Windows 7 end of support is January 14, 2020. That is five months from this writing. If your estate is already on Windows 10 with sane servicing rings, this post is confirmation bias — go back to patching. If you still have a material Windows 7 population, this is triage: what moves, what pays for ESU, what hides in VDI, and what gets isolated because it will never be good.
We have run Windows 7 to 10 programs with SCCM task sequences at enterprise scale. We have also inherited the last five percent that "cannot move." The last five percent is where security risk and business exceptions stop being theoretical.
The triage matrix
Sort every remaining Windows 7 device into one bucket with an owner and a date:
| Bucket | Action | Typical examples |
|---|---|---|
| A — migrate | In-place or wipe-and-load to Windows 10 before EOL | Standard office laptops with supported apps |
| B — ESU | Pay Extended Security Updates for a bounded set | Regulated systems with dated app certification |
| C — contain | Publish the app on VDI/RDS; remove local Win7 where possible | Line-of-business client that only runs on Win7 |
| D — isolate | Network segment, no internet, compensating controls | OT-adjacent or vendor-locked boxes |
| E — retire | Power off | Shadows and "we might need it" PCs |
No bucket means no decision, and no decision means silent risk after January.
ESU is not a strategy; it is a bridge
Extended Security Updates buy time for a price. Use them when:
- The application vendor's Windows 10 build is dated after EOL
- A medical or industrial certification cycle cannot move
- You have a funded migration project with a 2020 date, not a wish
Do not buy ESU for the whole estate because project management failed. That converts a planning problem into a permanent tax.
App-compat is usually the real project
The OS upgrade is mechanical when the app list is clean. Inventory:
- Vendors who only support Windows 7 (get written roadmaps or replacements)
- Kernel drivers and print stacks
- Security agents that block in-place upgrade
- Home-grown EXE tools with no owner
SCCM application model and pilot rings still apply. In-place upgrade task sequences fail most often on drivers and disk space; wipe-and-load fails on user-state assumptions. Pick per form factor.
VDI as containment, not a trophy
Publishing a stubborn Win7-only app on a managed RDSH or XenDesktop pool can remove hundreds of local Windows 7 endpoints from the network attack surface while the vendor catches up. That is a valid C-bucket move. It is not free: you inherit VDI capacity, profiles, and the moral duty to retire the pool when the app is fixed.
We have used this pattern on clinical and manufacturing floors where the PC next to the machine cannot change OS on the hospital's schedule.
Network isolation for the true stragglers
Some devices will remain. Treat them as hostile:
- No direct internet
- Restricted east-west
- Jump hosts for admin
- Aggressive monitoring
- Compensating controls written for audit
"Vendor laptop under the desk" is how ransomware tutorials begin.
Patching and discovery between now and January
You still need inventory accuracy. SCCM collections for Windows 7, hardware warranty, and last logged-on user. Weekly burn-down charts to leadership. The program that only reports "percent Windows 10" without exception aging is lying with averages.
Security narrative for the board
After January 14, 2020, unpatched Windows 7 is not a technical footnote; it is an accepted risk. Write it that way:
- Count of devices remaining by bucket
- ESU spend vs migration spend
- Compensating controls for D and C buckets
- Residual risk owner (named human)
Boards can accept risk. They should not discover it from a ransomware headline.
Fast paths that still work in five months
- Autopilot or bare-metal for devices that are really refresh candidates
- In-place task sequences for hardware that is healthy and drivers exist
- Targeted VDI publish for the worst app offenders
- Procurement of ESU only with exit dates in the PO comments
What does not work: a new steering committee with no authority to retire sacred cows.
Coordination with identity and Office
Windows 7 stragglers often hold back modern auth policies, TLS standards, and Office channel updates. Every month you keep them, you slow the security baseline for everyone else. Treat Win7 burn-down as unlocking Conditional Access and browser standards, not only as an OS project.
Example exception ticket fields
Force every remaining Windows 7 device to carry:
- Business owner
- Application dependency name and vendor contact
- Bucket (A–E)
- Target date
- Compensating controls if past EOL
- Review date
If the CMDB cannot hold those fields, a spreadsheet owned by the program manager will. Orphans without owners become permanent exceptions by default — that is a choice, make it explicit.
Coordination with desktop and security
Desktop engineering owns task sequences and images. Security owns exception acceptance after EOL. Application owners own vendor pressure. When those three do not meet weekly, Windows 7 becomes everyone else's problem and nobody's deadline.
If you're facing this
Five months is enough for a controlled finish if the matrix exists today. It is not enough to start discovering applications in December. We run Windows 10 migration and exception containment programs — bring your true Windows 7 count and the list of sacred apps, not the count from last year's audit.