Some advice required antivirus on Windows 10 after EOL 2024

Fair enough!

Agree with above - you can, of course, move the graphics cards from old to new.

Malneb said:

Microsoft has really done a disservice and this thread is a good example of that.

When windows 10 goes EOL then your software becomes deadlocked too because those companies will stop supporting windows 10 over time. Anti virus software will be the first softwares to drop support or at least they will be at the front of the line.

Assuming these 5 computers don't go near the public and are used by your staff to edit photos? The two kisok are used for the public to come in and upload photos to be edited?

Option:
You take all the computers offline that cannot go to windows 11 they become offline computers. You by a modern PC that can do win11 and can get support etc.
Set that win11 computer as domain controller that is the boss of all the old computers and that computer can forward any emails to the 5 computers it needs to go to, you would need to setup a mail server etc and a work group or domain. Those 5 computers become a time capsules and stay the same as the moment they go offline.

Those 5 computers are now local computers that can get email from a local mail server only without online access. You would want to lock them down in a few ways with rules and polices but it will get long winded fast if i try to explain further.

This is not necessarily a bad thing it just means your editing software gets no more updates but if that software works as is and provides what you need that its not that big of a deal.

You would need moderate networking knowledge or at least good at researching if you are unsure.

This is worth consideration. Here is some clarification (in no particular order)

1. All five computers have Google Drive For Desktop connected to the same account. There is, of course, a Google Drive folder in ThisPC on every computer. This is used primarily to facilitate downloads using FileInbox, an app that allows users of smartphones and other devices to files for printing.

2. There is no need to forward emails. Only the attachments need to be sent. We use Filezilla to automatically save attachments to an "Incoming Attachments" folder inside the Google Drive folder. All attachments other than image files (jpg, jpeg, png, tif, psd, wepb, heic) and document files (pdf, doc, docx) are immediately deleted from "Incoming Attachments" using a script that runs continuously (if anything important arrives that isn't one of the those, we can always go back to the actual email and save the attachment to a different location where it doesn't get automatically deleted).

3. We also receive download links via email from customers when they have shared images from Google Drive or Dropbox etc. These links invariably download a zip file. On the one computer with email, "Incoming Attachments" is set as the default Download location, which is in Google Drive, so that zip file is automatically uploaded to all the other computers.

4. While the public do not get near four of the five computers, the fifth one is the Order Controller, which has the proprietary software that runs our photo printers. While it is only staff that use the Order Controller, we do insert customer USB sticks, memory cards and portable drives as well as CDs and DVDs into that machine. Both Autoplay and Autorun are disabled on this computer (on all computers actually) and Windows Defender warns us anyway if a virus is found on a removable drive (in their infinite wisdom, Microsoft have chosen to disable Windows Defender's automatic virus scanning of removable drives, but I re-enabled it using Group Policy Editor).

Just a question for you (for anyone, actually).

Email phishing and scam messages are the primary attack vector for virus, ransomware and other malware infections, correct? So, is it worth considering having two internet connections - the first connected solely to a (new) email computer which would be on Windows 11, the second connected to the other five so that they are on a separate, isolated network. That network could have shared drives and shared folders as needed, but there would be no network connection at all between the email computer and the five workstations. ALL files would be transferred from the email computer to the network computers via Google Drive. Feasible?

You have some time to work out what you are ging to do.

One option is to replace your hp machines with more recent ( but not brand new ) machines of similar type.

the 8/9 gen intel versions of the hp machines or dell are currently available at reasonable cost and will likely be much less in a year or so.

perhaps hp elitedesk 800 g5 or dell optiplex 5070

this site can help a bit with comparisons of oem machines. They can usually be found cheaply on ebay and similar.

Dell OptiPlex 5070 SFF vs. HP EliteDesk 800 G5 SFF Comparison

the comparison charts are of some use, but the blurb underneath is not always accurate.

smartcooky said:

Email phishing and scam messages are the primary attack vector for virus, ransomware and other malware infections, correct? So, is it worth considering having two internet connections - the first connected solely to a (new) email computer which would be on Windows 11, the second connected to the other five so that they are on a separate, isolated network. That network could have shared drives and shared folders as needed, but there would be no network connection at all between the email computer and the five workstations. ALL files would be transferred from the email computer to the network computers via Google Drive. Feasible?

Yes email are a good way for bad things to happen, JS script attacks and virus's.

This is what the win11 computer will be for so you have a modern one it does not have to be expensive or top of the line parts it just needs to be compatible so anything after 7th generation.

Its the main computer it can go online and do all the online stuff that needs to happen and while be the parent you have all the older computers that are only local network computers so they are confined to being lan computers only they cannot go online. The win11 computer is responsible for sending the required information to the local computers.

it gets complicated fast if i go into detail. But you can make it in a way where that win11 computer is basically the main parent computer that has internet and all the child computers operate according to what the parent computers defines like reciving emails from the parent or whatever data they need to access.

You could also just have a server in your office if like you say those computers don't actually need email just attachments. The win11 computer can send attachments to a server somewhere on your local network and then any of the old computers can download those from the server and it means you have a win11 computer that is protected screening the files and emails so you are protected still.

as mentioned by the previous person that is also an option depending on what prices are like in NZ ifs anything like in AUS computers become expensive fast even used ones. I don't live in NZ anymore for like 20 years so i dunno.

- - - Updated - - -

smartcooky said:

This is worth consideration. Here is some clarification (in no particular order)

So, is it worth considering having two internet connections - the first connected solely to a (new) email computer which would be on Windows 11, the second connected to the other five so that they are on a separate, isolated network. That network could have shared drives and shared folders as needed, but there would be no network connection at all between the email computer and the five workstations. ALL files would be transferred from the email computer to the network computers via Google Drive. Feasible?

Sorry i missed some of your response because i have stuff going on atm.

Yes you have the right line of thinking but you would not need a second internet service. You would head towards vlan and other areas of networking, you need a router that can do Vlan.

This stuff gets confusing because networking is 101ways to skin a cat i would have to sit down and draw things and fully understand your needs myself so i cannot really explain it well either and overall it can get lengthy easily.

Malneb said:

Its the main computer it can go online and do all the online stuff that needs to happen and while be the parent you have all the older computers that are only local network computers so they are confined to being lan computers only they cannot go online.

OK, so just to clarify from our standpoint.

The local network would still have to have an internet connection, because Google Drive for Desktop and Dropbox run on all of them as that is how customers send the bulk of their work to us, and that amounts up to hundreds of files (which rules out email for those kinds of jobs). Now while having them online still presents some risk, shouldn't that risk be greatly reduced by not having access to email. That risk could be further reduced by restricting access to internet browser to the Admin account only. How else do viruses and malware get in? Port scanners? That would be very low risk surely?