XP computers in a business environment

[ddrueding]

What are peoples thoughts on having machines running XP still in production after the EOL?

Obviously this isn't ideal, but the opinions I've been reading run from "meh" to "omgwtfbbq". Sounds very Y2K to me.

Do you think that XP machines behind a firewall running updated software will be considerably more vulnerable the day after support ends?

One of my clients would need to upgrade every machine right now, nearly $10k, and she doesn't really have the money. My current recommendation has been to update the units that are critical (quickbooks, servers, etc) and leave the less important ones for later.

 

[CougTek]

Do you think that XP machines behind a firewall running updated software will be considerably more vulnerable the day after support ends?

If those machines are used by users who browse the web using IE8, then the answer is a loud "yes".

One of my clients would need to upgrade every machine right now, nearly $10k, and she doesn't really have the money. My current recommendation has been to update the units that are critical (quickbooks, servers, etc) and leave the less important ones for later.

That simply bad planification from her part. If she didn't have the time to put money on the side after 13 years and three skipped upgrade-cycles, just show her a mirror. Business IT has a cost and it can only be delayed for so long. After next month, she doesn't have to replace all of her systems right away, but if she doesn't, she has to be informed that her maintenance cost will have a good chance to rise significantly (which should be good for you).

 

[timwhit]

Is there any reason she needs to keep running Windows on all these machines?

 

[ddrueding]

The motivation behind not thinking it is that big a deal is that many of these XP machines haven't been updated in years anyway and are still chugging along. If they are a year behind on updates and not dead, will it matter that much if the updates (which they wouldn't install anyway) don't exist?

The theory I heard was that hackers were holding back many exploits/viruses for release the day after support ends, and these machines will be unusable within minutes. Obviously running IE is a death sentence, but I've always considered that to be the case.

And yes, they still have to run Windows.

 

[Chewy509]

I agree with Coug, certainly poor planing if there are only general business applications involved. (I do note, that there are some instances where due to installed software not working with anything beyond XP, you need to run XP, but these should be rare for most SMB).

Will it be a big deal once MS do EOL for the majority of users**, I think it'll be in the order of the effect that the Y2K bug had when 2000 rolled over, that is very little. However, will there be a big increase in exploits for XP - don't really know, as there has been a clear shift towards targeting mobile platforms and web browsers as primary infection points. Are blackhats holding on to exploits for XP so MS doesn't find out and patch them - can't really say, as there's a lot of money to be made from good 0-day exploits.

Also something for thought - how long does it take for MS to identify the root cause of an issue, write a patch, test it (in all possible combinations), get QA sign off, etc... hours? (highly unlikely), days? (may be for something critical), weeks? (I suspect for the majority), months? (yet bet). How do we know that MS hasn't already stopped writing patches for XP, and the only things left to come out are for those patches that are already in the QA cycle?

My only advise for those stuck with XP, reduce the external facing attack vector as much as possible and you'll be fine. Just like for those all those users still on Windows 2000, Windows NT 4 and 3.5.1, or Solaris 7 or 8, or the various Linux boxes out there (running old versions of Apache, etc). Should you upgrade to a newer supported Windows OS, absolutely if possible. (You're only hurting Microsoft's business in the long run if you don't).

** You can actually purchase extended support options from MS for Windows XP for a tidy fee...

 

[Chewy509]

Another question, beyond XP EOL, how old is the hardware in this case? Is it still even under warranty? That would be a bigger concern for me (unexpected hardware failure), than running an EOL OS.

 

[Mercutio]

My company still does a decent portion of its business training Windows XP and Office 2003. It's the Common Operating Environment for a big customer and they won't be done transitioning to Windows 7/Office 2010 until this August. Several other companies I deal with still have a mandate for IE6, apps that rely on WDM drivers (last supported in XP) or business applications that simply don't work properly in anything newer than XP. In a lot of those cases, we're talking about custom or vertical-market software for which the expense of replacement is every bit as enormous as the cost for replacing computers and OS licenses. It would probably be cheaper for me to build out some kind of regulated private network for the systems that need to do those things, but I know that would turn into another support nightmare.

The limitation of IE8 (vs. 9+) is probably the biggest single issue with XP in day to day operational terms, but I don't think Google or Firefox will be ending support for XP for a while.

My standard advice for the last couple years has been to upgrade what you can, when you can, but I was still deploying XP/C2D machines at customer request in 2011 with very similar specs to the ones I was rolling out in 2008 and I can see it's going to be a while before those machines get phased out.

The new version of UPS Worldship, which doesn't run on XP, has probably gotten my customers to buy more new PCs than anything Microsoft has done or said about XP's EoL.

 

[Mercutio]

... I will say: It is RIDICULOUSLY easy to make IE and Office run in WINE. Office Licenses often aren't transferable to other hardware but there are a couple customers where, in a perfect world, I'd just go in and trash their XP installs for SuSE or something.

 

[ddrueding]

There is (isn't there always) a specific program they need that requires the .NET framework and the tiny version of MS SQL.

 

[Chewy509]

But isn't .NET Framework available on newer OSes? And which version of MSSQL? The only one I know that has issues is MSDE2000 (MS SQL2000 based) with 7+, but there are migration guides for moving MSDE 2000 to MS SQL 2005 Express without upgrading the rest of the application.

 

[ddrueding]

Yes, the software they use could absolutely run on 7 and possibly 8, just not WINE.

 

[P5-133XL]

My view is that a computer that currently does a job well, in a business environment, shouldn't be fiddled with excessively and that includes the OS. That does not mean that improvements should not be examined or implemented nor should one have a blind-eye to potential failure modes and solutions to those. Rather, that there needs to be a known benefit that outweighs the disruptive risks and those risks need to be minimized to allow a smooth transition. You'd think that simply moving from XP to W7 is a minimal change that doesn't need planning but you'd be wrong for many.

XP is definitely a risk, but it is a manageable risk especially if it has no exposure to the internet. The more exposure to potential malware, the more I want to upgrade it. I also recognize that XP is fast and lean which means it can run on HW that is not very capable which invariably means more $$$. In addition to the base machine, moving from XP to W7 will force some peripheral HW replacement because of the lack of drivers but that is offset by being able to get peripherals that are newer (perhaps more capable) that never had XP drivers. Regardless it all costs $$$.

Then there is the training of employees. Many will be conversant in the newer OS's but that does not eliminate resistance from those that are used to and prefer doing things the old way. One should not under-estimate how painful and traumatic that change can be. I understand that computer people are used to relatively rapid change but that is not the case for many.

 

[Tannin]

I'd be setting down two or three cast-in-stone, never-ever-break rules:

1: No IE. Absolutely forbidden.
2: No Outlook Express.
3: No Windows Picture and fax viewer

Get rid of those three (are there any other big ones I've missed?) and you have got rid of the major attack vectors. My guess is that you'll be just fine. (Of course, I am assuming a proper firewall. But that's a given.)

 

[CougTek]

Why just not move to Windows 7 Pro and its XP Mode? You can still use the XP Mode for the retarded applications, but use the rest of the system to interact with the world. I've used this several times over the years for people who wanted to use printers that were not supported in recent versions of Windows. It worked well.

 

[mubs]

A current Linux OS running an XP Guest OS in a VM?

 

[jtr1962]

My view is that a computer that currently does a job well, in a business environment, shouldn't be fiddled with excessively and that includes the OS. That does not mean that improvements should not be examined or implemented nor should one have a blind-eye to potential failure modes and solutions to those. Rather, that there needs to be a known benefit that outweighs the disruptive risks and those risks need to be minimized to allow a smooth transition. You'd think that simply moving from XP to W7 is a minimal change that doesn't need planning but you'd be wrong for many.

This is very true. Quite a few computers in business environments either aren't connected to the Internet at all, or are connected through a server/mainframe which not only blocks malware, but often blocks users from even accessing sites known to contain malware. In this type of environment you probably only need to keep the main servers updated.

Another issue I'm seeing here with the client upgrading is the fact that these might be decade old machines or even older. They may not run Windows 7/8 well or at all. I knew someone who the last time I talked to them a few years ago was still using Windows 3.1 running on a 386 (or maybe it was a 486). Fat chance of "upgrading" that machine to even run Windows 98, let alone anything more modern. Come to think of it, I recall another person who only used their computer for word processing and accounting. Whatever they were using was ancient (this was less than 5 years ago). They still had a monochrome CRT (remember those?), and it looked like it was a pure DOS machine running DOS-based software. It looked like a 286 or even older. It probably was considering they said they were using this machine since sometime in the 1980s. Anyway, I think some people here might be surprised at the machines and software people are still running. IT guys typically only get called in when a business has at least borderline modern hardware and software. They never see the people who got used to a certain system of doing things on a computer 25 years and never saw the need to change it. I have to say sometimes it's by necessity. If anyone recalls the huge number of issues I had trying to get my microcontroller programmer to work on my new machine I can only imagine what someone running 20 year old CAD machines might face if they can't get up to date drivers for those machines (or if the machines only connect through traditional parallel ports). You're not going to toss a $100K machine which is still working just because you can only run it with an ancient computer.

All that said, if upgrading is necessary here the need to retrain employees can be avoided by running an XP VM with whatever software the employees are used to on it. This to me is the best feature of modern OSes. I didn't even have to worry about not accessing my old XP install when I upgraded to 7. If I needed to do something and the software wasn't installed, I just fired up the VM I made out of my XP install. If I needed to fire it up enough times to access the same piece of software, then I installed that software on 7. In some cases though I couldn't-the software just wouldn't run. That was only a few things. Surprisingly, I can even run my DOS-based PC CAD software from 7 via DOS-Box.

 

[jtr1962]

I'd be setting down two or three cast-in-stone, never-ever-break rules:

1: No IE. Absolutely forbidden.
2: No Outlook Express.
3: No Windows Picture and fax viewer

Get rid of those three (are there any other big ones I've missed?) and you have got rid of the major attack vectors. My guess is that you'll be just fine. (Of course, I am assuming a proper firewall. But that's a given.)

Just out of curiosity, exactly what do people use Outlook Express for anyway? I know it's for emails, but when I read or write emails I just do that from my web browser. Yes, Yahoo and the like always change how their email works, and it gets annoying at times, but I would imagine keeping Outlook Express set up to work smoothly with a bunch of different email clients is even more of a pain. And for what? It performs exactly the same functions as anyone can do by going to their email site with their browser. The only thing you can't easily do is save emails on your hard drive. However, Zimbra lets me do that without too much pain. I would imagine there are other things which perform the same function.

Windows picture and fax viewer seem even more useless although I've only fired them up once or twice. Are faxes even used all that much these days?

 

[Mercutio]

Why just not move to Windows 7 Pro and its XP Mode? You can still use the XP Mode for the retarded applications, but use the rest of the system to interact with the world. I've used this several times over the years for people who wanted to use printers that were not supported in recent versions of Windows. It worked well.

Plenty of stuff doesn't virtualize, often because it needs access to hardware in a way that the VM can't provide. One of my customers has a line of business application that still uses (sigh) a parallel port dongle. The application vendor stopped supporting the version of the application my customer has in the year 2000. It's a bit of a miracle that it works acceptably on XP in the first place, but he doesn't want to spend $500/month to access the updated, web-ified version and he doesn't want to pay $12k for a perpetual license, so about half the PCs at his site need to be XP machines that have parallel ports and will until he decides to move on.

 

[Mercutio]

Why just not move to Windows 7 Pro and its XP Mode? You can still use the XP Mode for the retarded applications, but use the rest of the system to interact with the world. I've used this several times over the years for people who wanted to use printers that were not supported in recent versions of Windows. It worked well.

Plenty of stuff doesn't virtualize, often because it needs access to hardware in a way that the VM can't provide. One of my customers has a line of business application that still uses (sigh) a parallel port dongle. The application vendor stopped supporting the version of the application my customer has in the year 2000. It's a bit of a miracle that it works acceptably on XP in the first place, but he doesn't want to spend $500/month to access the updated, web-ified version and he doesn't want to pay $12k for a perpetual license, so about half the PCs at his site need to be XP machines that have parallel ports and will until he decides to move on.

 

[Mercutio]

Just out of curiosity, exactly what do people use Outlook Express for anyway?

A LOT of people are under the mistaken impression that Outlook Express is the same thing as Outlook, or it's what they've always used.
In a business setting, sometimes it is useful to be able to send batch messages, schedule sending, check multiple accounts, configure message filters or rules where a webmail client probably won't have those options. Those are arguments for having a full-featured email client, but Outlook Express doesn't really support most of those things anyway.

Almost nothing that does "Scan to E-mail" will work directly with a webmail client, which is another reason it might be configured. I've seen HP scanners that would only scan to Outlook or Outlook Express E-mail, for example

I strongly prefer to set up Thunderbird for all that stuff, but just like Juno dial-up and Bonzi Buddy, I still run in to people using OE from time to time.

 

[jtr1962]

Plenty of stuff doesn't virtualize, often because it needs access to hardware in a way that the VM can't provide. One of my customers has a line of business application that still uses (sigh) a parallel port dongle. The application vendor stopped supporting the version of the application my customer has in the year 2000. It's a bit of a miracle that it works acceptably on XP in the first place, but he doesn't want to spend $500/month to access the updated, web-ified version and he doesn't want to pay $12k for a perpetual license, so about half the PCs at his site need to be XP machines that have parallel ports and will until he decides to move on.

That's exactly the kind of situation I was thinking of when I wrote my lengthy post above. When you're locked into a combination of hardware/software which still works fine for you, upgrading just for the sake of switching to a more modern OS is at best an expensive proposition. In this case, your customer is actually semi lucky that he can upgrade even if it'll cost an arm and a leg. In many cases the companies/people who wrote old software or made old hardware are long gone. Such is the case with my microcontroller programmer. Drivers don't exist for anything newer than XP, and it won't work through a VM because the driver needs direct hardware access. I need to dual boot into XP to get it to work. At least I can get a USB programmer for about $20 which programs some of the chips my older $600 programmer does but not all of them. I feel for anyone stuck with expensive hardware which still works but the designers are long gone. They're tasked with keeping increasingly ancient PCs going just to keep their hardware working. I would imagine with today's technology it's possible to make something equivalent to a DOS-based 386 or 486, complete with a few GB of storage, in something not much bigger than what ports it needs to have. That might be a great solution to the kinds of problems we're discussing.

 

[ddrueding]

In this case it is the fact the the hardware itself will barely run XP (512MB RAM, P4, IDE, paralel printers, etc). The price I gave them was for new everything. For a small business that is hanging onto viability, $10K is a large amount.

 

[Chewy509]

At least I can get a USB programmer for about $20 which programs some of the chips my older $600 programmer does but not all of them. I feel for anyone stuck with expensive hardware which still works but the designers are long gone.

We actually have a similar problem now with some of the USB based chip/jtag readers we have at work - there are only drivers for Win7 x86 (32bit). Won't work on x64 nor Win8 as the drivers are strictly 32bit and are not digitally signed. Lucky for us VirtualBoxes USB emulation works good enough that we can still use them. But I completely understand the issues with parallel ports, etc.

At least there are some manufacturers selling motherboards with ISA slots and parallel/serial ports (that are on IBM AT defined IO Ports/IRQs).

eg, http://www.esis.com.au/Mainboards/Mainboards.htm

 

[Howell]

Maybe they have enough money to put into a local proxy or even opendns if the free version suits them.

 

[sedrosken]

3: No Windows Picture and fax viewer

I don't want to sound ignorant, but how is Windows Picture and Fax viewer an attack vector, exactly? And wouldn't those vulnerabilities also affect alternate image viewers?

mubs: Why not? I do it for my old games that crash WINE. Aside from UT '99 only being playable in a window (seems to be a common issue for me lately, but as I can still play it I really couldn't care less at this point) I have no issues running XP in VirtualBox under Linux Mint 16 with Virtual Machine Additions added in -- oh wait a minute, you meant for driver support... yeah, I got nothing.

jtr1962: I use Thunderbird, and yes, it was a bit of a pain to get it set up with web-based accounts. But, I managed it, and the POP3 and IMAP settings for Yahoo and Gmail are able to be used in Outlook Express (which I know is a major security leak mostly because it hasn't been updated in years). Now I don't have to wait for my wimpy connection (and wimpy computers) to load the web-based javascript-heavy clients, and I have all my emails in one place, which seeing as I only use this and one other machine regularly, suits me perfectly. In a computer lab setting this is really not feasible however. Also ditto on Mercutio about the scanners and stuff not saving to webmail.

 

[Chewy509]

I don't want to sound ignorant, but how is Windows Picture and Fax viewer an attack vector, exactly? And wouldn't those vulnerabilities also affect alternate image viewers?

There have been a number of very well published exploits against the MS supplied TIFF and jpeg rendering libraries, which the Windows Picture and Fax viewer rely on.

As for why other applications don't suffer the same fate, most image viewing applications will use their own TIFF and jpeg rendering libraries for a number of different reasons.

 

[Tannin]

I don't want to sound ignorant, but how is Windows Picture and Fax viewer an attack vector, exactly?

Someone crafts a malformed image file (JPEG or etc.) which looks like a picture and acts like a picture except that when you open it in anything that uses the Microsoft image-rendering DLLs, it attacks bugs in them (typically via buffer overflows) to start executing it as code and - Hey Presto! - you are infected with something nasty. These attacks are quite common and have been around for years - they discover a vulnerability and exploit it, MS eventually patches that particular hole, and they move on to find another vulnerability. Software affected is typically anything that renders an image using the Microsoft common code. I don't have a list but it certainly includes Internet Explorer, some versions of MS Office, Outlook Express, and whatever else uses that same shared Microsoft code to view images. None of these things will be patched after April, so we are talking major vulnerability here, and one which is virtually certain to be exploited, just as it has been many times in the past.

And wouldn't those vulnerabilities also affect alternate image viewers?

No. They use their own code, and it's usually of vastly better quality. I'm not saying that there has never been a virus crafted to attack XNView or ThumbsPlus or PMView or Irfanview or any of the dozens of others, but I've never heard of one, not in all these years. It's only the Microsoft stuff.

EDIT: Woops, didn't see Chewy's reply above, which already answered that question.

 

[Tannin]

I'd be setting down two or three cast-in-stone, never-ever-break rules:

1: No IE. Absolutely forbidden.
2: No Outlook Express.
3: No Windows Picture and fax viewer
4: No Windows Media Player!!!
Get rid of those three (are there any other big ones I've missed?) and you have got rid of the major attack vectors. My guess is that you'll be just fine. (Of course, I am assuming a proper firewall. But that's a given.)

How on earth did I forget that last one? Sheesh! It's the most obvious one of the lot! (Well, apart from Internet Exploder, of course.)

 

[Tannin]

Why just not move to Windows 7 Pro and its XP Mode?

All other reasons aside, $A250 per licence. At that price for the OS alone, you might as well buy a whole new machine. Note that it's the Pro version we need for this, which is not far off double the price of the standard version.

 

[Bozo]

Why just not move to Windows 7 Pro and its XP Mode?

If the hardware is over 3 years old, why bother?

 

[Stereodude]

In this case it is the fact the the hardware itself will barely run XP (512MB RAM, P4, IDE, paralel printers, etc). The price I gave them was for new everything. For a small business that is hanging onto viability, $10K is a large amount.

And then there are companies like the one I work for. They're trying to save money everywhere in all sorts of petty ways. To the point where they've told us the coke/diet coke and bottled water in the fridge is only for visitors, not for employees. But, the IT department contacts me the other day telling me they want to replace my Lenovo T410 running Windows 7 (that's about 3 years old) with a new Lenovo T430. The specs on the T430 are basically identical to the T410 I have now. Same crap res 1600x900 TN LCD screen, same 500GB 7200RPM HD, same spec optical drive, 9 cell battery just like the T410, The processor is slightly faster, but it's barely worth mentioning. Basically replacing the machine I have now with the new equivalent just for the sake of phasing out all the old T400/T410's. I told them to pound sand unless they wanted to give me a machine that would actually help me do my job better, like a lighter T440s with the 1920x1080 IPS screen and a SSD.

Penny wise and pound foolish... :frusty:

 

[ddrueding]

Average lifespan of a PC in all the businesses I manage is probably around 5-6 years, though there are some 8-10 year old machines still cranking.

 

[snowhiker]

And then there are companies like the one I work for. They're trying to save money everywhere in all sorts of petty ways.

.... <snip> ....

Penny wise and pound foolish... :frusty:

Sounds like my company. Option A) Spend $100 ONCE to permanently and correctly fix a problem? NO WAY can we afford that. Don't even ask. Option B) Spend $10/week for the next 60 years. Sure no problem.

 

[Santilli]

Sounds like my house...

The Beast, which DD is working on, is down. I've had to move to move the HTPC in, and I'm now doing my business stuff on it.

I kept the HTPC on XP3 because of a lack of drivers in 7 for the sound card and printer. I do understand why people keep XP around. Some
of the old hardware was just REALLY good, and lasts forever. Examples are my Xerox printer/copier, 130 something, and the HP 4000N that continues to run
perfectly. Both bought around 2000, and still going strong. Hard to throw away a $1200-1700 printer that works flawlessly.

Why doesn't anyone make DVI monitors anymore??? Samsungs' are all HDMI or analog. Thank God for Costco's return policy...
The sad part for me is the apparent similarities in certain areas, where XP and 7 are both similarly slow. Even with the hardware in the Beast, their are spots where 7 slows, as does XP on the 3800+ X2 Athlon.

I run two XP3 machines now. The Panasonic laptops don't have drivers for 7, so they stay on XP. Both machines use Peerblock, windows firewalls, and Avast and or Nod32.

I download a lot of stuff, and it's been a very long time since a scan has nailed a bad file, trojan, or virus.

Still, it does happen.

I try and use Firefox for just about everything...

 

[Santilli]

Even with SSD's in both machines, and respectable old cpus, file transfers are so slow it's painful. If the old business requires moving fairly good sized files, it would be a real incentive
to move up to 7 or 8..

 

[Stereodude]

Why doesn't anyone make DVI monitors anymore??? Samsungs' are all HDMI or analog.

I'm not sure what monitors you're looking at, but most I've seen still have DVI. However, you can get DVI to HDMI adapters or cables since they are electrically compatible.

 

[Tannin]

^ Yp. Cost about $10

 

[sedrosken]

I kind of want to get my hands on my relative's old A64. Single Core. Same model computer, too! HP Pavilion A700N. Mine's an Athlon XP 3000+ with a 333MHz FSB. Theirs is a single A64. They don't use it anymore. I really hope they don't throw it away. Also, their monitor (exactly the same as mine... conspiracy?). I want that too, especially seeing as THEY NEVER USE the stuff. They bought two brand new laptops they use for everything now. I'm jealous, they have i5s while I'm chugging along on a PDC.

I am pretty sure that with the proper upgrades both Pavilions would run 7 flawlessly. But I don't have that kind of money, so Linux it is.

 

[LunarMist]

Are there no SOPs that require a risk assessment for such situations?

 

[ddrueding]

Nope. Just me. I'll be meeting with the boss tomorrow to discuss which machines, in my opinion, are too critical to risk with XP and which machines can afford to go down for a while. Considering he will be interested in minimizing the number of "perfectly good working computers" that we replace, I'll need to offer my opinion on likely consequences (odds, degree of impact, etc).