What to do to secure your IT infrastructure until you’ve migrated all workstations to Windows 11

Until you’ve migrated all workstations to Windows 11, computers still running older systems must be isolated on the network, given extra protection and, where possible, covered by paid security updates (ESU). We published this article in August 2020, when the problem was Windows 7. Since then, history has repeated itself: support for Windows 10 ended on October 14, 2025.

From a security standpoint, a network is only as secure as the most vulnerable device connected to it.

What happened during the move from Windows 7 to Windows 10?

Support for Windows 7 ended on January 14, 2020. Since then, Microsoft has provided no more security or feature updates, and every computer left on Windows 7 became a security hole.

In 2020, Windows 7 Professional and Windows 7 Enterprise systems enrolled in the Extended Security Updates program still received security updates, but even so they were more vulnerable than Windows 10, because they used outdated technologies. The program ended in January 2023: since then, Windows 7 and Windows 8.1 have received no updates at all.

To ease the transition, Microsoft allowed a free upgrade from Windows 7 and 8.1 to Windows 10, officially until July 29, 2016. For years afterwards, the free upgrade from Windows 7 or Windows 8.1 to Windows 10 still worked technically, but since 2023, Windows 7 and 8.1 licenses no longer activate Windows 10 or Windows 11 for free. The details are in our article on the free upgrade to Windows 10.

What do you do with workstations still on Windows 10?

Windows 10 hasn’t received free security updates since October 14, 2025. The ESU program for home users ended on October 13, 2026, and companies can buy ESU, paid per computer, until October 2028 at the latest. The cost rises every year, so ESU is a transitional solution, not a lasting one.

Compatible computers can move to Windows 11 for free: they need TPM 2.0, UEFI with Secure Boot, a processor on Microsoft’s list, 4 GB of RAM and 64 GB of storage. Incompatible ones get replaced, and until then they get ESU or are isolated from the rest of the network. See also how to get ready for Windows 11.

We recommend upgrading all workstations to Windows 11, because that heads off many problems, from irreversible data encryption to errors when running applications.

Preventing problems is the ideal case, but implementing the right backup policy is essential, for example through Backup as a Service.

How do you secure your IT infrastructure until the migration is complete?

Until the migration is complete, the IT team should implement the following network security solutions:

• a clear inventory: which computers still run Windows 10 and which applications are holding them back;
• up-to-date security solutions on all workstations (antivirus with detection and response, anti-spam) and a firewall at the edge of the network;
• auditing the network infrastructure and isolating workstations not yet upgraded to Windows 11 in a separate network, with access only to the applications they need;
• ESU for the Windows 10 computers that are still in use;
• turning off remote access exposed directly to the internet: RDP ports closed, access only through a VPN, and two-step verification for every service that supports it;
• up-to-date applications; watch out for Office 2016 and Office 2019, which haven’t received updates since October 14, 2025;
• secure passwords, different for each account, kept in a password manager;
• a dedicated guest network, isolated from the main network (see how to secure your office wireless network);
• regularly tested backups, so restoring works when you need it.

RezolvIT proposes and implements security systems and solutions for all its IT maintenance clients. We’ve helped companies of all sizes migrate to Windows 10, from small businesses to subsidiaries of multinationals, and we’ll help you move to Windows 11 the same way. If you want to find out which computers can be upgraded and what needs replacing, ask for a free IT audit.