Order in the environment
The old system you cannot replace — how to live with it
Every guide says „replace it”. This one is about the situation where you cannot, and the machine still has to run for another three years.
9 min read · checked: August 2026
In production plants, laboratories and small workshops there are computers that cannot be upgraded. Not because nobody wants to — because they drive a piece of equipment whose manufacturer never released a driver newer than a system from a decade ago. Or the manufacturer no longer exists.
“Replace it” is useless advice here. Replacement means replacing the equipment, and that can run to hundreds of thousands for a machine that works perfectly well.
This note is about what to do when replacement is off the table — and how not to pretend to yourself that the problem is not there.
First establish what this really covers
Very often it turns out that the old system is needed by a smaller part of the environment than everyone assumes.
Three questions:
- Does the driver genuinely not exist, or has nobody checked for five years? It happens that the manufacturer released a newer version and nobody looked.
- Does the equipment need this computer, or only this software? Some such software runs on a newer system in compatibility mode or inside a virtual machine.
- Does the communication go over a serial port, or over something that can be translated? Converters and serial port servers are often cheaper than accepting the risk for another few years.
If the problem disappears after those three questions, the subject is closed. If not, we move on to living with it.
The principle: it is to be an island
A machine without patches is not by definition a catastrophe. The catastrophe is a machine without patches sitting on the same network as everything else, with internet access and access to file shares.
The goal is single: to make its eventual compromise mean nothing beyond itself.
Cut off internet access
This machine almost certainly does not need the internet. It drives equipment; it does not browse. Cutting outbound traffic closes the route by which malware downloads itself and through which it communicates.
If the software vendor requires a connection to a licence server, allow that one address and nothing else.
Isolate it on the network
A separate VLAN or a separate physical segment, with a rule permitting only what has to pass: communication with the equipment and possibly one connection from one computer for transferring results.
A practical tip: describe that rule in a comment in the firewall configuration. In two years nobody will remember why those particular ports.
Block removable media
Since the machine has no internet, what is left is the USB stick — and that is a real infection route in such environments, because results are moved exactly that way.
If removable media must be used, designate one dedicated, labelled stick used nowhere else. It is a non-technical solution and that is why it works: people can stick to it.
Switch off what it does not use
Old systems have services enabled by default that nobody needs — file sharing, remote desktop, legacy network protocols. Every disabled service is one route fewer.
An image of the whole machine, not just the data
With a computer like this, a file-level backup is not enough. Restoring a decade-old system onto new hardware after a disk failure is often impossible: there are no drivers, no installation media, no licence key, and the person who configured it left eight years ago.
What is needed is an image of the whole machine and, if possible, a check that it boots in a virtual machine. That takes half a day once and is the only thing standing between a disk failure and a halted production line.
If the physical machine can be virtualised at all — do it. A virtual copy is easier to restore, easier to isolate and easier to freeze in time.
Write down why it is like this
The most frequently skipped step and the most valuable.
One page: what this machine is, what equipment it serves, why it cannot be upgraded, what restrictions were applied and when the matter is to be reviewed again. Without a review date such a machine stands there until it draws attention to itself in the worst possible way.
The review date also matters because the situation shifts: the equipment manufacturer releases a new driver, the company replaces the machine anyway, a substitute appears. Without a written deadline nobody notices.
What not to do
Do not pretend this is fine because “it works and nobody has complained”. The risk exists regardless of whether anyone is talking about it.
Do not try to patch the system with fixes from unofficial sources. Unofficial patch bundles for retired systems are exactly the kind of file you do not want to run on a machine you cannot restore.
Do not leave it unrecorded. The knowledge “this machine is special”, living only in somebody’s head, leaves with that person — and then somebody plugs it into the ordinary network, because all computers are on the ordinary network.
One sentence to close
You cannot make a machine without vendor support secure — you can make its compromise mean nothing beyond itself, and its failure not stop the company. That is a realistic goal and it is achievable in a few days.