Windows XP Systems Fading but Still On the Prowl

During the Thanksgiving break, I had a number of simultaneous encounters with PCs in public places still sporting the Windows XP logo and it got under my skin. Among them was a computer near the checkout area at Home Depot. And within an hour I spotted another on a counter right next to the teller stations at my local Bank of America branch.

Given that we know Windows XP systems are no longer patched by Microsoft, the sight of them is becoming as uncomfortable as being near someone who has a nasty cold and coughs without covering his or her mouth. Speaking of spreading viruses, I've even been to two different doctors' offices in recent months that were running Windows XP-based PCs -- one of them is used to actually gather patient information and the other to schedule appointments. In both cases, when I asked if they planned to upgrade those systems, I got the equivalent of a blank stare. I don't think they had any idea what I was talking about.

Nevertheless, seeing a Windows XP PC just after I used the self-checkout terminal at Home Depot was especially unsightly given the  retailer's massive breach last month in which e-mail addresses were stolen. Home Depot Spokeswoman Meghan Basinger said: "Thanks for reaching out, but this isn't detail we'd discuss."

Now the Bank of America situation is a bit different. The day after the Thanksgiving holiday weekend, InformationWeek announced their IT chief of the year: Cathy Bessant, head of Bank of America's 100,000-person Global Technology & Operations, who manages an IT organization of 100,000 employees. That's a lot of IT pros and developers.

Bank of America appeared to have a strong IT organization just by the nature of the way the company is often first to market with new e-banking features and mobile apps. The bank's systems tend to be reliable and they haven't had any major breaches that I can recall. Also, having worked in the past for InformationWeek Editor-in-Chief Rob Preston, who interviewed Bessant and reported on the bank's ambitious IT efforts, I have no doubt the choice was a well vetted one.

So when he noted among the bank's many milestones this year that its IT team completed the largest Windows 7 migration to date (300,000 PCs), I felt compelled to check in with Bank of America Spokesman Mark Pipitone. Perhaps after updating so many systems, my inquiry sounded petty, but I was curious as to how they were dealing with these stray Windows XP systems. Were they paying $200 for premium support per system or maybe the PC was just front-ending an embedded system? (Microsoft does still support Windows XP embedded.) As such, I sent a picture of the system to Pipitone.

"Not knowing exactly what device you took a picture of, the best the team can tell is that it's an excepted device (there are some across our footprint), or it's a device that's powered on but not being used on a regular basis," Pipitone responded.

I made a trip to the branch and asked what the XP machine was used for. A rep there told me that it was used for those needing to access their safe deposit boxes. I informed Pipitone of that, though he declined to comment further. Maybe the lone PC I saw isn't connected to the Internet or it is otherwise protected. But the mere public display of Windows XP machines in so many different places for many tech-aware people is still disconcerting.

I laud Bank of America and others who have undertaken the painful move of modernizing their PC environments. At the same time, I look forward to a day when I don't have to see that Windows XP logo when I walk into a place of business, whether it's a doctor's office, a local restaurant or a major retailer or bank. Windows XP was a great operating system when it came out and I know some defenders of the legacy OS will be outraged by my stance -- many of whom are angered by Microsoft's decision to stop supporting it. But Windows XP machines are likely unprotected unless they're not, and never will be, connected to a network.

There is some encouraging news. Waiting in my inbox on December 1 right after the holiday weekend was a press release from StatCounter reporting that there are more Windows 8.1 PCs out there than those with Windows XP. According to the November report, 10.95 percent of systems are running Windows 8.1. Windows XP still accounts for 10.67 percent. This marks the first time that there are more Windows 8.1-based systems than Windows XP PCs, according to its analysis. Back in August, the combination of Windows 8 and Windows 8.1 systems achieved that milestone, so it could be argued the latest report is a minor feat.

Nevertheless, the stragglers will remain for some time, according to Sergio Galindo, general manager of GFI Software, a provider of Web monitoring and patch management software. "I'm aware of several companies that continue running large XP installations -- and even larger IT budgets -- that may have custom XP agreements," Galindo said. "Windows XP will continue to survive as long as it meets people's needs. To keep a network secure, IT admins and computer consultants can 'lock down' the accounts on the XP machines. I strongly advise that machines running XP be allowed only minimal capabilities and have no admin access. I also favor using more secure browsers such as Chrome versus Internet Explorer in these cases. Also, IT admins may want to shut off some of the more common attack vectors such as Adobe Flash. In the case of XP, less (software) is more (secure)."

By the way, just a friendly reminder: there are just over 200 days left before Microsoft will no longer support Windows Server 2003. You'll be hearing a lot about that from us and Redmond magazine's Greg Shields last month primed the pump.

Posted by Jeffrey Schwartz on 12/10/2014 at 12:54 PM