What to do when an old Windows computer cannot be replaced yet

Once a version of Windows reaches the end of support, Microsoft stops issuing security updates for it, apart from any paid extended arrangements it chooses to offer. Every new vulnerability found after that date stays open on the machine permanently. Attackers know this, and unsupported systems are a routine target for ransomware operators scanning for easy entry points.

The risk is not only the old computer itself. A compromised device on the same network as your accounts, your file storage and your staff laptops gives an attacker a foothold to move sideways. Treating the device as a contained problem, rather than an ordinary office PC, is the starting point.

Before changing anything, find out why the computer cannot be replaced. Common reasons are a line-of-business application that has no current version, a driver for a piece of machinery such as a lab instrument or a CNC controller, or a licence tied to the old hardware. Speak to the software supplier and ask directly whether a supported version, a different operating system or a hosted alternative exists.

Record what the machine connects to. List every shared folder it reads from, every server it talks to, every USB device and every person who logs on. This inventory decides how tightly you can lock it down and gives you the evidence you will need later if an insurer or assessor asks about it.

The strongest practical control is to stop the unsupported machine reaching anything it does not strictly need. Where possible, place it on its own network segment or VLAN, or on a separate router, and block traffic to your main office network except for the specific addresses and ports the application requires. If it only ever talks to one local server, allow only that connection and deny the rest.

Remove the things that make an old PC easy to attack. Turn off email, stop general web browsing and block internet access entirely unless the application genuinely needs a particular site. If it needs one supplier address, allow that address alone rather than opening the whole internet.

Limit access to the people who must use the machine. Use a standard user account for daily work rather than an administrator account, give each person their own login and remove any shared or default accounts. Make sure the screen locks after a short period of inactivity and that the password is long and unique.

Control removable media, because USB drives are a common way for malware to reach an isolated machine. Disable USB storage where the application does not need it, or allow only company-issued drives that are scanned elsewhere first. Keep a current, supported anti-malware product running on the device if one is still available for that Windows version, and take regular backups of its data stored somewhere the old machine cannot overwrite.

Isolation buys time but is not a long-term answer. Write down a target replacement date, a named person responsible and the specific blocker, such as waiting for a supplier release or budget approval. Review the record monthly so the exception does not quietly become permanent.

Give the replacement a route. That might mean migrating the application to a supported Windows version, running it in a virtual machine on supported hardware where the supplier allows it, moving to a hosted version, or replacing the connected equipment. Ask suppliers for written timelines and keep their replies with your risk record.

Cyber Essentials requires that software in scope is supported and receives security updates, with updates applied within 14 days of release where they address high or critical vulnerabilities. A device running an operating system that no longer receives security updates fails that requirement, and isolation, restricted accounts and monitoring do not change the answer. Those controls lower real-world risk, but they are not a substitute for a supported operating system.

The accepted routes are to replace or upgrade the device, or to remove it from the scope of the assessment by placing it in a properly separated subset that has no route to the internet and no connection to in-scope systems. The scoping rules are set out in the current NCSC and IASME requirements, so check the latest version before you rely on a subset. If the device cannot meet either route, expect the assessor to record it as a failure.