nearly limitless storage and network bandwidth.

If you don't have the option to move to Azure and you can't upgrade quickly, be prepared to get out your checkbook or run the risk of not having support. What does it mean to not have support? If you call Microsoft customer service and support with a problem, they are going to tell you that you have two choices: upgrade or pound sand. This is a daunting prospect for many organizations.  

This also poses a risk in the event of another major security attack like Spectre and Meltdown, or any of the various major remote desktop vulnerabilities, or the remote code execution bug in SQL Server. If a bug like that happens, it is unlikely that Microsoft will issue a patch for versions that are out of support. While you can purchase an ESU subscription, this requires you to have Software Assurance on those licenses. In many cases, the reason why a customer is still on an older version is because without Software Assurance, they have no upgrade rights.

For those of you who do not have Software Assurance, there is still hope. You can repurchase your existing licenses at current list prices (which, in the case of SQL Server Enterprise Edition, is approximately $7,000 per CPU core), then purchase the software assurance to get ESU. Extended support is an expensive operation.

There are some other options, and Microsoft's policies in the SQL Server support space have become more user-friendly in recent years. Given the rapid product development cycles that the SQL Server teams have pushed since 2014, Microsoft is recommending that software vendors writing applications for SQL Server certify on a compatibility level, rather than a specific version of the software. Support has also been aligned to this model, which alleviates the biggest concern around upgrading: performance degradation. Additionally, the Query Store feature that was introduced in SQL Server 2016 will allow administrators to easily track any queries that have regressed in performance. This mitigates much of the technical risk associated with upgrading.

While the upgrade process is better technically (Windows Server even supports in-place upgrading of cluster nodes from Windows Server 2016 to Windows Server 2019), there are some financial- and vendor-related concerns around upgrading. The financial component is that both SQL Server and Windows Server have changed their licensing models since 2008 to core-based licensing.

On the Windows Server side, this has minimal impact -- until you get over 16 cores, at which point you can incur higher costs. If you have a 2-socket, 24-core server, for example, your Windows Server licenses would cost roughly 50 percent more. However, Windows Server licenses are relatively cheap, and are but a rounding error compared to SQL Server licensing. SQL Server costs roughly $7,000 per core, plus the cost of Software Assurance, which you typically want to purchase. This means you will really need to justify running higher core-count servers.

The vendor-related concerns around upgrading are the biggest limiter I see in the field. Small independent software vendors (ISVs) frequently don't have the resources to test their applications around new versions of SQL Server or Windows Server, or they wait until well after the latest version is released to initiate testing. You have few options in this scenario and none of them are good.

You can pressure the ISV, assuming it is still in business, to certify on the version you would like to use. Your organization should have leverage, since most ISVs charge an annual support fee to their customers. You can also "go rogue" and perform the upgrade without vendor support. Microsoft offers a tool called the Database Experimentation Assistant (DEA) that will identify any incompatibilities. Of course, you can't see all the SQL code or Windows libraries that may be in the compiled vendor code, so this option still carries some risks and probably isn't a good strategy for mission-critical applications.

The final approach is just to stay in place. However, this option is fraught with security and audit risks. With the rapid pace of technical development, having 10-year-old software running critical parts of your enterprise is dangerous and concerning.

It is a challenge to explain to business leaders why they need to spend a decent chunk of money just to get on supported versions of software that may not provide significant business value. But in order protect your customers' and your company's data, you must spend money. This is a good time to recommend moving to Platform as a Service (PaaS) offerings that remove the upgrade management from your responsibilities.

Incidentally, Microsoft's SQL Server team just issued the following heads up regarding SQL Server 2014:

Today we released the final CUs for #SQLServer 2014. No more CUs for that major version of SQL Server.

From now on, I don't want to see any of you deploying that version. Focus on 2016, 2017 or 2019.

Yes, we support 2019 in production. But you need to reach out to us 1st.

— Argenis Fernandez (@DBArgenis) July 30, 2019

As you can see, the wheels keep turning, so building flexibility into your upgrade process is a necessity.