The shop floor PC that cannot be upgraded: living with legacy Windows on CNC, HMI, and test stations

The PC nobody is allowed to touch

Walk through almost any plant and you will find one. A beige tower bolted under a CNC control. A panel PC running the HMI on a packaging line. A test station in quality that only works with one specific software version and one specific card in one specific slot. Ask about it and the answer is usually the same: do not update it, do not unplug it, and if it breaks, call the person who set it up.

Often that machine is running a version of Windows that Microsoft stopped supporting years ago. Sometimes it is Windows XP or Windows 7. More and more often now, it is Windows 10.

That is not carelessness. These PCs are tied to equipment worth far more than the computer, and the vendor certified it on a specific operating system. So the PC stays.

The goal of this post is not to tell you to rip it out. It is to help you live with it safely, and to make sure that when it fails, you can get production back.

Know where the dates actually stand

It helps to be precise about what "unsupported" means, because the dates are often misremembered. These are from Microsoft's official lifecycle pages:

• Windows XP reached the end of extended support on April 8, 2014.
• Windows 7 reached the end of extended support on January 14, 2020. Paid Extended Security Updates were offered for certain editions, including the embedded editions, for up to three more years, and those have also ended.
• Windows 10 Home and Pro reached end of support on October 14, 2025. Microsoft offers a paid Extended Security Updates program for Windows 10 version 22H2, and organizations can receive security updates through it for up to three years after that date. ESU includes security fixes only, not new features or general technical support.
• Windows 10 IoT Enterprise LTSC releases follow their own, longer lifecycles. LTSC 2019 is supported until January 9, 2029, and LTSC 2021 until January 13, 2032.

That last point matters on the shop floor. Some machine builders ship equipment on IoT Enterprise LTSC, which may still be receiving security updates even though regular Windows 10 is past end of support. Before you assume a PC is unsupported, find out exactly which edition and version it is running. It takes minutes and changes the conversation.

Why "just upgrade it" is not an answer

The operating system is part of the equipment's certified configuration. The CNC or HMI vendor tested their software, drivers, and communication cards against that specific version. Change it yourself and you may lose support from the one company that can fix the machine. In regulated or customer audited work, a change can also trigger requalification of the process.

So the real questions are different:

• Does the equipment vendor offer a supported upgrade path, and what does it cost in money and downtime?
• When does the equipment itself get replaced, and can the PC upgrade wait until then?
• Until that happens, how do we keep this PC from becoming the way an attacker gets in, or the reason we cannot ship?

Write down the answers. That becomes your plan for each machine.

Fence it off

An unpatched PC is most dangerous when it can talk to everything and everything can talk to it. The single most effective thing you can do is limit that.

• Put shop floor machines on their own network segment, separate from the office network where email and web browsing happen.
• Allow only the traffic the machine actually needs. Usually that is a file share for programs, a connection to a specific server, or nothing at all.
• Block internet access unless the vendor has a specific, documented need.
• No email and no web browsing on these PCs. They are equipment, not workstations.

Our earlier post on carving up flat OT and IT networks covers how to do this without stopping production.

Control how programs and files get there

Programs, recipes, and test files have to reach these PCs somehow, often on a USB stick that has been in a dozen machines.

Pick one controlled path. A dedicated file share that only the right people can write to is a common approach. If USB is unavoidable, use designated drives that stay in the plant, and scan them on a separate, up to date machine before they go near the controller.

Treat vendor remote access as a door

Equipment vendors often need to connect in for support. That is reasonable. What is risky is a remote access tool that was installed years ago, runs all the time, and uses a password nobody has changed.

Make remote access something you turn on when needed, for a named person, and turn off when the session is over. Know which tools are installed on which machines. Our post on vendor and app access goes deeper on this.

Plan for the day it dies

For many plants the bigger risk is plain hardware failure. An old PC with its original drive will stop at some point, usually at a bad time.

Ask yourself honestly: if this PC failed tomorrow morning, how long until the machine runs again?

The things that shorten that answer:

• A full image of the drive, taken while it is working, stored somewhere other than the machine, and tested by restoring it to spare hardware at least once.
• Copies of the installers, license keys, drivers, and configuration files the vendor used, including any hardware license dongles and where they live.
• Spare hardware that is known to work with the image, especially if the PC uses special cards or older ports.
• Machine parameters and programs backed up separately, so a rebuild does not mean starting over.

Backups that have never been restored are a hope, not a plan. The same is true of images. Our post on testing ERP restores explains why the test is the part that counts.

Get the knowledge out of one person's head

On a lot of shop floors, the only full understanding of a legacy PC lives with one maintenance tech or one engineer who has been there for years. That works until they retire, change jobs, or go on vacation the week the machine fails.

For each legacy system, write down what it controls, the exact Windows edition and version, the software and versions on it, the vendor contacts, how remote support works, where the image and installers are, and the steps to restore it. Keep it somewhere the next person can find it.

Expect the questions

Customers with security requirements, and cyber insurance applications, increasingly ask about unsupported systems. You will get questions like: do you run end of life operating systems, and if so, how are they isolated?

"We have a few, and here is how we handle them" is a much better answer than "we are not sure." An inventory, a segmentation plan, and a recovery plan for each machine give you something honest to point to. Answer accurately. Do not claim controls you do not actually have.

Where to start this week

Make a list of every PC on the shop floor. For each one, record the exact Windows edition and version, what equipment it runs, who the vendor is, whether it can reach the internet, and whether a working image exists.

That list will show you where the real risk sits and which machines to isolate, image, or plan upgrades for first.

If you want a structure for the rest, our IT Resilience Framework lays out how we think about keeping operations running, and you can read how we work with manufacturers. If you would rather walk through your list with someone, book a time with us.

The machine can stay old. It just should not stay unknown.