The short answer: most small manufacturers can’t simply switch off legacy production PCs, because the machines depend on them. Instead, list them, keep them away from the office network and email, and hold a tested image of each one. Then plan replacement with the machine supplier rather than waiting for a failure.
This guide is for owners and operations managers at manufacturers in Meath, Cavan, Westmeath, Louth and Dublin. It covers the risks, containment, backups, the replace-or-contain decision and how a managed IT provider helps.
Why legacy production PCs stay in service
A shop-floor PC often runs the software that talks to a CNC machine, a PLC or a test rig. That software may only work on an old version of Windows. As a result, upgrading the PC can mean upgrading the machine software, or even the machine itself.
Machine suppliers sometimes need to approve changes, too. The National Cyber Security Centre’s guidance on securing operational technology notes that equipment manufacturer approval may be required before patching. It adds that patching cycles for these systems are often much longer than for office IT.
So legacy production PCs are usually there for a good reason. The goal is to manage them deliberately, not to pretend they don’t exist.
What are the risks?
An unsupported operating system no longer gets security updates. Therefore, known weaknesses stay open for as long as the PC runs. If that PC shares a network with office laptops and email, one infected laptop could reach it.
The NCSC guidance also points out a second risk. Even when ransomware only hits office IT, firms may shut down production as a precaution. In other words, poor separation can stop the line even if legacy production PCs aren’t infected.
Finally, there’s plain hardware failure. Old PCs fail, and replacement parts get harder to find. Without a recent image, a dead hard drive can mean days of reinstalling and reconfiguring machine software.
Isolating legacy production PCs from the office network
Containment starts with knowing what you have. The NCSC recommends an accurate asset inventory, including hardware type and software versions. It also recommends an up-to-date network diagram showing every external and vendor connection.
From there, the usual steps are:
- Put production PCs on their own network segment, separated from office PCs by a firewall.
- Allow only the traffic each machine genuinely needs, and block everything else by default.
- Remove email, web browsing and general file shares from production PCs.
- Control supplier remote access, so it’s only switched on when needed and logged.
- Restrict USB sticks, or scan them on a separate PC first.
The NCSC guidance says to assume your corporate network is compromised and act accordingly. That mindset keeps legacy production PCs out of reach of most everyday threats. Our networking work covers firewalls, switches and segmentation for production sites.
Images and spares, so a failed PC doesn’t stop production
A standard file backup isn’t enough for legacy production PCs. Instead, take a full image of each PC, including the operating system, machine software, licences and settings. Store copies offline, as the NCSC suggests for key documentation, so ransomware can’t reach them.
It also helps to keep a tested spare PC for the most critical machines. Then, if a PC fails, someone can restore the image to the spare and get the line moving again. Test that restore before you need it, because an untested image is only a hope.
Hypothetical example
A 30-person engineering firm in Navan runs three CNC machines from old Windows PCs. It moves them onto a separate network segment with no email or internet access. Next, it images each PC and stores the images offline. Finally, it agrees a replacement timeline with the machine supplier for the oldest unit.
Replace or contain legacy production PCs?
Replacing a legacy production PC is the cleaner long-term answer. However, it only makes sense if the machine software runs on a supported system. Ask the machine supplier directly, and get the answer in writing.
Containment makes sense when replacement isn’t possible yet. Typically, that applies when the machine is still productive and the supplier offers no upgrade path. Even then, set a review date, because containment is a holding position rather than a permanent fix.
For each of your legacy production PCs, record the machine it runs, the supplier’s position and the plan. That short list becomes your replacement budget for the next few years. When new hardware is due, our hardware procurement service can source and set it up.
How a managed IT provider handles legacy production PCs
A managed IT provider keeps the office side patched and monitored, and treats production PCs as a separate zone. That means agreeing maintenance windows with production, rather than forcing updates mid-shift. It also means working with machine suppliers instead of around them.
In addition, a provider can keep the asset list, network diagram and images current. Those records matter most on the day something fails, when nobody has time to piece them together.
Our related posts cover the cost of managed IT support for manufacturers and connecting a second site or warehouse.
How Sweeney Computer Services can help
Oliver Sweeney founded the company in 1985. Today, we support more than 50 businesses and more than 10 schools from Hurdlestown, Kells, Co. Meath. For new clients, managed packages start from €49 (Silver), €69 (Gold) and €89 (Diamond) per user per month, excluding VAT. Microsoft 365 licences are billed separately. Device and server backup is available as part of a managed package, scoped in the proposal.
Unsure where to start with legacy production PCs? A short review of your shop-floor network is a sensible first step. We can map the machines, the connections and the options with you.
Read more about our IT support for manufacturing, backup and disaster recovery and managed IT support.
A quick sense-check
Worried about the PCs running your machines?
Book a short call with Michael Sweeney about your shop-floor PCs, network and options.
