On 25 May 2004, Microsoft announced plans to extend the support life cycle of current and future nonconsumer products to a minimum of 10 years. The company’s mainstream phase of support will comprise five years, or two years after a successor version ships -- depending on which time frame is longer. The extended support phase will increase to five years. Microsoft plans to support service packs for 12 or 24 months after a successor service pack ships, depending on the complexity of the service pack. The company also announced plans to release patches to critical NTW4 security holes in the event of exploitation.

Microsoft's extension of support for Windows 2000 is good news for enterprises that would like to stay on that operating system (OS) and skip Windows XP. Gartner believes that many enterprises would prefer to skip Windows XP because of the amount of compatibility testing enterprises must do before they bring in a new release. If Longhorn (the code name for Microsoft’s next planned version of Windows) ships in 2006, as Microsoft has indicated, enterprises will have three or four years to migrate from Windows 2000 to the new OS before support for Windows 2000 ends. However, Gartner believes that the Longhorn client will not be available until at least 2007 (0.7 probability).

Given the extended time frame, Gartner recommends that enterprises continue to select Windows XP as new PCs are purchased. Microsoft has not disclosed how much of the security shielding technology planned for XP Service Pack 2 (SP2) will eventually be delivered for Windows 2000. Gartner expects that XP with SP2 will prevent some buffer overrun holes from being exploited, especially on new PCs that include the "no execute" instruction. Enterprises should understand that Windows XP is Microsoft's current "favorite," and is likely to receive better support than older versions of the company’s OS.

Gartner believes that Microsoft's reluctance to release fixes for critical security holes in NTW4 until it sees a serious exploit "in the wild" targeting NTW4 systems is somewhat shortsighted. While the company’s position sends a message that enterprises should eliminate NTW4, making a fix available after an exploit circulates for NTW4 (which has no automatic update capability) could become a PR nightmare for Microsoft. If a major corporation or government agency lands on the front pages after a worm shuts it down, for example, Microsoft will be forced to re-think its policy.

In a Gartner survey in October 2003, more than 20 percent of desktop PCs at respondents' companies were still running NTW4. If Microsoft provided NTW4 with the 10-year support life cycle it offers with other products, NTW4 would be supported into 2006. Because Microsoft will already be creating critical security fixes for enterprise customers paying for customer support through year-end 2005, Gartner recommends that Microsoft proactively make these fixes available to all NTW4 customers. Microsoft indicates that it does not want to give customers a false sense of security that they can patch all NTW4 security holes

Recommendations: Enterprises should continue to eliminate NTW4, and should favor Windows XP on new PCs. Highly risk-averse enterprises can buy custom support from Microsoft to ensure that they receive NT patches after 30 June 2004. Established NTW4 machines should run intrusion prevention products until they are replaced.

Analytical Source: Michael Silver, Gartner Research

Recommended Reading and Related Research

• " Windows XP SP2 Is More Than Your Average Service Pack" — Enterprises should test their applications thoroughly and request that the protection provided to Service Pack 2 be available for Windows 2000. By Michael Silver and John Pescatore
• "Windows Client and Office Migration: 4Q03 Survey" — Enterprises that license Office 2003 should prefer it for new deployments if possible (instead of deploying older versions), but Office 2003 is likely to see the same relatively slow installed-base growth that Office 2000 and Office XP. By Michael Silver

(You may need to sign in or be a Gartner client to access all of this content.)