The PC nobody is allowed to upgrade
There is one machine in the building with a note on it: do not update. It runs an old Windows version because the software on it will not run on anything newer. Maybe it drives a machine on the shop floor, or it holds the old estimating program, or it is the only place the historic accounts can be opened.
It works. But it cannot get security updates, and its hardware is getting old. Every time it takes a little longer to boot, someone wonders what happens if it does not.
Why the software is stuck
Older programs often rely on components that newer Windows versions removed or changed: 16-bit installers, old database drivers, specific versions of Internet Explorer, USB licence dongles with long-dead drivers, or hard-coded paths to folders that no longer exist.
Sometimes it is simply that nobody has tried. The software may run fine on a current Windows with compatibility settings, or in a virtual machine, but testing it was never anyone's job, so the old PC stayed.
Where the software controls equipment, the constraint may be real: the equipment vendor only certifies one environment, and changing it could affect the machine.
The risks you are carrying
| Risk | Why it matters |
|---|---|
| No security updates | Known weaknesses stay open; the machine is an easy target on your network |
| Ageing hardware | Old disks and power supplies fail, often without warning |
| No replacement hardware | Newer PCs may not support the old Windows at all |
| Insurance and customer questions | Cyber insurers and larger customers may ask about unsupported systems |
| Single copy of data | Records held only on that PC's disk |
The network risk is the one to act on first. An unsupported PC that can browse the web and reach every other machine in the office is a much bigger problem than one that is fenced off.
How we deal with it
- Immediate protection. We take a full image backup of the machine and a separate copy of its data. We then isolate it on its own network segment, with no web browsing and only the connections it genuinely needs.
- Understand the software. We identify exactly what it depends on: components, drivers, database, dongle, file locations and any equipment it talks to.
- Test the easy routes. We try it on a current Windows with compatibility settings, then in a virtual machine hosted on newer hardware or in Azure, which removes the ageing hardware risk even if the old Windows stays for a while.
- Get the data out. Where the software holds records, we extract them into a modern database or readable archive, so the information no longer depends on the program running.
- Plan the way out. If the software cannot move, we plan a replacement: a package, a rebuilt tool, or a custom interface to the equipment, with the isolated machine carrying on meanwhile.
- For historic-only software, a read-only archive is often all that is needed
- For estimating or admin tools, a web rebuild usually makes sense
- For equipment control, we work with the equipment vendor's constraints rather than around them
Where that leaves you
The immediate risk is lower within the first stage: the data is backed up, the machine is fenced off, and a copy of it exists that can run on other hardware. After that, the old PC is no longer a single point of failure.
Longer term, the program is either running in a supported environment, replaced, or reduced to an archive that can be searched without it. The note saying do not update can finally come off.
When an insurer or a larger customer asks whether you run unsupported systems, you have a straight answer: what the machine is, why it exists, how it is contained and what the plan is. That is a far better position than hoping nobody asks.
Is there a machine like this in your building?
- A PC runs an out-of-support Windows version because of one program
- It has a note saying not to update it
- The data on it is not backed up anywhere else
- It sits on the same network as everything else and can browse the web
- Nobody has tested the software on a newer system
- It controls equipment or holds records you still need