Microsoft will not provide security updates or assisted support after the July 2010 date. Resistance may eventually lead to security risks, as attackers will target hesitant consumers through un-patched exploits. While upgrading is annoying and costly, residing in legacy operating systems may be even more costly in the end.

Here is a link that might be useful: Link

Thanks Zep. What types of un-patched exploits are we talking here?

Exploits / vulnerabilities found in the windows operating system that malware can penetrate. When discovered Microsoft issues security up-dates for them. Sometimes called patches.

just an Example : Old Exploit from 2008

Microsoft Security Bulletin MS08-067 Â Critical

This security update resolves a privately reported vulnerability in the Server service. The vulnerability could allow remote code execution if an affected system received a specially crafted RPC request. On Microsoft Windows 2000, Windows XP, and Windows Server 2003 systems, an attacker could exploit this vulnerability without authentication to run arbitrary code. It is possible that this vulnerability could be used in the crafting of a wormable exploit. Firewall best practices and standard default firewall configurations can help protect network resources from attacks that originate outside the enterprise perimeter.

This security update is rated Critical for all supported editions of Microsoft Windows 2000, Windows XP, Windows Server 2003, and rated Important for all supported editions of Windows Vista and Windows Server 2008. For more information, see the subsection, Affected and Non-Affected Software, in this section.

http://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx

Ok, so I'm not being very clear. I'm trying to assess the risk of not upgrading. The machines are perfectly adequate in their out-dated configuration. They are protected by updated AV, firewall, etc. and run a variety of undemanding software.

I am uncomfortable with the situation, but he-who-pays is not. I'm looking to explain my discomfort with some information. Why will these machines be any more in danger in August than they are today? New holes may be found? What's the likelihood?

The bad guys are always finding new ways to infiltrate other peoples computers. You have had 10 years of success with what you are doing so why not continue as long as the machines can handle the work load? As long as you ensure the protection is in place and being updated you are possibly safe.

On the other hand you refer to a business. If so 'he who pays' is losing out on write offs. Those W2K computers must have a book value of 25 cents (yes, mere cents) by now based on a 30% annual write off. Also he has to consider the value of the data on those machines. If it is ripped off or destroyed what will it take to re-establish all that data. Back ups must be difficult as I am sure your computers do not have USB 2.0 making progress more difficult. Many safety programs are only written for XP and onwards and that trend will continue leaving W2K users at greater risk.

Susan -
If you stop using MSIE and Outlook in favor of Firefox and Thunderbird, are smart enough to not click on links in email, and avoid social networking sites like Twitter and Facebook you are probably safer than most users of Win XP or Vista.

Just keep the virus checker up to date.

Thank you owbist and lazygardens. All good and helpful points.

It's high time to start insisting everyone use Firefox instead of IE6. He-who-pays will be fine with that. Keeping them off Facebook will be more difficult.

I think the danger of loss of data, or exposure of sensitive data, should be convincing. I'll mention the write-offs, too. :)

You've boosted my confidence. I can go forth and protect my little corner of the world without worrying that I'm being overly paranoid. Thanks.

I need to understand the risk assosiated with keeping w2k0 machines in the enterprise. How can we be exploited internal/external. I need a report or business case. Can someone help? What will happen is an exploit goes wild after jul 13th?

a great example is to go back in time and remember the blaster worm. It would be an exploit that utilizes something in the OS which has not been patched and the exploit has been exposed and is in the wild. In an OS that is no longer supported there will be no work done to provide a patch to stop such exploits. In the example of blaster a patch was put out that would block that hole. In an unsupported os you would not get that.
Now the thing to remember is that in general the bad guys tend to go for the newer systems and tend to move away from those older ones because less people and business will be using them. That is not necessarily something to bank on however.
An unsupported OS that has all the layered protection that can be applied is going to be fairly safe till some type of security exploit is found and no patch is put out for that exploit, when will that happen, no one knows, which is why it is advised to move on to ones that are supported.
For an individual you are risking your own info so choosing to stick with it for a while is one thing, for a business that has the info of clients, customers, patients etc involved you had better think hard about that and the possible repercussions.
Time to do an evaluation and make the decisions.

Depending on the actual exploit the results could be from one extreme to minor, all depends on what and where the exploit is and what it takes to take advantage of said exploit. Just remembering the havoc of the blaster epidemic should provide a good shove in the right direction. Imagine all those machines that were rendered pretty much useless with out that fix installed.
It is possible that others in the security industry may step in and create patches or fixes in some cases for unsupported OS's but again not something to bank on.

Ravencajun

thanks for the input very helpful, all i need now is a scare strategy to present to my business (company I work for) with some sort of heat map or security risk if this happens and how it can happen. Im sure i can gather that from you info plus my input

thanks