Letting Go of Windows NT

Jan. 1, 2007, was a significant day for automation and control systems. It is the day that Microsoft dropped all support for Windows NT 4.0. Dennis Brandl takes a look at some of the options.

Microsoft stopped general support (security or bug fixes) of Windows NT 4.0 in January 2005, but there was a pay-per-incident plan available until December 31, 2006. As of January 1st, there was no more support, and this is a problem for automation systems that have not yet reached their end of life.

The typical automation system will have a useful life of 15 to 20 years – much longer than the typical nine years of computer operating system support. With no support, Windows NT systems will become increasingly vulnerable to virus and worm attacks, exploits, rootkits, and server failures that require expertise and assistance to restore operations.

While targeted viruses and worms will gradually disappear, many recent attacks have been backward compatible and affect current and older versions of Windows and applications.

Be FEARLESS

One approach to addressing the loss of support is to follow the “I AM FEARLESS” approach. This is short for Isolate, Apply Major patches, Fix, Enhance, Abandon, or Retire Legacy Shopfloor Systems. (Thanks to Jeff Lucatorto of Merck for the acronym.) I AM FEARLESS provides a quick reminder of the remediation approaches that should be taken for Windows NT phase-out.

- “Isolation,” which means disconnecting the system from the corporate network, is only a short-term solution. This does not guard against server failure, but does provide time to implement long-term solutions.

- “Applying Major patches” requires obtaining the last set of patches for Windows NT 4.0 (Windows NT Rollup Security Path 6a, from October 2006), testing the patches, and applying them to the production systems. This will provide some security and additional stability, but is still not a long-term solution.

- “Fixing the problem” is a long-term solution. It requires updating Windows NT and applications to newer supported versions. This is often the lowest cost alternative, but it is not always possible, especially when the applications are no longer available or there is no upgrade path. When a fix is not possible, then enhancing is the next best choice.

- "Enhancing the system” means to update Windows NT and the applications to new versions with enhanced user functionality. Many users of older systems can justify the expense of adding new functionality at the same time the system is updated. Enhancements are often possible when there is an application upgrade path. If no upgrade path exists, then the choices are to abandon the system or replace it.

- “Abandon” means to retire the server and the application. While the application was probably essential when it was initially installed, often other, newer applications duplicate the older application's functionality, but do not have the functions turned on. The older applications were kept in place because it was less painful to keep them going than to eliminate them and use the alternative. With the loss of Windows NT support, it is better to switch to supportable applications.

- “Replace” means to replace the existing application and server with a new supported application. This is usually the most expensive and time-consuming alternative, but it is the choice when all else is eliminated. If the application is critical, there is economic justification for replacement. If the application is not critical, then it should be abandoned, because it is a security risk and will shortly be unmaintainable.

Use I AM FEARLESS to help define your upgrade decisions. And if you have already taken care of Windows NT 4.0 applications, then get ready for the next upgrades when Windows 2000 support is dropped.

Author Information :

Dennis Brandl, brandl@brlconsulting.com, is president of BR&L Consulting in Cary, NC, which is focused on manufacturing IT issues.