Gartner urges NT users to migrate now

Now that Microsoft is no longer committed to rolling out critical security fixes for the aged Windows NT operating system, it's time for enterprises to migrate, research firm Gartner advised.

As of Wednesday, June 30, Microsoft is no longer obligated to provide critical security patches for Windows NT Workstation 4 (NTW4).

The only bone it's thrown enterprises still using the OS is that it will consider fixes for exploits that target NT if they spread across the Internet.

Analysts at Gartner see this as a short-sighted policy, one which may come back to bite Microsoft.

'Microsoft risks a public relations nightmare should an exploit circulate for NTW4 and require the company to make a fix available,' said Michael Silver and John Pescatore in an online alert.

'If the media reports that a worm has shut down a major corporation or government agency, Microsoft likely will be forced to rethink.'

Microsoft isn't ending security patch development, noted Gartner, but is only providing it to corporate customers who sign a custom support agreement with the developer.

'The company already plans to create critical security fixes for enterprise customers that pay for customer support through year-end 2005,' the pair wrote.

'Gartner believes that Microsoft should proactively extend these fixes to include all NTW4 customers.'

In lieu of Microsoft changing its mind, Gartner recommended that enterprises plan to migrate current NTW4 users to Windows 2000, or better yet, Windows XP Professional, with priority assigned to users with a higher risk of legal or financial losses.

The research firm also told companies to consider deploying a host-based intrusion prevention products from vendors such as Cisco, McAfee, and Sana to protect all PCs, particularly those running NT, against developing threats.

Companies that can't take the risk, and must remain with NT, should think about buying a custom support plan from Microsoft.

Such plans, which Gartner estimated costs about $200,000 for 12 months, require Microsoft to provide critical security patches.