Guide
Obsolete systems and software: keeping them safely
Windows 7, Windows Server 2012, Windows 10, CentOS 7… Many businesses keep a system that is no longer updated, often for a good reason. Here are the risks, the possible options and good practice for keeping it without exposing the rest of your IT.
Updated on 18 October 2026 · Figures are sourced at the bottom of the page; opinions are those of IT CyberWall.
What is an obsolete system?
A system or piece of software becomes obsolete when its publisher stops maintaining it: no more security patches, no more bug fixes, no more support. It keeps working, but every flaw discovered after that date stays open.
Some end-of-support dates for systems that are still very common in businesses:
| System | End of support | Paid extension |
|---|---|---|
| Windows 7 | 14 January 2020[1] | Ended |
| Windows Server 2008 and 2008 R2 | 14 January 2020[2] | Ended |
| Windows Server 2012 and 2012 R2 | 10 October 2023[3] | Extended Security Updates (ESU) until 13 October 2026[3], so now ended |
| Windows 10 | 14 October 2025[4] | ESU for businesses, for three years at most[5] |
| CentOS Linux 7 | 30 June 2024[6] | Only by converting to a commercial offering[6] |
| Debian 10 « Buster » | 30 June 2024 (end of long-term support)[7] | Third-party commercial offerings |
Software follows the same logic: management software, a driver or a database discontinued by its publisher poses the same problem, even on an up-to-date system.
Why it is risky
- Flaws that will never be fixed. Once support ends, the publisher no longer releases patches[3][4]. An attacker who knows about a flaw knows it will stay exploitable.
- A way into the rest of the network. A vulnerable machine connected to the same network as your workstations and servers can be used as a springboard.
- Ageing hardware. Disks, power supplies, motherboards: failures become more likely and spare parts scarcer.
- Declining compatibility. Recent browsers, antivirus, printers and software stop working on the old system one after another.
The possible options
| Option | Advantages | Limitations |
|---|---|---|
| Update or migrate | Back to a maintained system: the only lasting solution. | Only possible if the software exists for the new system. Requires testing. |
| Pay for extended updates | Security patches continue, with no immediate change. | Temporary and costly: for Windows 10, the price per device doubles every year[5]. Not available for every system. |
| Replace the software | A modern solution, often with more features. | Data migration, training, cost and lead time. |
| Keep and isolate | The only choice when nothing else is possible right away. | The system remains vulnerable: it must be isolated, backed up and its exit planned. |
These options are often combined: the old system is isolated while the migration is prepared.
Good practice if you have to keep it
- Record it. Note which system, which software, why it is being kept, who uses it and until when[8].
- Isolate it from the network. A separate network, with only the traffic that is strictly necessary[8]. No internet access if it does not need it.
- Do not use it for anything else. No email, no web browsing, no unknown USB sticks.
- Give it its own accounts. Usernames and passwords that are not used anywhere else[8].
- Control file exchanges. A single, scanned exchange folder, rather than access to the company network.
- Have it backed up. A backup that has never been restored is only an assumption: backup frequency and restoration tests are decided with your backup provider.
- Monitor it. Disk, availability, unusual login attempts.
- Set a review date. Every year, ask the question again: can we finally do without it?
Why virtualise an obsolete system
Virtualising means turning the physical machine into a virtual machine running on a recent server. For an obsolete system, it is often the simplest way to apply the good practice above:
- Hardware is no longer a problem. The old PC can be retired; the system runs on recent, maintained hardware.
- Isolation is easier. The virtual machine’s network is configured in the hypervisor, with no rewiring.
- Rollbacks are immediate. A snapshot before each intervention lets you roll back in a few seconds; a virtual machine can also be backed up in its entirety.
- You can test with no risk. A copy of the machine lets you try an update or a migration without touching the original.
Limitations to check: some licences are tied to the original hardware, and some old expansion cards cannot be passed through to a virtual machine. A USB licence dongle, on the other hand, usually can.
Preparing the exit: testing an update on a copy
- Copy the virtual machine into a test network, cut off from production.
- Apply the update or migration to the copy: new system, new version of the software, or export of the data to another tool.
- Have users check that everything works: printing, exchanges with the controlled machine, old files.
- Measure how long the operation takes and note any sticking points.
- Switch over to production with a proven procedure, keeping the old machine read-only for as long as needed.
If the test fails, you simply delete the copy: production is unaffected.
What IT CyberWall does
We handle your obsolete systems from start to finish: capture of the existing machine, network isolation, monitoring, then update or migration trials on a copy when the time comes. The virtual machine runs on the hypervisor of your choice, on your premises or in a data centre. Its backup is entrusted to WeDoBack.
A system you cannot give up?
Describe your situation: we will propose a solution to protect it, and then to move away from it.
Sources
Sources consulted on 18 October 2026. Supplier prices are shown excluding tax, in the currency and region of the published price list, and may change: always check the official page before deciding.
- Microsoft – La prise en charge de Windows 7 a pris fin le 14 janvier 2020 — support.microsoft.com/en-in/help/4057281/windows-7-support-ended-on-january-14-2020
- CISA – Microsoft Ending Support for Windows 7 and Windows Server 2008 R2 — us-cert.gov/ncas/alerts/aa19-290a
- Microsoft Lifecycle – Windows Server 2012 and 2012 R2 reaching end of support — learn.microsoft.com/en-us/lifecycle/announcements/windows-server-2012-r2-end-of-support
- Microsoft – Windows 10 support has ended on October 14, 2025 — support.microsoft.com/en-us/windows/deployment/updates-lifecycle/windows-10-support-has-ended-on-october-14-2025
- Microsoft Learn – Extended Security Updates (ESU) program for Windows 10 — learn.microsoft.com/en-us/windows/whats-new/extended-security-updates
- CentOS Project – End dates are coming for CentOS Stream 8 and CentOS Linux 7 — blog.centos.org/2023/04/end-dates-are-coming-for-centos-stream-8-and-centos-linux-7/
- Debian – Annonce de la fin de vie du suivi à long terme de Debian 10 — www.debian.org/News/2024/20240615.fr.html
- ANSSI – Guide d’hygiène informatique, v2.0 (measures 14, 34 and 35) — messervices.cyber.gouv.fr/documents-guides/guide_hygiene_informatique_anssi.pdf
Backup and restoration are operated by WeDoBack.