Is it safe to keep a machine running an old version of Windows?

An unsupported version of Windows no longer gets security fixes, so any weakness found from now on stays open. That's why the usual advice is to upgrade or replace. But on production floors, labs, and clinics, the computer is often part of a piece of equipment: the software only runs on that version, the maker may be out of business, and the machine itself works fine.

How to keep it running safely

• Isolate it. Give it its own network segment, separate from office computers, with a firewall in between
• Allow only what it needs. If it only sends files to one server, that's the only connection it gets
• Keep it off email and the web. Most attacks arrive through those
• Control removable media. USB drives are the usual way files get on and off these machines, and the usual way malware does too
• Limit who can log in, with separate accounts and passwords that aren't reused anywhere else
• Back it up as a full image, so a failed drive doesn't mean a stopped line
• Write it down. Insurers and auditors ask about unsupported systems; a documented exception with these controls is a much better answer than silence

Plan the exit anyway

Isolation buys time; it doesn't make the machine new. Keep a note of when the equipment is due for replacement, and when you shop for new equipment, ask how long the vendor supports its software.