0

An application I support has been installed on Windows Server 2012. The server is to be upgraded to Server 2019 in an in-place upgrade. This is to be done without being tested first.

The application runs a Server and Database which remote clients and redundant servers communicate with. The server has an IIS site which acts as a reverse proxy. Remote clients and servers connect using TLS 1.3 to the local IIS site and the local Server connects to the local IIS site via HTTP.

Could an in-place upgrade of Windows Server 2012 affect the Windows Firewall or IIS in such a way that it interferes with those connections?

EDIT: Are there any specific known changes or losses of configuration in IIS or Windows Firewall when doing an in-place upgrade?

Improve this question

2 Answers 2

Reset to default
2

Everything is possible when upgrading, and more so when you're jumping an intermediate Windows Server version.

I suggest to convert the server to a virtual machine (P2V) and test it first. Especially if this is an important production machine.

See a list of P2V products in Wikipedia Physical-to-Virtual.

Improve this answer
1
  • Yes. This was my idea. I wanted to create a set of networked VM's running the correct version of Windows Server for all the servers we're upgrading, especially as it's for national utilities infrastructure. The Project manager and Lead Engineer have decided to test modifiying our software on Windows 10 VM's and wing the in-place upgrade on site. I guess I should have asked if there are any known specific losses or changes of config as part on in-place upgrades.
    – Flash_Steel
    May 18, 2022 at 12:07
1

I've recently performed an In Place Upgrade of my 2016 Web Server to 2019. I can state that IIS configuration was unaffected, but default firewall rules were completely re-set.

Any firewall rule that I had custom-created was unaffected, but default rules that had been customized were all reset to default. Example: I had SMB and RDP limited to a specific set of source IPs, this was re-set to ALL source IPs once the upgrade was complete.

Definitely back-up all your firewall rules before proceeding, I was unprepared for this after a Google and a read of various guides and whitepapers.

Improve this answer
1
  • Thanks! This is exactly the kind of thing that I was worried about. I'm trying to compile a list of real life examples of things like this going wrong to show the project leads that there is a business case for spending a week testing the in-place upgrade instead of having horrible shocks like this!!
    – Flash_Steel
    May 22, 2022 at 19:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .