Editorial · March 3, 2014
Windows XP End of Support: What Small Firms Should Do
Windows XP end of support will come on April 8, 2014. After that day, Microsoft will no longer provide security updates or technical support for XP. XP computers will still work. But a PC running XP after that date "should not be considered to be protected," Microsoft says. That leaves small firms 36 days to decide what happens to each XP machine.
What will end on April 8
Microsoft's lifecycle fact sheet lists April 8, 2014 as the end of extended support for XP. In a January 2014 post, the Microsoft Malware Protection Center spelled out what "no longer supported" means. After April 8, 2014, XP users will no longer receive:
- new security updates
- non-security hotfixes
- free or paid assisted support options
- online technical content updates from Microsoft
Office 2003 will lose support the same day, including its security updates.
What the loss of updates means
Security updates patch weak spots that malware may use, Microsoft says. In April 2013, with 52 weeks to go, the Microsoft Security Response Center wrote that XP leaving support does not mean attackers will stop trying to exploit it. But "the absence of new security updates will make it easier for attacks to succeed," it added.
Microsoft's page for businesses warns of other risks. Many software makers will stop supporting their products on XP, and the new Office will not run on it. Most PC makers will stop supporting XP too, so XP drivers for new hardware may not be available. Firms bound by rules such as HIPAA may find they can no longer meet compliance requirements.
The U.S. Department of Health and Human Services (HHS) says the HIPAA Security Rule sets no minimum requirements for PC operating systems. But the rule does set requirements for information systems that hold electronic protected health information. HHS also says an organization the rule covers should consider known weaknesses in its operating system in its risk analysis. One example is a weakness with no patch because the maker no longer supports the operating system.
Why antivirus is not a fix
Microsoft will stop offering Microsoft Security Essentials, its antimalware program for consumers, as an XP download on April 8. A PC that already has it will keep getting signature updates for a limited time. In January, Microsoft said it would keep sending signature and engine updates for its own antimalware programs to XP users through July 14 of next year. The aim, it said, is to help organizations finish moving off XP, and the end-of-support date does not change.
Microsoft says these updates do not make a PC secure. "[T]he effectiveness of antimalware solutions on out-of-support operating systems is limited," the Microsoft Malware Protection Center wrote. Antivirus software "will also not be able to fully protect you once Windows XP itself is unsupported," the business page adds. If you use another brand of antivirus, our editors suggest asking its maker what it plans for XP.
Your options for old PCs
Microsoft gives two ways to stay protected: upgrade the PC you have, or get a new one. It says very few older computers will be able to run Windows 8.1, the latest version of Windows. To run it, a PC needs:
- a processor of 1 GHz or faster with PAE, NX and SSE2 support
- 1 GB of memory (2 GB for the 64-bit version)
- 16 GB of hard disk space (20 GB for 64-bit)
- a DirectX 9 graphics device with a WDDM driver
Microsoft recommends running its Upgrade Assistant to check whether a PC meets these needs. Even a PC that passes the check needs a clean install from a DVD to move from XP to Windows 8.1. Microsoft says you will not be able to keep any files, settings or programs, so it recommends a backup first.
If a PC meets the requirements for Windows 7 or Windows 8.1, Microsoft's business page says you can buy Windows 7 Professional or Windows 8.1 Pro. The lifecycle fact sheet lists October 31, 2013 as the end of retail software sales for Windows 7 Professional. The sheet also says PC makers can still sell Windows 7 Professional, with no end date set yet. If a PC does not meet the requirements, the business page says to consider a new business PC with Windows 8.1 Pro.
A plan for the next 36 days
Our editors suggest these steps, in this order:
- List every XP computer and every copy of Office 2003. Both will lose support on April 8.
- Rank the machines by what they hold. Customer, payment and health records come first.
- Ask each software and hardware maker whether its product works with the Windows version you plan to move to.
- Back up your files and gather program discs or purchase emails before any clean install, as Microsoft recommends.
- Wipe each old drive before the PC leaves your hands.
- If a machine must stay past April 8, keep customer, payment and health records off it.
Microsoft says most programs written for earlier versions of Windows will work in Windows 8.1. But it says some older ones "might run poorly or not at all" there. Windows XP Mode in Windows 7 follows the same support lifecycle as XP, so extended support for it will end April 8 too.
The FTC says deleting a file leaves its pieces on the drive until they are overwritten, and a data recovery program can retrieve them. It suggests a program that overwrites the drive many times, or removing the drive and destroying it. It adds that the law requires businesses to follow data security and disposal rules for certain customer information.