Windows XP end of support: What to do next

Why move at all?

“With Microsoft withdrawing support in April 2014, there won’t be any more patch Tuesdays for Windows XP,” warns Grant Tiller, senior product manager at RES Software. “Rather than take a straight upgrade to Windows 7, people are looking at alternatives, one of which is to stick with XP.”

However, as Computer Weekly has previously reported, the migration is such a large step that there will inevitably be applications that cannot be moved.

Tiller says IT leaders must check whether any specialist in-house code will support the new OS. Many in-house applications are written for a browser front end, but some browser applications written for IE6 on XP will not run correctly on IE8 in Windows 7.

Application virtualisation

"The migration from XP to Windows 7 or 8 is way behind schedule,” says Garry Owen, senior product marketing manager at VMware. “Now there is almost no choice.” 

Since there will be no scheduled security patches from next April, he says companies continuing to run Windows XP face the risk of targeted hacking attacks. 

“In the US, we are seeing class action from shareholders of companies which have not considered a migration because there is a massive compliance issue,” says Owen.

One of the options open to the IT department is to run XP in a sandboxed environment, such as by using Citrix or VMware.

VMware recommends virtualising applications that cannot be migrated to Windows 7. Its ThinApp application virtualisation software takes an old application and encapsulates it with all the software components its needs to run in a single .exe file. 

“You can run IE6 on ThinApp and it runs on top of Windows 7. We have thousands of customers doing this,” says Owen.

Inevitably, there will be some applications that cannot be moved. 

Oren Taylor, director at CDG, says the XP support deadline will force organisations to rationalise their desktop application estate. 

“You need to understand usage metrics, not just what applications start up, but also do a function point analysis to determine how users interact with those applications,” he says.

Licensing restrictions

According to Gartner, Microsoft supports the virtualisation of IE6 applications only if the IT department runs its Terminal Services software or chooses to run Windows XP in a virtual machine locally.

Migrating XP onto a server that runs Microsoft Terminal Services may give businesses a way to keep Windows XP running securely, but there are restrictions.

Microsoft states it does not support the use of Microsoft Application Virtualisation (App-V) or similar third-party application virtualisation products to virtualise IE6 as an “application” enabling multiple versions of Internet Explorer on a single operating system. 

In addition, the terms under which Windows and IE6 are licensed do not permit IE6 “application” virtualisation. Microsoft supports and licenses IE6 only for use as part of the Windows operating system, not as a standalone application.

If users follow the wording, then Microsoft effectively forbids companies from using application virtualisation to run IE6 applications – even though these applications can run in a virtual environment.

Microsoft effectively forbids companies from using application virtualisation to run IE6 applications

To remain compliant with the Microsoft end user licence agreement (EULA), the only option open to businesses which have a requirement to continue running IE6 applications is to virtualise the whole OS.

But on its TechNet site, Microsoft stipulates that users can only run Windows Server 2003 to virtualise IE6. “This means you cannot take advantage of the Terminal Services RemoteApp capabilities in the Windows Server 2008 R2 operating system. It also means that in July 2015, when Windows Server 2003 support ends, the IT department will need to rethink its XP strategy."

According to CDG’s Taylor, one option open to IT – and one that is gaining acceptance – is to use a third-party product from Browsium. HMRC recently awarded the US start-up a £50m contract for Browsium’s browser emulation software, which enables IE6 to run securely on top of a modern version of IE.

Should companies continue running XP, even after support ends? Unless money is no object, the short answer is 'no'

Weigh up the options

With thousands of desktop applications to test, any business embarking on a Windows XP migration now is unlikely to finish before support ceases in April 2014. 

David Angwin, marketing director for Dell Wyse, recommends that IT departments run a full audit of every application in their desktop software portfolio. 

“Most organisations do not know what people run and there are lots of software licences not being used,” he says.

Once a survey of the desktop estate has been run, IT then needs to decide whether to upgrade to Windows 7 or Windows 8, and whether desktop virtualisation is suitable for some users. In spite of largely being regarded as the best option for enterprises, moving to Windows 7 will have its own limitations. For instance, mainstream support ends in January 2015 and the OS will only be supported until 2020.

Many companies are unlikely to opt for Windows 8, however, since the touch user interface (UI) is not ideal in a traditional enterprise desktop environment.

So should companies continue running XP, even after support ends?

Unless money is no object, the short answer is "no”. The cost of custom fixes runs into hundreds of thousands of pounds and, as VMware’s Owen points out, the CIO or IT director may face the wrath of shareholders concerned about security risks. 

Running XP in a virtual machine may work for now, but this approach is only valid while support is still available for Windows Server 2003. As for running IE6 applications using application virtualisation, Microsoft’s licensing denies this as an option.