News

Security Patch Support Ends for SQL Server 2008/R2

• By Kurt Mackie
• 07/10/2019

July 9 marked the end of "extended support" for SQL Server 2008 and SQL Server 2008 R2, the last five-year phase of Microsoft's overall 10-year product lifecycle for these products.

The two servers will no longer receive security patches from Microsoft after that date. They'll continue to run, but they're potentially subject to attacks that won't get addressed by Microsoft in the form of patches, unless organizations pay extra.

Oddly, SQL Server 2008 and SQL Server 2008 R2, which were released about two years apart, are both losing support on the same day. It might be expected that SQL Server 2008 R2 would still have some support time remaining. However, they have the same end date because they "share the same major version number: version 10," explained Pedro Lopes, a senior program manager at Microsoft, in a Tuesday announcement. It's an explanation that only makes sense at Microsoft. The rest of the world typically looks to a product's initial release date to estimate these kinds of things.

Extended Support Options
Likely, organizations have already been planning their workload migrations in advance of the July 9 date. This time around, Microsoft added a couple of options for organizations having upgrade difficulties because of application dependencies on using SQL Server 2008 technologies.

Organizations with such dependencies can keep their SQL Server 2008/R2 Standard and Enterprise workloads in their own datacenters and pay for an Extended Security Updates plan, which adds three years of patch support from Microsoft (only "Critical" patches arrive, and there's no technical support). However, these organizations will need to have Software Assurance coverage on these servers, and they'll be paying 75 percent of the full SQL Server licensing costs each year to get the patch support.

Alternatively, organizations with SQL Server 2008/R2 dependencies can move their workloads into a virtual machine hosted on Azure datacenter infrastructure and get free Extended Security Updates support for three years. However, they must pay the costs associated with using the virtual machine (compute, storage, input/output and backup) and Software Assurance is required on the SQL Server licenses. Microsoft sweetens this latter option with its Azure Hybrid Benefit program, which promises a discount of "up to 55 percent" on the Azure virtual machine hosting costs.

Using an Azure virtual machine to host SQL Server 2008 workloads comes with provisioning options using images from the Azure Marketplace, or there's a self-install option, according to this Microsoft blog post. The self-install option will open up a centralized management scenario via the Azure Portal, which will be "coming late-July 2019."

Organizations wanting to find the devil in the Extended Security Updates plan's details can check Microsoft's FAQ on the topic. Microsoft also has an Extended Support product page here.

Azure SQL Database
Of course, Microsoft is touting its Azure SQL Database service as the workload migration goal for SQL Server 2008/R2 users. Azure SQL Database is an "evergreen" database management system, and Microsoft handles the upgrades and patching, so there are no more migrations, Microsoft's Monday announcement explained. The announcement also included some news about two future Azure SQL Database additions.

First, Microsoft is planning to release a preview of a new "Azure SQL" management portal, which "will provide a single pane of glass through which you can manage Azure SQL Databases and SQL Server on Azure Virtual Machines." This preview will be "coming soon."

Second, "later this month," Microsoft is planning to release a preview of a new "Big Data Clusters" capability for SQL Server 2019. The Big Data Clusters preview "combines SQL Server with Apache Spark and Hadoop Distributed File System for a unified data platform that enables analytics and artificial intelligence (AI) over all data, relational and non-relational."

Windows Server 2008 Support
Microsoft this week also gave notice that Windows Server 2008 and Windows Server 2008 R2 both will be reaching their end-of-support date on Jan. 14, 2020. Microsoft's Extended Security Updates program also applies to these products.

There will be an "ask Microsoft anything" session about the Windows Server 2008/R2 end of support on July 30, from 9:00 a.m. to 11:00 a.m. PST. Access this page to get a reminder for the event, where Microsoft staff will answer questions.