How to identify who/what uses a Windows 2003 server?

This is not a dumb question, it's a great question and I'm glad that you're asking.

Human processes

Make sure that you've reviewed all documentation, talked to the greybeards, and have sign-off from someone from the business.

Technical processes

Get a complete backup; mark the media for long-term archival. Run a connection monitor or packet sniffer for a period of time to see what connections are still being made. Inspect the services to see if anything sounds important/familiar.

Cutting the cord

Better idea than powering off - unplug the network cable for a few days. If it's an old physical machine, you don't want to risk the situation where you need to power it back up but the disk spindles are frozen. Leave them spinning.


Source of authority - I spent over a year decommissioning old servers for a Fortune 25 pharma company. This was the process, and it worked.


Power it off and see who screams, and about what.

Seriously, it is the best way. Even checking logs will only get you so far, because you'll only see activities that are logged.


EDIT: To head off any further comments, this advice assumes you've already done what you should have done in the first place, even before asking the question here - asked around about the server, looked for documentation, and logged on to see if you can catch any obvious signs of activity.

This also assumes you're not in one of those environments that apparently exist where business-critical systems that no one knows about run on hardware so fragile it's at risk of bursting into flames or exploding during boot.