Windows 11 Rollout, Six Unsupported Laptops and a Legacy Payroll Client
An insurance brokerage runs 25 Windows 10 Pro 22H2 laptops. Nineteen use 8th-generation Core i5 CPUs; six use Core i5-7200U chips, which fall outside the processor list Microsoft supports for Windows 11. A payroll client used by all staff is 32-bit, requires .NET Framework 3.5, writes a configuration file into its own folder under Program Files and writes a licence key to HKLM. The vendor says Windows 11 is "not supported" and will not ship an update before Q3 of next year. Because of those file and registry writes, every user is a local administrator, which the last security audit rated high severity. BitLocker is off, USB mass storage is unrestricted, and there is no test lab - pilots are done on a volunteer's laptop. Replacing the six older machines would cost about USD 7,200, which finance will approve only against a written case. Windows 10 reaches end of support on 14 October 2025.
1. Evaluate the options for the six unsupported laptops and recommend one, stating the tradeoffs.
Read the worked answer
Three realistic paths. Replace now: about USD 7,200, removes the problem permanently, brings warranty coverage and a clean Windows 11 image, but consumes capital while the six machines still function. Keep Windows 10 under commercial Extended Security Updates: a per-device yearly fee, purchasable in annual increments for up to three years, with the price rising each year - it buys time and nothing else, and does nothing about the local-admin exposure. Isolate the six on a restricted VLAN with no general browsing: cheap, but patches still stop in October 2025 and those devices hold payroll data. My recommendation is staged replacement, justified not by the CPU alone but by the fact that these machines process payroll, the highest-exposure data the firm holds, and by the fact that ESU costs recur while a laptop is one-off. If finance refuses, buy one year of ESU for the six only, with a written commitment to replace before year two.
2. Users need local admin because of the payroll client. Describe how you would remove local admin without breaking the application.
Read the worked answer
First find exactly what the application writes: run Process Monitor under a standard user on a clean machine and record every file and registry write, noting which ones fail. Then, in order of preference: (a) Application Compatibility Toolkit shims - a RedirectHKCU or virtualise-registry fix moves the HKLM write into the user's own hive, and a corrected installer default or file-redirection shim handles the Program Files write; no admin rights needed afterwards. (b) If shims fail, tighten NTFS and registry ACLs so the Users group has Modify on the payroll folder and on that single HKLM key only - narrow and auditable, and far safer than local admin. (c) Last resort, publish the client on an RDS session host so only the server holds the write permissions. Then remove local admin, deploy LAPS for unique managed local passwords, and keep one documented break-glass account.
3. Set out the rollout sequence and controls for the 19 supported laptops.
Read the worked answer
Build a pilot ring of three laptops, one running the payroll client all day, and hold it two weeks. Sequence: confirm the payroll client works as a standard user with the shim or ACL in place; enable BitLocker with TPM and escrow recovery keys before anything else; restrict USB mass storage by policy with a documented exception route; upgrade the 19 machines in three waves of six or seven, never spanning a payroll run; retain the previous Windows 10 image for 30 days. Controls: a written rollback trigger, such as the client failing to post or print a batch; a change record per wave; and an explicit check that .NET Framework 3.5 is installed as a Windows feature rather than left to prompt on first launch - that prompt is the most common reason users report 'the app stopped working' after an upgrade.