# IIS Rescue - Full Content Summary (llms-full.txt) Last updated: 2026-09-18 Site: [iisrescue.com](https://iisrescue.com/) Index file: [iisrescue.com/llms.txt](https://iisrescue.com/llms.txt) IIS Rescue modernizes legacy IIS, classic ASP, and SQL Server websites for small businesses, migrating them to modern cloud hosting. Projects are fixed- price with a zero-downtime cutover and a full documentation handover. Solo operation, project-based, no retainers. This file summarizes every substantive page on the site. Each entry gives the core question the page answers, its main takeaways, and the page's questions and answers reproduced verbatim from the published page. Transactional pages (consultation booking, guide request, download and thank-you pages, and the privacy policy) are excluded. Every path leads to modern cloud hosting. Rehost. Rebuild. Replace. ============================================================================== ## CORE PAGES ============================================================================== ------------------------------------------------------------------------------ ### IIS Website Migration for Small Business URL: [iisrescue.com](https://iisrescue.com/) ------------------------------------------------------------------------------ CORE QUESTION Who migrates a legacy IIS, classic ASP, or SQL Server website for a small business, and how does the process work? KEY TAKEAWAYS - IIS Rescue moves legacy IIS, classic ASP, and SQL Server websites to modern cloud hosting. Every project is fixed-price, tested before go-live, and cut over with zero downtime. - Three paths, chosen during a free consultation: Rehost (same site, safer home), Rebuild (same job, modern engine), Replace (a clean start, nothing lost). - Three phases: Blueprint (a fixed written quote before any work starts), The Build (the new environment built and migrated in parallel at a private staging address, while the old site keeps serving customers), The Switch (the client tests and approves, then traffic moves with no gap in service). - Four commitments on every project: a fixed-price quote, test before go-live, a zero-downtime cutover, and a full documentation handover with no proprietary lock-in. - No monthly retainer or maintenance contract is required. Projects are solo and project-based; the client talks to the person doing the work, start to finish. - Credentials: Microsoft Certified Trainer (MCT), Cloud Systems Engineer currently managing enterprise Microsoft infrastructure, 40 years in Microsoft infrastructure, in IT since 1986. - The recurring situation: the site still works, which is the trap. The server is out of support, the original developer is gone, and the business still depends on the site every day. PAGE SECTIONS The site still works. That's the trap. | Three ways to move an IIS site to the cloud | How a zero-downtime migration works | Real enterprise infrastructure experience. Applied to your legacy site. | Four things every project gets | Questions owners of legacy sites actually ask | Case study: legacy ASP.NET rebuilt on modern cloud infrastructure | Start with a 30-minute conversation. QUESTIONS AND ANSWERS (verbatim from the page) Q: Can you migrate a classic ASP website without rewriting it from scratch? A: Often, yes. Many classic ASP websites can be rehosted to modern Windows cloud hosting, such as Azure App Service, with targeted fixes rather than a full rewrite — not every classic ASP migration to cloud hosting means starting over. When a rewrite genuinely is the better path, you get that recommendation up front — with a fixed quote for both options, not a surprise partway through. Q: Should I rehost or rebuild my legacy IIS site? A: Rehost when the application still does its job and the real problem is the server underneath it — moving the site as-is to modern cloud hosting is the faster, cheaper path. Rebuild when the code itself has become the problem: unmaintainable, undocumented, or blocking features the business needs. The free consultation weighs both against your actual site. If it's a genuine toss-up, you see the trade-offs and a fixed quote for each before deciding. Q: My website runs on Windows Server 2012 or 2016. How urgent is a migration? A: Windows Server 2012 and 2012 R2 support ended in October 2023. Windows Server 2016 left mainstream support in 2022, with extended support ending January 2027. A site on these servers still works — but it no longer gets the protection a public-facing website needs indefinitely. It's a plan-now situation, not a panic-now one. Planning while the old server still runs is exactly what makes a zero-downtime migration possible. There's more detail on each deadline in the articles on migrating off Windows Server 2012 R2 and the January 2027 Windows Server 2016 deadline. Q: What happens when my SQL Server or SQL Server Express version reaches end of life? A: The database keeps running, but security patches stop — and compliance or cyber-insurance requirements often stop being met. SQL Server 2012, 2014, and now 2016 are all past end of support — SQL Server 2016 reached its extended-support date on July 14, 2026. The usual fix is migrating to a modern managed platform — Azure SQL Database, a current SQL Server version, or PostgreSQL if the application is being rebuilt on a different stack. Your schema and data move over, and the application is updated and tested against the new database before anything goes live. Q: How do you move an IIS site to the cloud without downtime? A: The new environment is built and tested in parallel while your existing site keeps running untouched. You approve the new site at a staging address. Go-live is a DNS cutover with a final data sync — visitors are directed to the new site while the old one still answers, so there's no gap. The old server is retired only after the new site is verified in production. Q: What does an IIS website migration cost? A: Every project gets a fixed-price quote after a free consultation and a look at the existing site. The quote is the price — no hourly meters, no change-order surprises for anything in the agreed scope. Ongoing cloud hosting costs are itemized separately and paid by you directly to the provider, so there's no markup and no dependency. Q: Do I need a monthly retainer or maintenance contract afterward? A: No. IIS Rescue is project-based by design. Every project ends with a full documentation handover — hosting details, where credentials live, architecture notes, and how-to steps — so any competent IT provider can maintain the site after handover. No proprietary lock-in, no mystery systems. Q: What if I no longer have the source code or access to the old server? A: This is common and usually solvable. Depending on what still exists, the site can be recovered from the server itself, from hosting-provider backups, or reconstructed from the live site and database. The consultation establishes what access exists before any quote is given, so recovery work is scoped honestly. Q: What if I still have questions before booking a consultation? A: Not everyone's ready for a 30-minute call right away. If you'd rather ask something specific first, use the quick contact form on the Contact page — it goes straight to a real inbox, no auto-responder, no sales sequence. Or download the free IIS migration guide below, which covers most of what people ask before booking. ------------------------------------------------------------------------------ ### IIS Migration: Rehost vs Rebuild vs Replace URL: [iisrescue.com/iis-migration-rehost-rebuild-replace.html](https://iisrescue.com/iis-migration-rehost-rebuild-replace.html) Published: 2026-07-14 | Last updated: 2026-07-29 ------------------------------------------------------------------------------ CORE QUESTION Should a legacy IIS site be rehosted, rebuilt, or replaced, and how do you tell which one fits? KEY TAKEAWAYS - Rehost moves the application and database as-is onto modern infrastructure with no application code changes. Best fit when the application logic is sound and the urgency is really about the infrastructure underneath it. - Rebuild keeps the site's purpose and data while replacing the application layer with something current, preserving or redirecting existing URLs. Best fit when the code itself has become the bottleneck. - Replace takes two forms. Retire: a site that never needed a dynamic backend becomes plain HTML, CSS and JavaScript on static hosting, with forms handled by the platform. Swap: unmaintained off-the-shelf software moves to a currently supported product. - The decision comes down to where the actual problem lives - the server (rehost), the code (rebuild), or neither (replace). - Extended support ending does not mean the server stops working. It means security patches for newly discovered vulnerabilities stop shipping unless Extended Security Updates are bought separately. - Rehosting a bad application just moves the bad application somewhere newer. Rebuilding when a rehost would do is expensive overkill. KEY FACTS Microsoft end-of-support dates cited on this page (mainstream ended / extended ends): Windows Server 2012 October 9, 2018 / October 10, 2023 Windows Server 2012 R2 October 9, 2018 / October 10, 2023 Windows Server 2016 January 11, 2022 / January 12, 2027 Windows Server 2019 January 9, 2024 / January 9, 2029 Windows Server 2022 October 13, 2026 / October 14, 2031 SQL Server 2012 July 11, 2017 / July 12, 2022 SQL Server 2014 July 9, 2019 / July 9, 2024 SQL Server 2016 July 13, 2021 / July 14, 2026 SQL Server 2017 October 11, 2022 / October 12, 2027 PAGE SECTIONS What each path actually means | The three paths, side by side | End-of- support timeline reference | How to decide which path fits | Further reading | Frequently asked questions | Migration advice from someone who still does this for a living. | Ready to talk through your specific site? QUESTIONS AND ANSWERS (verbatim from the page) Q: How long does an IIS rehost typically take? A: Most rehosts run one to three weeks from kickoff to cutover. The timeline is mostly bound by how much cleanup the existing environment needs — undocumented dependencies, custom IIS modules, or unusual database configurations add time. A straightforward ASP.NET app with a single SQL Server database is often the fastest of the three paths, since no application code is being rewritten. Q: Can I rebuild a classic ASP site without losing data? A: Yes — the data and the code are handled separately. The database is migrated, and typically cleaned and validated in the process, independent of what the new application looks like. The old system keeps running untouched throughout, so there's no window where data only exists in a half-migrated state. Q: What does it cost to migrate off IIS? A: It depends on the path and the state of the existing site, which is why every project gets a fixed-price quote after a free consultation rather than a generic number. As a rule of thumb, rehosts are typically the least expensive of the three paths since no application code changes; rebuilds cost more in proportion to how much of the application needs to be reconstructed; replacements are usually the cheapest to run afterward, since there's no server or database to keep paying for. Q: Do I need to migrate IIS and SQL Server at the same time? A: Not necessarily, but it's usually simpler to. If the application and database are tightly coupled — most are — migrating them together avoids running a bridge configuration where a modernized app talks back to an aging on-premises database, which reintroduces the exact reliability and security problems the migration is meant to fix. In some cases, particularly rehosts, it can make sense to stage the database first. Q: Can I test the new environment before switching over? A: Yes, always. The new environment is built and populated in parallel with the existing site, at a private staging address, while the old site keeps running untouched. You review and approve it there. Nothing goes live, and no DNS changes happen, until you sign off. Q: What happens to my domain and email during migration? A: Nothing, unless email is specifically part of the migration scope. DNS is only touched at the final cutover step, and only the records needed to point the website at its new home — mail routing is left alone unless you ask otherwise. If email is hosted on the same aging server, as with on-premises Exchange, that's scoped and discussed separately during the consultation. ------------------------------------------------------------------------------ ### Fixed-Price IIS & Classic ASP Migration for Small Business URL: [iisrescue.com/fixed-price-iis-classic-asp-migration](https://iisrescue.com/fixed-price-iis-classic-asp-migration) ------------------------------------------------------------------------------ CORE QUESTION Who do you hire to migrate a legacy IIS or classic ASP website to modern cloud hosting for a small business, and how is the work priced? KEY TAKEAWAYS - IIS Rescue migrations are fixed-price - you get the number before work starts. The quote is the price, with no hourly billing and no change orders for anything within the agreed scope. - Every migration is zero-downtime: the new site is built and tested before go-live, then switched over by DNS cutover with a final data sync. - No monthly retainer or maintenance contract is required. Every project ends with a full documentation handover so any competent IT provider can take over. - Classic ASP is the hardest case in this category and the one most providers decline. It is the work IIS Rescue is built around. - Three paths: Rehost (same site, safer home), Rebuild (same job, modern engine), Replace (a clean start, nothing lost). - Scoping is free and carries no obligation. Cloud hosting is billed to the client directly by the provider - no markup, no reselling, no dependency. - Three typical triggers: a host or insurer says the server is out of support; the original developer is gone; or the owner would rather handle a known risk as a planned project than as an emergency. - Rough ordering: rehosts are typically least expensive since no application code changes; rebuilds cost more in proportion to how much is reconstructed; replacements are usually cheapest to run afterward. PAGE SECTIONS Fixed-price, zero-downtime migration: classic ASP to modern cloud hosting for small business | Classic ASP migration services for small business | IIS classic ASP cloud migration | Who this is for | How it works | What it costs | Frequently asked questions | Migration advice from someone who still does this for a living. | Get the number before you commit to anything. QUESTIONS AND ANSWERS (verbatim from the page) Q: How much does it cost to migrate a classic ASP website? A: Every project is quoted at a fixed price after a free scoping call and a look at the existing site, so you have the number before any work starts. The quote is the price — no hourly meters and no change-order surprises for anything within the agreed scope. Ongoing cloud hosting is billed separately and paid by you directly to the provider, so there is no markup and no dependency on IIS Rescue afterward. Q: Can you migrate my site without rewriting it? A: Often, yes. That is a rehost: the existing IIS site and SQL Server database move as-is onto managed cloud hosting with no application code changes, so the site keeps the same pages, the same login screen, and the same behaviour. A rewrite is only recommended when the code itself is the liability rather than the server, and in that case you get both options priced before deciding. Q: Can I test the new site before switching over? A: Yes, always. The new environment is built and populated in parallel with your existing site, at a private staging address, while the old site keeps running untouched. You click through it and sign off. Nothing goes live, and no DNS changes happen, until you approve it. Q: Do I need to migrate IIS and SQL Server at the same time? A: Not necessarily, but it is usually simpler to. If the application and database are tightly coupled — most are — migrating them together avoids running a bridge configuration where a modernized app talks back to an aging on-premises database, which reintroduces the exact problems the migration is meant to fix. In some cases, particularly rehosts, it can make sense to stage the database first. Q: What if my original developer is gone? A: This is one of the most common reasons people get in touch, and it is usually solvable. Depending on what still exists, the site can be recovered from the server itself, from hosting-provider backups, or reconstructed from the live site and its database. The scoping call establishes what access and source actually exist before any quote is given, so recovery work is priced honestly rather than discovered halfway through. Q: Is a monthly retainer required after the migration? A: No. No monthly retainer or maintenance contract is required. IIS Rescue is project-based by design, and every project ends with a full documentation handover — hosting details, where credentials live, architecture notes, and how-to steps — so any competent IT provider can maintain the site afterward. ------------------------------------------------------------------------------ ### Who's Behind IIS Rescue URL: [iisrescue.com/about](https://iisrescue.com/about) ------------------------------------------------------------------------------ CORE QUESTION Who actually runs IIS Rescue, and what are their credentials? KEY TAKEAWAYS - IIS Rescue is run by Steve Buckner. It is a solo, project-based operation: the person who scopes the project is the person who runs it. - In IT since 1986 - 40 years. A Microsoft Certified Trainer for over 20 years, meaning Microsoft has credentialed him to teach other engineers this material, not only to apply it. - Works as a cloud systems engineer managing enterprise Microsoft infrastructure as a day job, so migration estimates come from current practice rather than from a template. - Personally deployed, patched and decommissioned the generation of servers this business now migrates. - Current Microsoft certifications: Azure Solutions Architect Expert; Microsoft 365 Certified Administrator Expert; Azure Administrator Associate; Security Operations Analyst Associate; Azure Virtual Desktop Specialty; plus Microsoft Certified Trainer (MCT). - The full record - nine current certifications and thirty-three exams passed - is published by Microsoft, not self-asserted. - A growing part of the work is responsible AI adoption, through the AI Rollout Framework. VERIFICATION Microsoft Learn transcript: [learn.microsoft.com/en-us/users/azuresteven/transcript/dg129ho6ko96o92](https://learn.microsoft.com/en-us/users/azuresteven/transcript/dg129ho6ko96o92) Credly badges: https://www.credly.com/users/steve-buckner/badges/credly LinkedIn: https://www.linkedin.com/in/it-steve/ PAGE SECTIONS Who's behind IIS Rescue | The credentials, for what they are worth | Where this is heading | What that means for your project ------------------------------------------------------------------------------ ### The Two-Minute Assessment URL: [iisrescue.com/two-minute-assessment](https://iisrescue.com/two-minute-assessment) ------------------------------------------------------------------------------ CORE QUESTION Which path does one specific legacy IIS website need - rehost, rebuild or replace - and how is that call actually made? WHAT IT IS The two-minute assessment is IIS Rescue's diagnostic for legacy Windows websites: it asks six plain-language questions about one specific site — what the site is built with, what it runs on, what holds its data, whether the source code still exists, what non-web components it depends on, and what the business needs from it next — and recommends one of three paths, rehost, rebuild or replace. It shows its reasoning, the risks those answers imply, and what moves a fixed price. It returns an estimate, not a quote. It is a rules engine, not a language model. The same six answers always produce the same recommendation, and the "why" on screen is a readout of which rules fired rather than a paraphrase of one — so there is nothing on a page making commercial claims that can improvise. The same engine answers AI assistants at iisrescue.com/mcp as a callable tool. An agent asking on a client's behalf gets the identical recommendation, risks and reasoning, structured for it to relay, because a human and an agent cannot be told two different things when there is only one implementation of the answer. It publishes no price. Every IIS Rescue project is quoted at one fixed number, in writing, after a free scoping call, and a tool that guessed at that number from six answers would be guessing at the one thing the practice promises not to guess at. What it does name is what pushes a price up or down, which is the part worth knowing before the call. KEY TAKEAWAYS - Six questions, about two minutes, no email address and no contact details. The answers stay in the browser; nothing is sent anywhere. - The six inputs are: what the site is built with, what it runs on, what holds its data, whether the source code still exists, what non-web components it depends on, and what the business needs from it next. - "Not sure" is a valid answer to every question. It lowers the confidence figure and names the unknown most worth resolving; it does not break the result. - It is a rules engine, not a language model: identical answers always give an identical recommendation, and the reasoning shown is a readout of which rules fired. - It returns no price figure. IIS Rescue publishes no rate card and quotes one fixed number in writing after a free scoping call. The assessment names what moves that number instead. - Some of the logic is counter-intuitive and deliberately so. Missing source code pushes against a rebuild rather than toward one, because there is nothing to rebuild from except the running site's behaviour. Unaccounted- for custom components push against retiring the site, because nobody can switch off what nobody has identified. - Confidence is capped when the top two paths are close, however few unknowns there were: a genuine toss-up is not a confident answer. - Internal/engineering name: Pathfinder. That is the name in the codebase and in the MCP tool ids (get_pathfinder_questions, run_pathfinder). "The two-minute assessment" is the public product name. One engine, two names. CALLABLE BY AGENTS The same engine is exposed at https://iisrescue.com/mcp as the MCP tool run_pathfinder, with get_pathfinder_questions returning the six questions and their allowed answers. It is the same implementation the page runs, not a second version of it, so an agent and a person cannot be told two different things about the same site. Automated checks diff both faces over a fixed scenario set and fail the build on any difference. PAGE SECTIONS The assessment itself | What this is | How the call gets made QUESTIONS AND ANSWERS (verbatim from the page) Q: What is the two-minute assessment? A: The two-minute assessment is IIS Rescue's diagnostic for legacy Windows websites. It asks six plain-language questions about one specific site — what the site is built with, what it runs on, what holds its data, whether the source code still exists, what non-web components it depends on, and what the business needs from it next — and recommends one of three paths: rehost, rebuild or replace. It is free, it asks for no email address or contact details, and the answers stay in the browser. It returns an estimate and the reasoning behind it, never a price: every IIS Rescue project is quoted at one fixed number, in writing, after a free scoping call. Q: How do I know if I should rehost or rebuild my old website? A: It comes down to where the actual problem lives. If the application still does its job and the thing forcing your hand is the server underneath it, that is a rehost — the site moves as-is onto supported hosting and the code is left alone. If the code itself has become the problem, because it cannot be changed safely or it blocks something the business now needs, that is a rebuild. The question that settles it fastest is what you need from the site going forward, not what it is built with. “Just get it off the dying server” and “it needs to be a properly modern application again” lead to different paths from identical technology. The two-minute assessment asks that question last and weighs it heavily for exactly that reason. Q: How does the two-minute assessment decide between rehost, rebuild and replace? A: Each answer carries weight toward one or more of the three paths, and the path with the most weight wins. Older platforms and intact source code lean toward a rebuild being feasible; a site that still works with no appetite for change leans toward a rehost; no database and no application logic leans toward replacing the whole arrangement with something simpler. A second pass then applies rules that override the raw arithmetic where experience says it would be wrong. Missing source code, for instance, pushes hard against a rebuild rather than toward one. Several unaccounted-for custom components push against replacing the site outright, because nobody can retire what nobody has identified yet. Nothing about it is generated language. It is a rules engine, so the same six answers always produce the same recommendation, and the reasoning shown on screen is a readout of which rules fired rather than a description of them. Q: What questions does the two-minute assessment ask about my website? A: Six: what the website is built with (classic ASP, ASP.NET Web Forms, newer .NET, mostly static pages, or a mix added to over many years); what it is running on; what holds the data; whether the source code still exists; whether there are COM objects, custom IIS modules, ISAPI filters or scheduled tasks behind it; and what you need from the site going forward. None of them require looking anything up. File extensions usually answer the first one — .asp, .aspx, or plain .html — and if nobody has logged into the server in years, that is itself an answer to the second. Q: What if I do not know what my website is built with or what server it is running on? A: “Not sure” is a valid answer to every one of the six questions, and choosing it is not a failure state. The assessment still returns a path; it just returns it with lower confidence, and it names the specific unknown most worth resolving rather than guessing at it. Confidence is mostly the proportion of the picture that is actually known, so the questions that move it most are the heavy ones — what the site is built with, whether the source code exists, and what custom components it depends on. Three or more “not sure” answers drops the confidence further still and says so plainly: at that point the result is a starting point rather than a call. Q: Does not having the original source code mean my website has to be rebuilt? A: Usually the opposite. With no source code there is nothing to rebuild from except the running site's observable behaviour, which makes a rebuild the expensive path rather than the cheap one. Rehosting what is actually running on the server is generally the sensible move instead. It does add discovery work, and discovery is the part of a project that moves a fixed price most — which is why it is worth checking whether the code exists before a scoping call rather than during one. Q: My old website depends on COM objects and scheduled tasks. Does that rule out moving it? A: No, but it changes the shape of the job and it is the classic reason a migration stalls. Some COM objects are 32-bit, some are undocumented, and managed hosting platforms will not run them as-is — so they have to be identified before anything can move, and that discovery gets priced in. It also argues against retiring the software altogether. If components nobody can fully account for are still running, something elsewhere in the business may quietly depend on them, and that needs confirming before the legacy software is switched off. Q: Is there a tool that tells me whether my classic ASP site needs rewriting? A: The two-minute assessment is one, and it will tell you when the answer is no. There is no automated converter that turns classic ASP into modern .NET — VBScript, COM data access and Session state have no mechanical equivalent — so a rewrite is a genuine rebuild whenever it is the right call. It often is not the right call. Classic ASP still runs on current, supported Windows, so moving the site to supported hosting without touching the code is a legitimate option. It buys time rather than fixing the platform, which is worth deciding deliberately rather than by default. Q: Why does the two-minute assessment not give me a price? A: Because IIS Rescue publishes no rate card, and a tool that guessed at a number from six answers would be guessing at the one thing the practice promises not to guess at. Every project is quoted at one fixed figure, in writing, after a free scoping call, and that figure does not move afterward. What the assessment does name is what pushes a price up or down on your specific site — missing source code, unidentified components, homegrown data storage — which is the part you can act on before the call. Q: How accurate is a migration recommendation based on six questions? A: Accurate enough to plan around, and explicit about when it is not. The result carries a confidence figure derived from how much of the picture the answers actually cover, and it is capped deliberately when the top two paths are close — a genuine toss-up between two paths cannot return a confident answer however few unknowns there were. At high confidence it says the signals point one way and nothing argues against it. Lower down it names the one thing left to pin down, and at the bottom it says outright that this is a starting point rather than a call. It is an estimate, not a quote: nobody can responsibly commit to a fixed number from six answers on a web page. Q: Can I get a migration recommendation without talking to a salesperson? A: Yes — that is what the two-minute assessment is for. It asks for no name, no email address and no company details, nothing is sent anywhere, and there is no follow-up because there is nothing to follow up with. The result is the result. A free 30-minute scoping call is the next step if you want the fixed price, but it is a step you take when you choose to, with the path already named and the open questions already known. Q: Can an AI assistant run the two-minute assessment for me? A: Yes. The same engine is exposed to AI assistants at iisrescue.com/mcp as a callable tool, so an agent can ask you the six questions and get back the recommendation, the confidence level, the alternatives, the risks and the reasoning, structured for it to relay. It is the same implementation the page runs, not a second version of it, so an agent and a person cannot be told two different things about the same site. Automated checks compare both faces over a fixed set of scenarios and fail the build on any difference. ============================================================================== ## CASE STUDIES ============================================================================== ------------------------------------------------------------------------------ ### IIS Migration Case Studies URL: [iisrescue.com/case-studies.html](https://iisrescue.com/case-studies.html) ------------------------------------------------------------------------------ CORE QUESTION What legacy IIS migration projects has IIS Rescue actually completed, and what were the results? KEY TAKEAWAYS - Three documented projects, one per path. Every completed project is documented the same way: the starting stack, the path chosen, and the measured result. No vague testimonials, no invented numbers. - Rehost - manufacturing: a decade-old production scheduling and inventory system lifted to Azure with no application code changes. Disaster recovery established, capital hardware spend avoided, cutover completed in a single planned window. - Rebuild - direct-response marketing: a customer acquisition platform on Windows Server 2008 and classic ASP.NET rebuilt on a modern JavaScript frontend and PostgreSQL while registrations kept flowing. Three weeks, near-zero downtime. - Replace - transportation and logistics: an unsupported internal wiki platform replaced outright with a current, actively maintained alternative on Azure. Four weeks, zero downtime. PAGE SECTIONS Your site could be the next write-up. ------------------------------------------------------------------------------ ### IIS Rehost to Azure Case Study URL: [iisrescue.com/case-study-3.html](https://iisrescue.com/case-study-3.html) ------------------------------------------------------------------------------ CORE QUESTION What does a straight IIS rehost to Azure look like, with no application code changes? KEY TAKEAWAYS - Client: a manufacturing company of roughly 350 employees. Path: Rehost. Project length: 5 weeks. Downtime at cutover: 3 hours (planned). - Before: a decade-old custom line-of-business application handling production scheduling, inventory and order processing, on Windows Server 2012 R2 with IIS 8.5 and SQL Server 2012, hosted on VMware with local SAN storage. - After: Azure Virtual Machines running the same application with no code changes; the database on Azure SQL Managed Instance; Azure Backup and Site Recovery plus Network Security Groups. - The application was stable and nobody was asking for new features. The liability was the aging hardware and limited disaster recovery, not the code - which is what made rehost the clear fit. - Result: aging-hardware risk removed without a new capital hardware purchase, disaster recovery genuinely addressed, and a cloud foundation that can be modernized incrementally later. PAGE SECTIONS The situation | Before and after | The approach | The result | Related case studies | Your site could be the next write-up. ------------------------------------------------------------------------------ ### Legacy ASP.NET to Cloud Migration Case Study URL: [iisrescue.com/case-study.html](https://iisrescue.com/case-study.html) ------------------------------------------------------------------------------ CORE QUESTION What does a rebuild of a legacy ASP.NET platform involve, and can the business keep operating during it? KEY TAKEAWAYS - Client: a direct-response marketing company building subscription-based financial protection programs. Path: Rebuild. Project length: 3 weeks. Downtime at cutover: near-zero. - Before: an on-premises Windows Server 2008 environment, IIS 7 hosting a proprietary ASP.NET application, on-premises Exchange handling email integration, and a SQL Server 2008 database approaching end of support. Deployments were manual. - After: Netlify managed cloud hosting, a modern JavaScript frontend with a lightweight API, PostgreSQL with data cleaned and validated during migration, and an automated deployment pipeline with monitoring. - Rather than lifting the existing application onto another Windows server, the platform was rebuilt on modern architecture: records were cleaned and validated during the move rather than copied over as-is. - The business kept accepting new customer registrations throughout the transition. PAGE SECTIONS The situation | Before and after | The approach | The result | Related case studies | Your site could be the next write-up. ------------------------------------------------------------------------------ ### Legacy Knowledge Base Migration to Azure Case Study URL: [iisrescue.com/case-study-2.html](https://iisrescue.com/case-study-2.html) ------------------------------------------------------------------------------ CORE QUESTION When is replacing unsupported off-the-shelf software better than rehosting or rebuilding it? KEY TAKEAWAYS - Client: a transportation and logistics company of roughly 200 employees. Path: Replace (swap). Project length: 4 weeks. Downtime at cutover: zero. - Before: an internal knowledge base wiki on IIS 8 on a single on-premises server, backed by a SQL Server 2008 R2 database already past end of support, with local accounts and no real disaster recovery. - After: a current, actively maintained wiki platform deployed via Azure Container Instances, the database on a managed Azure database service, and user identity moved to Microsoft Entra ID. - The reasoning: continuing to build on the old wiki software, regardless of where it was hosted, would have meant inheriting its existing security gaps. Replacing closed those gaps at the source instead of carrying them forward onto newer infrastructure. - Security posture improved by removing the software that carried the risk, not just by moving it to newer hardware. PAGE SECTIONS The situation | Before and after | The approach | The result | Related case studies | Your site could be the next write-up. ============================================================================== ## END-OF-SUPPORT DEADLINES ============================================================================== ------------------------------------------------------------------------------ ### Windows Server 2012 R2 End of Life: What It Means for Your Website URL: [iisrescue.com/windows-server-2012-end-of-life-website](https://iisrescue.com/windows-server-2012-end-of-life-website) Published: 2026-08-27 | Last updated: 2026-08-27 ------------------------------------------------------------------------------ CORE QUESTION Windows Server 2012 R2 is out of support - what does that actually mean for the website running on it, and what should the owner do about it? KEY TAKEAWAYS - Extended support for Windows Server 2012 and 2012 R2 ended October 10, 2023. Paid Extended Security Updates end October 13, 2026, after which no security patch exists at any price. - Nothing breaks on the date itself. The server keeps running and the site keeps serving pages - the risk accumulates quietly, which is exactly what makes it easy to leave too long. - Almost every other treatment of this topic frames it as a server problem. On a 2012-era box the website is an IIS site, often classic ASP or ASP.NET, usually talking to a SQL Server database beside it - and those are what make the migration a project rather than a checkbox. - Three specifics the server-focused advice omits: the application is usually older than the operating system; IIS configuration (bindings, app pools, rewrite rules, hand-installed certificates) lives on the server and not in source control; and the database usually has its own expired deadline. - Three concrete risks: security patches stop, compliance and audit requirements fail, and cyber-insurance renewal gets harder or more expensive. A slower cost is that fewer people are willing to touch the server the longer it runs. - The route off is Rehost, Rebuild, or Replace - all ending at modern cloud hosting with no box left to patch. KEY FACTS Microsoft end-of-support dates cited on this page (mainstream ended / extended ends): Windows Server 2012 October 9, 2018 / October 10, 2023 Windows Server 2012 R2 October 9, 2018 / October 10, 2023 Windows Server 2016 January 11, 2022 / January 12, 2027 Windows Server 2019 January 9, 2024 / January 9, 2029 Windows Server 2022 October 13, 2026 / October 14, 2031 SQL Server 2012 July 11, 2017 / July 12, 2022 SQL Server 2014 July 9, 2019 / July 9, 2024 SQL Server 2016 July 13, 2021 / July 14, 2026 SQL Server 2017 October 11, 2022 / October 12, 2027 Paid ESU for Windows Server 2012 / 2012 R2 ends October 13, 2026. PAGE SECTIONS Quick answers | The dates, from Microsoft | What this means for your website | What actually goes wrong | What to do about it | Frequently asked questions | Migration advice from someone who still does this for a living. | Still running on Windows Server 2012? QUESTIONS AND ANSWERS (verbatim from the page) Q: Is Windows Server 2012 R2 still supported? A: No. Extended support for Windows Server 2012 and Windows Server 2012 R2 ended on October 10, 2023. Paid Extended Security Updates run out on October 13, 2026, after which there are no security patches at any price. Q: Is my website at risk if it runs on Windows Server 2012? A: Yes. Newly discovered vulnerabilities in the operating system and in IIS stop being patched, which leaves a public-facing website permanently exposed. It also causes failed compliance audits and can make cyber-insurance renewal harder or more expensive. Q: What should I do about it? A: Move the website to modern cloud hosting. There are three paths — Rehost, Rebuild, or Replace — and which one fits depends on whether the real problem is the server, the code, or neither. Q: How much does it cost and how long does it take? A: Every migration is quoted at a fixed price after a free scoping call, so you have the number before any work starts. Most rehosts run one to three weeks from kickoff to cutover; rebuilds take longer in proportion to how much of the application has to be reconstructed. Q: What happens to my website when SQL Server 2016 reaches end of life? A: SQL Server 2016 reached its extended-support date on July 14, 2026, so that has already happened. The database keeps running and the website keeps working, but security patches stop, and compliance and cyber-insurance requirements often stop being met. The usual fix is migrating the database to a modern managed platform — Azure SQL Database, a current SQL Server version, or PostgreSQL if the application is being rebuilt on a different stack. Q: Do I have to migrate before October 2026? A: Nothing breaks on the date itself. October 13, 2026 is when paid Extended Security Updates for Windows Server 2012 and 2012 R2 stop, which means it becomes the point after which no security patch exists at any price. Migrating before then is what keeps it a planned project rather than an emergency. Q: Can I keep my site exactly as it is? A: Usually yes. A rehost moves the existing IIS site and SQL Server database onto modern cloud hosting with no application code changes — same pages, same login screen, same behaviour, just no longer running on an unsupported server. Keeping the site as it is and keeping the server as it is are two different questions, and only the second one has a deadline. Q: Does my website stop working when Windows Server 2012 reaches end of life? A: No. The server keeps running and the website keeps serving pages. End of support means Microsoft stops shipping security patches for newly discovered vulnerabilities — the risk accumulates quietly rather than announcing itself, which is exactly what makes it easy to leave too long. ------------------------------------------------------------------------------ ### SQL Server 2016 End of Support: What Changes Now URL: [iisrescue.com/sql-server-2016-end-of-support.html](https://iisrescue.com/sql-server-2016-end-of-support.html) Published: 2026-07-29 | Last updated: 2026-07-29 ------------------------------------------------------------------------------ CORE QUESTION SQL Server 2016 extended support ended July 14, 2026 - what actually changes, and where can the database go? KEY TAKEAWAYS - Mainstream support ended July 13, 2021; extended support ended July 14, 2026. Nothing stopped working on the day - every query that ran on July 13 ran identically on July 15. - What ended is security patches for newly discovered vulnerabilities. The practical risk is not that the database breaks; it is that a vulnerability gets published and an unpatched instance stays vulnerable indefinitely. - ESU for SQL Server 2016 runs in three annual windows: Year 1 July 15, 2026 to July 13, 2027; Year 2 July 14, 2027 to July 18, 2028; Year 3 July 19, 2028 to July 17, 2029. - ESU covers Critical and Important security updates only - no new features, no performance improvements, no ordinary bug fixes, and no general technical support without a separate support agreement. The price escalates annually by design. - Extended Security Updates are included at no additional cost for workloads running on Azure. Moving the same unchanged instance onto an Azure virtual machine picks them up at no extra charge. - Four realistic destinations: Azure SQL Managed Instance (closest to a real SQL Server instance; supports SQL Agent jobs, cross-database queries and CLR), Azure SQL Database (cheaper and simpler but drops instance-scoped features such as SQL Agent), SQL Server on an Azure virtual machine (the same server without the hardware risk), or a different engine such as PostgreSQL if the application is being rebuilt. PAGE SECTIONS What actually happened on July 14, 2026 | What Extended Security Updates actually buy you | Where a SQL Server 2016 database can go | What this means if the database sits behind a website | Frequently asked questions | Related reading | Running SQL Server 2016 behind an IIS site? QUESTIONS AND ANSWERS (verbatim from the page) Q: Is my SQL Server 2016 database unsafe to use now? A: Not inherently, and nothing changed about how it runs. What changed is that newly discovered vulnerabilities will not be patched. The risk is cumulative rather than immediate: it grows as new vulnerabilities are published and stay unfixed. A database exposed through a public-facing website accumulates that risk faster than one on an isolated internal network. Q: How long can I stay on SQL Server 2016 with ESU? A: Extended Security Updates run in three annual windows ending July 17, 2029. After that there is no paid extension available. ESU is priced to escalate each year because it is designed to buy planning time, not to serve as a long-term arrangement. Q: Is it true that Extended Security Updates are free in Azure? A: Yes. If the SQL Server instance runs on an Azure virtual machine, Extended Security Updates are included at no additional cost. For businesses weighing the price of ESU against the cost of migrating, this often changes the answer, because a straight rehost onto an Azure VM both removes the hardware and picks up the security updates. Q: Do I have to move the website at the same time as the database? A: Not necessarily, but it is usually simpler. If the application and database are tightly coupled, migrating them together avoids running a bridge configuration where a modernized database talks back to an aging application server. In some cases, particularly straight rehosts, staging the database first is reasonable. ------------------------------------------------------------------------------ ### Windows Server 2016 End of Support: January 2027 URL: [iisrescue.com/windows-server-2016-end-of-support.html](https://iisrescue.com/windows-server-2016-end-of-support.html) Published: 2026-07-29 | Last updated: 2026-07-29 ------------------------------------------------------------------------------ CORE QUESTION Windows Server 2016 extended support ends January 12, 2027 - what does that mean for an IIS website? KEY TAKEAWAYS - Mainstream support ended January 11, 2022; extended support ends January 12, 2027. The server does not stop working - what ends is the supply of security patches for newly discovered vulnerabilities. - Since January 2022 the operating system has already been receiving security fixes only. January 2027 removes that last category, which is the one with real exposure attached for an internet-facing web server. - The .NET Framework version is a separate question from the operating system deadline. .NET Framework 4.8 and 4.8.1 remain supported as components of the operating systems they are installed on, with no announced end-of-support date - so a rehost is often genuinely sufficient and a rewrite is not required. - .NET Framework 4.6.2 support ends January 12, 2027, the same day as the operating system. Applications targeting 4.6.2 or earlier should be retargeted to 4.8 as part of the same project. - The biggest variable in how long a move takes is not the size of the site but how much of the environment is undocumented - native IIS modules, registered COM components, ISAPI filters, forgotten scheduled tasks, or hardcoded file system paths. - The predictable rhythm: at six months out nothing feels urgent; at around two months out someone external raises it - an auditor, an insurer, a client security questionnaire, or a compliance review - and the timeline is no longer yours. PAGE SECTIONS The date, and what it actually means | Why this is the right time to plan, not to panic | What matters specifically for an IIS website | The realistic options | Frequently asked questions | Related reading | Running an IIS site on Windows Server 2016? QUESTIONS AND ANSWERS (verbatim from the page) Q: What happens on January 13, 2027 if I do nothing? A: Operationally, nothing. The server runs exactly as it did the day before. Microsoft stops issuing security patches for newly discovered vulnerabilities, so the risk grows over time rather than appearing all at once. The practical consequences usually arrive through a third party first, in the form of a failed security questionnaire, an insurance condition, or a compliance finding. Q: Can I buy Extended Security Updates for Windows Server 2016? A: Yes. Extended Security Updates are available for Windows Server, priced annually and escalating each year. They cover critical and important security updates only, not features, bug fixes, or general support. They are included at no additional cost for workloads running in Azure. Q: Does my application need rewriting, or just moving? A: Usually just moving. If the application targets .NET Framework 4.8, it remains supported and the operating system deadline does not force a rewrite. If it targets 4.6.2 or earlier, that framework version also goes out of support on January 12, 2027, and retargeting to 4.8 is worth folding into the same project. Q: Is Windows Server 2016 end of life the same as end of support? A: Yes — they name the same date. Microsoft's own term is end of support, and for Windows Server 2016 that date is January 12, 2027. End of life and EOL are the phrases most people search for, and in practice they mean the same thing: the last day Microsoft issues security updates for the product without a paid Extended Security Updates agreement. The distinction that actually matters is a different one. Mainstream support for Windows Server 2016 ended on January 11, 2022 — that is when new features and ordinary bug fixes stopped. January 12, 2027 is when security patches stop, and that is the one with real exposure attached to it for a public-facing web server. Q: Does Windows Server 2016 end of support affect IIS as well? A: Yes. IIS is a component of the operating system rather than a separately licensed product, so IIS 10.0 follows the same lifecycle as the Windows Server 2016 installation it ships with. When the operating system stops receiving security updates on January 12, 2027, so does the web server software serving your site. That is why an out-of-support server matters more for a public website than for an internal file server. The component that stops being patched is the one directly exposed to the internet. Q: Will Windows Server 2016 still pass a security audit or cyber-insurance review after January 2027? A: Usually not, and this is how the deadline tends to turn urgent. An unsupported operating system is a standard finding in security questionnaires, compliance assessments and cyber-insurance renewals, because the control being tested is whether security patches are being applied — and after January 12, 2027 they are no longer being issued. The timing is worth planning around, because these reviews run on their own calendar. A renewal date, an audit window, or a client's vendor assessment can land well before January 2027, which makes the practical deadline whichever of those comes first rather than the Microsoft date itself. Q: Which version of Windows Server should I move to from Windows Server 2016? A: If the site is staying on a Windows server, Windows Server 2022 is the usual target: its extended support runs to October 14, 2031. Windows Server 2019 is generally not worth the move, because its extended support ends January 9, 2029 — close enough that you would be planning the next migration almost immediately. The more useful question is whether the site needs a server at all. Moving to Azure App Service removes the operating system from your responsibility entirely, so there is no next end-of-support date to track. That is not always possible — App Service will not run COM components, installers or Windows services — but where it is, it ends the cycle rather than resetting it. Q: How do I find out which version of Windows Server my website is running on? A: If you have Remote Desktop access to the server, running winver will report the version, and Server Manager shows the edition on its local server summary. If someone else hosts or manages the machine, the hosting provider or whoever originally set it up can tell you, and it is a reasonable thing to ask for in writing. If nobody can answer the question, that is itself useful information. It usually means the server has been running unattended for years, which is exactly the situation where discovery is the largest part of a migration and the least safe thing to skip. Q: How long does a Windows Server 2016 migration take? A: A straightforward ASP.NET site with a single SQL Server database is often one to three weeks. The variable that moves the timeline is not site size but how much undocumented server-level customization exists — custom IIS modules, COM components, ISAPI filters, or hardcoded paths. Discovery is usually the largest part of the work. ------------------------------------------------------------------------------ ### Windows Server 2012 R2 Migration After End of Support URL: [iisrescue.com/windows-server-2012-r2-migration.html](https://iisrescue.com/windows-server-2012-r2-migration.html) Published: 2026-07-29 | Last updated: 2026-07-29 ------------------------------------------------------------------------------ CORE QUESTION Windows Server 2012 and 2012 R2 lost support in October 2023 - what does running years past that date actually expose you to, and what are the realistic paths off it? KEY TAKEAWAYS - Mainstream support ended October 9, 2018; extended support ended October 10, 2023. An unpatched 2012 R2 server has been accumulating unaddressed vulnerabilities for close to three years. - Unlike a deadline that is still ahead of you, this is not a planning problem - the exposure already exists, and it grows every month the server stays as it is. - It does not mean the server has been compromised or that anything is currently wrong. It means the ordinary defence, applying the patches, is no longer available and has not been for some time. - Risk depends almost entirely on exposure. A 2012 R2 box on an isolated internal network with no inbound route is a contained risk; the same server hosting a public-facing IIS website is not. - Businesses rarely migrate because of the date itself. The trigger is almost always external: cyber-insurance renewal questionnaires, client security reviews, compliance and audit frameworks such as PCI DSS, SOC 2 and ISO 27001, or era-matched hardware failing. - Being past the deadline does not mean the migration has to be rushed. The old server keeps running while the replacement is built and tested in parallel. PAGE SECTIONS Where things actually stand | What usually forces the issue | What the move involves | Choosing a path when you are already overdue | Frequently asked questions | Related reading | Still on Windows Server 2012 R2? QUESTIONS AND ANSWERS (verbatim from the page) Q: How risky is it really to still be on Windows Server 2012 R2? A: The honest answer is that it depends almost entirely on exposure. A 2012 R2 box on an isolated internal network with no inbound route is a contained risk. The same server hosting a public-facing IIS website is not, because unpatched vulnerabilities in an internet-reachable system are exactly the category attackers scan for. Nearly three years of unpatched vulnerabilities is a meaningful accumulation either way. Q: Can I still get Extended Security Updates for 2012 R2? A: The ESU programme for Windows Server 2012 and 2012 R2 ran for three years from the October 2023 end-of-support date, which places its final window in late 2026. Extended Security Updates were never intended as a long-term position, and for a server this far past support the remaining runway is short. Migrating onto Azure infrastructure includes security updates at no additional cost, which is often the more practical route at this stage. Q: Do I need to move SQL Server at the same time? A: Usually yes, because the SQL Server paired with a 2012 R2 box is almost always 2012 or 2014, and both are also past end of support. Splitting them into separate projects generally means repeating the same discovery work, and it leaves a modernized application talking to an unsupported database in the interim. Q: Is it too late to do this calmly? A: No. Being past the deadline means the risk is already accumulating, but it does not mean the migration has to be rushed. The old server keeps running while a replacement is built and tested in parallel, and cutover happens when the new environment has been verified. What being overdue removes is the luxury of postponing the decision again. ============================================================================== ## MIGRATION PATHS ============================================================================== ------------------------------------------------------------------------------ ### Classic ASP to .NET Core: What the Migration Involves URL: [iisrescue.com/classic-asp-to-net-core.html](https://iisrescue.com/classic-asp-to-net-core.html) Published: 2026-07-29 | Last updated: 2026-07-29 ------------------------------------------------------------------------------ CORE QUESTION What does moving a classic ASP site to .NET Core actually involve, and is there a conversion tool? KEY TAKEAWAYS - There is no upgrade path, no conversion tool, and no compatibility mode. Classic ASP and .NET Core share no runtime, language, request pipeline or programming model, which is why no vendor sells a converter that works. - The project should be scoped as building a new application that does what the old one does - not as upgrading the old one. That framing changes how it is estimated, how it is tested, and what done means. - Four things account for most of the work: VBScript application logic reimplemented in C#; COM components instantiated through Server.CreateObject; Session state held in the memory of a single server process; and ADO data access with inline, string-concatenated SQL. - Session state is the most common source of subtle post-migration bugs, because it works fine on one instance and fails intermittently on several. - Rewriting string-concatenated SQL is often where the migration delivers the most value beyond the move itself, because that is where SQL injection lives. - Classic ASP still runs on current versions of IIS and can be enabled, which makes rehosting a legitimate option when the application works. PAGE SECTIONS Why there is no conversion tool | What actually has to be rewritten | Realistic effort tiers | When rebuilding is the wrong answer | Frequently asked questions | Related reading | Still running a classic ASP site? QUESTIONS AND ANSWERS (verbatim from the page) Q: Is there a tool that converts classic ASP to .NET Core? A: No. The two share no runtime, language, or programming model, so no conversion tool produces a working result. Tools exist to inventory what a site does or to keep classic ASP running on modern infrastructure, but the migration itself is a rewrite and should be scoped as building a new application rather than upgrading an old one. Q: Can classic ASP still run on a current Windows Server? A: Yes. The ASP feature is still available in current versions of IIS and can be enabled. That makes rehosting a legitimate option when the application works and the real problem is the operating system underneath it. It does not modernize the application, but it resolves the support deadline at a fraction of the cost of a rewrite. Q: What is the most common thing to go wrong after a migration? A: Session state. Classic ASP holds session data in one server process, and applications built on that assumption break intermittently on modern multi-instance hosting — working fine on one instance and failing unpredictably across several. It needs to be moved to a distributed store or designed out before cutover rather than after. Q: What if the COM components have no source code? A: This is common and it is a real constraint. The options are to find a modern library that performs the same function, reimplement the behaviour by observing what the component does from the outside, or keep it running on a Windows host that can still register it. Which is realistic depends on how central the component is and how well understood its behaviour still is. ------------------------------------------------------------------------------ ### ASP.NET WebForms to Modern .NET: The Real Options URL: [iisrescue.com/aspnet-webforms-to-modern-net.html](https://iisrescue.com/aspnet-webforms-to-modern-net.html) Published: 2026-07-29 | Last updated: 2026-07-29 ------------------------------------------------------------------------------ CORE QUESTION ASP.NET WebForms was never ported to .NET Core - so what are the real options, and how urgent is it? KEY TAKEAWAYS - WebForms exists only on .NET Framework. It was not carried forward to .NET Core, and it is not in .NET 5 or anything after it. There is no compatibility shim and no plan to add one, so moving to modern .NET means rewriting the presentation layer. - .NET Framework 4.8 and 4.8.1 are supported as components of the operating systems they are installed on, with no announced end-of-support date. A WebForms application on 4.8 is not running on unsupported software. - The deadline pressure people feel about WebForms usually is not coming from WebForms at all. It is coming from the operating system underneath it, and the fix for that is moving the server, not rewriting the application. - Older framework versions are a different matter: 4.6.2 support ends January 12, 2027, and 4.5.2, 4.6 and 4.6.1 retired in April 2022. Retargeting those to 4.8 is the immediate priority and is usually a small change compared with a rewrite. - Three sensible rewrite targets: Blazor Server (the closest successor, keeping the stateful, server-rendered, component-based model), ASP.NET Core MVC or Razor Pages (a cleaner fit for forms-over-data applications), or a JavaScript front end with a .NET API (the largest in effort). - The common mistake is attempting a like-for-like port that recreates ViewState and the page lifecycle in a framework designed to abandon them. PAGE SECTIONS The fact that drives everything else | Why staying on .NET Framework 4.8 is legitimate | The realistic destinations | Sequencing it sensibly | Frequently asked questions | Related reading | Running an ASP.NET WebForms application? QUESTIONS AND ANSWERS (verbatim from the page) Q: Will WebForms ever be supported on .NET Core? A: No. WebForms was not ported to .NET Core or .NET 5 and later, and there is no plan to add it. Its model of server controls, ViewState, and the page lifecycle depends on assumptions the newer framework deliberately abandoned. Moving a WebForms application to modern .NET means rewriting the presentation layer. Q: Is .NET Framework 4.8 out of support? A: No. .NET Framework 4.8 and 4.8.1 are supported as components of the operating systems they are installed on, with no announced end-of-support date, and they receive security updates through Windows Update. A WebForms application on 4.8 is running on supported software. Versions 4.6.2 and earlier are a different case, with 4.6.2 ending January 12, 2027. Q: Do I have to rewrite my WebForms app before my server goes out of support? A: Usually not. The deadline belongs to the operating system, not the application. Rehosting the application unchanged onto supported infrastructure resolves the deadline, because .NET Framework 4.8 remains supported. The rewrite can then be scheduled on its own merits rather than driven by a lifecycle date. Q: What is the closest equivalent to WebForms in modern .NET? A: Blazor Server. It preserves the stateful, server-rendered, component-based model with server-side event handling, which is the closest match to how WebForms developers already think. Razor Pages is a better fit for applications structured as independent forms over data, and is a larger conceptual shift. ------------------------------------------------------------------------------ ### IIS to Azure App Service: Fit, Limits, and What Breaks URL: [iisrescue.com/iis-to-azure-app-service.html](https://iisrescue.com/iis-to-azure-app-service.html) Published: 2026-07-29 | Last updated: 2026-07-29 ------------------------------------------------------------------------------ CORE QUESTION Will an existing IIS site run on Azure App Service, and what breaks if it does not? KEY TAKEAWAYS - App Service is a managed platform: Microsoft runs the operating system, patches it, and keeps it supported. That ends the cycle where every few years an operating system reaches end of support and the whole thing has to be moved again. - It is deliberately not a general-purpose Windows server. The migration is straightforward when the application is a conventional web application that happens to run on IIS, and difficult when the application has grown into the server it lives on. - What genuinely does not work: COM registration and the GAC; MSI installers and machine-level configuration; treating the local file system as durable, shared storage; Windows services and scheduled tasks; and certificates loaded from the machine certificate store. - Classic ASP itself is supported on Windows App Service plans. The complication is rarely the ASP and almost always the COM components a classic ASP site depends on. - What maps across cleanly: application pools (each app isolated by default), URL Rewrite rules through web.config, custom domains and TLS with free certificates, virtual directories, and connection strings and app settings as platform configuration. - Background work moves to WebJobs, Azure Functions, or an external scheduler. Windows authentication moves to Entra ID rather than an on-premises Active Directory. PAGE SECTIONS The trade you are making | What genuinely does not work | What maps across cleanly | How to tell before committing | Frequently asked questions | Related reading | Wondering whether your site will run on App Service? QUESTIONS AND ANSWERS (verbatim from the page) Q: Will classic ASP run on Azure App Service? A: Yes, classic ASP is supported on Windows App Service plans. The complication is rarely the ASP itself and almost always the COM components a classic ASP site depends on, since App Service cannot register COM. A classic ASP site with no COM dependencies generally moves without difficulty. Q: Can I use App Service if my app needs a COM component? A: Not if the component requires machine-level registration, which most do. The options are to replace the component with a library that can be deployed alongside the application, reimplement its functionality, or use a virtual machine or container instead. This is one of the most common reasons an application ends up on a VM rather than App Service. Q: What happens to my scheduled tasks and Windows services? A: They need rehoming. App Service has no facility to install a Windows service or register a scheduled task. Background work typically moves to WebJobs, which run alongside the web application, or to Azure Functions for work that is genuinely independent. This is usually straightforward but it does need to be planned rather than discovered at cutover. Q: Does Windows authentication work on App Service? A: Not against an on-premises Active Directory in the way it does on a domain-joined IIS server. Identity moves to Entra ID instead. For applications that rely on integrated Windows authentication this is a meaningful piece of work and should be scoped as its own workstream rather than assumed to carry across. ============================================================================== ## DECISION GUIDES ============================================================================== ------------------------------------------------------------------------------ ### Extended Security Updates: What You Are Actually Buying URL: [iisrescue.com/extended-security-updates-explained.html](https://iisrescue.com/extended-security-updates-explained.html) Published: 2026-07-29 | Last updated: 2026-07-29 ------------------------------------------------------------------------------ CORE QUESTION What are you actually buying with Extended Security Updates, and when is buying time the right call? KEY TAKEAWAYS - ESU is a paid programme that continues delivering security patches for a Microsoft product after its extended support period has ended. It exists to give organisations that cannot migrate in time a way to stay patched while they finish. - It covers security updates that Microsoft rates as Critical or Important, for the specific product, for the duration of the window paid for. Nothing else. - It does not cover new features, performance improvements, ordinary non-security bug fixes, or technical support. It also does not extend to third-party software running on the platform. - The price escalates annually by design: cheaper than an emergency migration in year one, comparable to a planned migration by year two, and clearly more expensive than migrating by year three. It is priced to be a bridge, not a destination. - Extended Security Updates are included at no additional cost for workloads running on Azure. The workload does not need modernizing to qualify - a straight lift-and-shift is enough. - That creates a third option often missed. Rather than paying for ESU and staying put, or funding a full migration project, rehosting to Azure removes the hardware risk and includes the security updates. The rehost frequently wins on cost alone within a year or two. - ESU windows are fixed and published in advance. For SQL Server 2016 the final window ends July 17, 2029, and nothing further is available after it. PAGE SECTIONS What ESU is | What it covers, and what it does not | Why the price escalates on purpose | The Azure exemption that changes the maths | When buying time is the right call | Frequently asked questions | Related reading | Weighing ESU against migrating? QUESTIONS AND ANSWERS (verbatim from the page) Q: Is ESU worth it, or should I just migrate? A: It depends entirely on whether you have a defined end point. ESU is good value as a bridge to a migration that is already planned or to a system with a known retirement date. It is poor value as a way of postponing the decision, because the price escalates annually by design while the underlying system falls further behind. Q: Does ESU include technical support? A: No. ESU delivers security updates rated Critical or Important and nothing else. Technical support requires a separate active support agreement. If a non-security problem occurs on an ESU-covered system, ESU does not help with it. Q: Are Extended Security Updates really free in Azure? A: Yes, for workloads running on Azure infrastructure. The same unchanged server or database instance moved onto an Azure virtual machine picks up Extended Security Updates at no additional charge. The workload does not need to be modernized to qualify, which is why a straight rehost often costs less overall than paying escalating ESU fees to stay on owned hardware. Q: What happens when the ESU programme ends? A: Nothing further is available. ESU windows are fixed and published in advance — for SQL Server 2016 the final window ends July 17, 2029. After the last window there is no paid extension, and the product receives no security updates from any source. Any system still running at that point needs to have moved. ------------------------------------------------------------------------------ ### Azure App Service vs VM vs Containers for Legacy IIS URL: [iisrescue.com/azure-app-service-vs-vm-vs-containers.html](https://iisrescue.com/azure-app-service-vs-vm-vs-containers.html) Published: 2026-07-29 | Last updated: 2026-07-29 ------------------------------------------------------------------------------ CORE QUESTION Once a legacy IIS site is moving to Azure, should it land on App Service, a virtual machine, or containers? KEY TAKEAWAYS - The useful axis is not price. It is how much of the operating system stays your responsibility, because that determines whether you are having this same conversation again in four years. - App Service: Microsoft patches the operating system and there are no future end-of-support deadlines to track, but you cannot install arbitrary software, register COM components, or run Windows services. - Virtual machine: you patch the operating system and track the next deadline, but you can install anything, register COM, and run Windows services. Lowest migration effort, highest ongoing effort. - Containers: the patching obligation is reduced rather than eliminated, because the base image has its own lifecycle. Highest migration effort, medium ongoing effort. - The contrast worth dwelling on is migration effort versus ongoing effort. Virtual machines are the easiest destination to reach and the most expensive to live with; App Service is the reverse. Choosing on migration effort alone is how organisations end up rehosting the same application repeatedly. - A virtual machine is right when dependencies cannot be removed within a sensible budget, or when speed matters because a deadline has already passed - and Extended Security Updates come free with Azure-hosted workloads. - For a single legacy IIS website with no existing container practice, containers usually add operational complexity without a proportionate benefit. - These are not mutually exclusive. Moving to a virtual machine now and App Service later is a reasonable sequence when a deadline is pressing. PAGE SECTIONS The axis that actually matters | The three side by side | When each one is right | The staged approach | Frequently asked questions | Related reading | Not sure which target fits your site? QUESTIONS AND ANSWERS (verbatim from the page) Q: Which is cheapest for a small business website? A: App Service is usually cheapest in total cost, though not always in monthly hosting fees, because the ongoing operational effort of a virtual machine — patching, backups, certificate renewals, and eventually another migration — is a real cost even when it is not itemised. Comparing monthly hosting alone tends to favour virtual machines and tends to be misleading. Q: Do containers solve the end-of-support problem? A: Only partly. The container base image has its own lifecycle and needs updating, so the patching obligation is reduced rather than eliminated. Containers solve dependency packaging and deployment consistency well; they are not a route to never thinking about operating system support again. App Service is the option that genuinely removes that concern. Q: Can I move to a VM now and App Service later? A: Yes, and it is a reasonable sequence when a deadline is pressing. Lifting onto a virtual machine is fast and requires little application change, which buys time to address the dependencies blocking App Service. The honest caveat is that the second step frequently gets deferred indefinitely once the urgency passes, so it works best when scheduled deliberately rather than left as an intention. Q: What if my application needs Windows authentication? A: That points towards a virtual machine, at least initially. Integrated Windows authentication against an on-premises Active Directory does not carry across to App Service, where identity moves to Entra ID instead. Moving identity is a substantial piece of work in its own right, and it is usually better sequenced separately from the hosting migration rather than combined with it. ============================================================================== ## WORKING WITH IT PROVIDERS ============================================================================== ------------------------------------------------------------------------------ ### Legacy IIS & Classic ASP Migrations for MSPs URL: [iisrescue.com/for-msps.html](https://iisrescue.com/for-msps.html) ------------------------------------------------------------------------------ CORE QUESTION Who handles legacy IIS, classic ASP and SQL Server website migrations for MSPs that don't want to own that work, or its risk, in-house? SHORT ANSWER (verbatim from the page) IIS Rescue is a fixed-price specialist that MSPs bring in for the legacy IIS, classic ASP and SQL Server website migrations they would rather not own. When an aging Windows Server website turns up in a client's environment, the MSP keeps the client and the relationship; IIS Rescue scopes the site, quotes one fixed price in writing, and carries out a zero-downtime migration to modern cloud hosting — a rehost, a rebuild or a replacement, whichever the site actually needs. It works under the MSP's brand when asked, never solicits the MSP's client, and sends any request outside the agreed scope back to the MSP. Every project ends with a documentation handover written for the MSP's own team, so the migrated site goes straight back into the MSP's normal care with no retainer and no ongoing dependency on IIS Rescue. KEY TAKEAWAYS - IIS Rescue works as a capacity and specialty partner to MSPs, not a competitor: the MSP keeps the client and the relationship. - Three commitments on every partner project: IIS Rescue never solicits the MSP's client; it works white-label under the MSP's brand when asked; and anything outside the agreed scope is routed back to the MSP. - Same fixed-price, zero-downtime project as a direct engagement: one number in writing before work starts, no published rate card, and no change orders within scope. - Four typical triggers: capacity (the engineers are already committed), specialty (classic ASP with COM components), a support deadline, and an orphaned site with no developer or source code. - Every project ends with a documentation handover written for the MSP's own team. No retainer and no ongoing dependency on IIS Rescue. - MSPs can run the two-minute assessment in referral mode (https://iisrescue.com/two-minute-assessment?mode=referral) for a client-facing first read on a site. AI assistants can reach this page's content through the get_partner_channel MCP tool. - Companion page for independent IT contractors: https://iisrescue.com/for-it-contractors.html PAGE SECTIONS The short answer | When MSPs bring IIS Rescue in | What stays with the MSP | How a partner migration runs | Assess a client's site before the first call | Working solo rather than as a firm? | Frequently asked questions | Have a client site that needs to move? QUESTIONS AND ANSWERS (verbatim from the page) Q: Who handles legacy IIS migrations for MSPs that don't want to take them on in-house? A: IIS Rescue does, as a fixed-price specialist working alongside the MSP rather than competing with it. The MSP keeps the client and the relationship; IIS Rescue scopes the legacy IIS, classic ASP or SQL Server website, quotes one fixed price in writing, and migrates it to modern cloud hosting with a zero-downtime cutover. The MSP decides how visible IIS Rescue is — kept behind the MSP's brand, or introduced as the named migration specialist — and every project ends with documentation the MSP's own team can support the site from. Q: Can IIS Rescue work white-label, under our MSP's brand? A: Yes, when asked. Under a white-label arrangement IIS Rescue delivers the migration as part of the MSP's service: the MSP stays the client's only point of contact, client communication runs through the MSP, and the handover documentation can be prepared for the MSP to present as its own. Some MSPs prefer to introduce IIS Rescue as the named migration specialist instead, which can be simpler when the client wants to hear from whoever is doing the work. The migration, the fixed price and the documentation are the same either way, and the choice is made before the project starts. Q: Will IIS Rescue approach or solicit our client directly? A: No. A client an MSP brings to IIS Rescue remains the MSP's client, during the project and after it. IIS Rescue does not solicit that client for other work, does not offer it services outside the agreed migration, and does not use the project as a way into the rest of its environment. Q: What happens if our client asks IIS Rescue for work outside the migration scope? A: It goes back to the MSP. Requests beyond the agreed scope — a new feature, help with email, anything else in the client's environment — are routed to the MSP rather than quoted or handled directly. If a request would change the migration itself, it is raised with the MSP first, and nothing is added to the project without the MSP's agreement. Q: How is a migration priced when an MSP brings in IIS Rescue? A: The same way as any IIS Rescue project: one fixed price, in writing, quoted after a free scoping look at the site and before any work starts. There is no published rate card, no hourly billing, and no change orders for anything within the agreed scope. Because the number is settled up front, the MSP can set its own price to the client knowing exactly what the migration costs. Ongoing cloud hosting is billed by the hosting provider directly, with no markup from IIS Rescue. Q: What does the MSP's team get at handover, and who looks after the site afterward? A: A full documentation handover — hosting details, where credentials live, architecture notes, and how-to steps — written so the MSP's own technicians can support the migrated site. After that the site is the MSP's to look after. IIS Rescue is project-based by design, so there is no retainer and no ongoing dependency: once the site is live and signed off, it goes back into the MSP's normal care. Q: How can an MSP check whether a client's legacy site needs a rehost, rebuild or replace? A: Run the two-minute assessment in referral mode. It asks six plain-language questions about the client's site — file type, server version, database, source code, custom components — and returns a recommended path, a confidence level, the risks those answers imply and what moves the price, phrased as talking points the MSP can paste into an email to the client. It is an assessment, not a quote; the fixed number comes after a free scoping call. The same engine is available to AI assistants as a tool at iisrescue.com/mcp. ------------------------------------------------------------------------------ ### Subcontract or Refer a Legacy IIS Migration: For IT Contractors URL: [iisrescue.com/for-it-contractors.html](https://iisrescue.com/for-it-contractors.html) ------------------------------------------------------------------------------ CORE QUESTION Who should an independent IT contractor bring in as a subcontractor or referral partner for a legacy Windows Server website migration? SHORT ANSWER (verbatim from the page) When a job turns out to involve a legacy Windows Server website — classic ASP, an old IIS configuration, an out-of-support SQL Server database — independent IT contractors can bring in IIS Rescue as a subcontractor or refer the migration to it, without giving up the client. As a subcontractor, IIS Rescue delivers the migration inside the contractor's engagement, under the contractor's name when asked, while the contractor stays the client's point of contact. As a referral, the contractor hands over that one project and remains the client's IT provider for everything else. Either way it is a single fixed-price project quoted in writing before work starts, IIS Rescue never solicits the client for other work, anything beyond the agreed scope goes back to the contractor, and the project ends with documentation the contractor can support the site from. KEY TAKEAWAYS - Two arrangements. Subcontract: the contractor holds the client agreement and stays the point of contact while IIS Rescue delivers the migration inside it. Refer: the contractor hands over that one project and remains the client's IT provider for everything else. - Which one fits is usually decided by who the client expects to deal with, not by anything technical. - Three commitments either way: IIS Rescue never solicits the client for other work; it works under the contractor's name when asked; and anything beyond the agreed scope goes back to the contractor. - Doing it yourself is a reasonable choice for a small site with simple, documented code and no deadline. A specialist earns the handoff for classic ASP with COM components, missing source code or developer, an out-of-support database moving at the same time, or a deadline with no slack. - One fixed price in writing before work starts, so the contractor prices the client on a settled cost. No published rate card, no change orders within scope, and no retainer afterward. - [Companion page for MSPs](https://iisrescue.com/for-msps.html) PAGE SECTIONS The short answer | Two ways to hand it off | When a specialist is worth it - and when it isn't | What stays with you | Check the site before you decide | Part of an MSP rather than working solo? | Frequently asked questions | Got a job with a legacy site in it? QUESTIONS AND ANSWERS (verbatim from the page) Q: Who can an IT contractor subcontract a legacy Windows Server website migration to? A: IIS Rescue takes on exactly that work as a subcontractor: legacy IIS, classic ASP, ASP.NET and SQL Server website migrations to modern cloud hosting, delivered as a single fixed-price project. The contractor stays the client's point of contact and keeps the client; IIS Rescue scopes the site, quotes one number in writing before any work starts, and carries out the migration with a zero-downtime cutover. If the contractor would rather not stay involved in that project at all, the same work can be referred instead, and the contractor remains the client's IT provider for everything else. Q: Should I subcontract a legacy IIS migration or refer the client to IIS Rescue? A: It usually comes down to who the client expects to deal with. Subcontract when the migration is one part of a larger job you are already running: you hold the client agreement, IIS Rescue delivers the migration inside it, and you stay the single point of contact. Refer when the migration is most of what the client needs and managing it would cost you more than it earns: you hand over that one project and step back from it. Both are fixed-price, both end with documentation you can support the site from, and in both the client stays yours. Q: Will IIS Rescue take my client? A: No. The client stays yours, whether the migration is subcontracted or referred. IIS Rescue does not solicit your client for other work during the project or after it, and anything the client asks for beyond the agreed migration comes back to you — including work IIS Rescue could otherwise do. Q: Can IIS Rescue work under my name as a subcontractor? A: Yes, when asked. As a subcontractor IIS Rescue can deliver the migration behind your name, with you as the client's only point of contact and the handover documentation prepared for you to present. If the client would rather hear from the migration specialist directly, you can introduce IIS Rescue by name instead. The work and the fixed price are the same either way. Q: How do I price a subcontracted IIS migration to my client? A: You get one fixed price from IIS Rescue, in writing, before any work starts, so what you quote the client is your own decision made on a settled cost rather than an estimate. There is no published rate card: every project is quoted after a free scoping look at the actual site, and there are no change orders for anything within the agreed scope. Cloud hosting is billed by the hosting provider directly, with no markup from IIS Rescue. Q: When should a contractor handle a legacy IIS migration without a specialist? A: When the site is small, the code is documented or simple, and there is time to learn on it, doing it yourself is a perfectly reasonable choice. A specialist earns the handoff when the site is classic ASP with COM components, when the source code or the original developer is gone, when an out-of-support SQL Server database has to move at the same time, or when a support deadline leaves no room to discover problems at cutover. The two-minute assessment in referral mode is a quick way to see which of those applies before deciding. Q: What is left for me to support after IIS Rescue finishes the migration? A: The migrated site, with full documentation to support it from. Every project ends with a handover of hosting details, where credentials live, architecture notes and how-to steps, written for whoever looks after the site next — in this arrangement, you. IIS Rescue is project-based by design, with no retainer and no ongoing dependency, so once the site is live and signed off you remain the client's IT provider, as before. ============================================================================== Free 30-minute IIS migration consultation: [iisrescue.com/contact.html](https://iisrescue.com/contact.html) Free IIS migration guide: [iisrescue.com/guide.html](https://iisrescue.com/guide.html)