“Further analysis of the low-level TCP/IP characteristics reveals a total of 609,000 web-facing computers running Windows Server 2003. This is over 10% of all web-facing computers, and shows the true potential cost of migration, as software licensing is typically charged on a per-machine rather than per-IP address basis.
China and the United States account for 55% of the world’s Windows Server 2003 computers (169,000 in China and 166,000 in the US), yet only 43% of all other web facing computers.”
See Millions still running the risk with Windows Server 2003Why do they do it? Run “2003” in 2015! It’s not cost, because Debian GNU/Linux would cost $0. It’s lock-in whether by habit or by application. Lots of folks have invested heavily in applications that still work so they are willing to risk everything, perhaps by adding other layers of security. Why?
In five years, they’ve had plenty of opportunity to plan migration. I think a lot of them just want a box that runs and don’t consider other alternatives. I’d recommend Debian GNU/Linux if/when they get hacked and are forced to move on. It’s simple, efficient and very popular on the web without such compromises. Debian supplies updates and upgrades for the cost of a download. Heck! They could even make a small donation to Debian in lieu of licensing That Other OS.