Home/Blog/Legacy systems
Hotel room with single beds, decorative panelled headboards and natural light coming through the window

Legacy systems in hotels: what to do about unsupported Windows and servers

Many hotels still have computers running Windows 7 or 10, servers on Windows Server 2008 or 2012 and equipment nobody has updated in years. Replacing everything at once is not always possible. Here is why it happens, what the risks are and how to reduce exposure until the replacement arrives.

14 October 2026 8 min read Ryland Deakin

Why hotels build up legacy systems

It is not usually carelessness: the old system stays because replacing it seems risky, expensive or dependent on someone else:

  • The supplier only certifies an old version. A PMS, POS, door lock system, phone system or building automation that is only supported on a specific version of Windows.
  • The software has fallen behind too. Windows may be up to date while the PMS, the POS, the database (such as an old SQL Server) or the integration component is still on an unsupported version. A legacy system is rarely just an old computer: it is a stack of application, database, operating system, hardware and integrations with other systems, such as the POS and door locks. Replacing one layer without checking the others can break the rest or just move the problem somewhere else.
  • Equipment with an embedded system. Kiosks, CCTV recorders, controllers, printers and digital signage run their own versions of Windows or Linux. When the manufacturer stops publishing updates, the equipment keeps working, but without fixes.
  • Nobody has the inventory. The accounts server, the maintenance computer that controls the boiler, the old machine that "only runs one program".
  • Replacement never makes it into the budget. While it works, replacing it looks like a cost with no return.
  • Whoever installed it has left. Without documentation, nobody knows whether it can be updated without breaking an integration.

What "end of support" means

When the manufacturer ends support, the system keeps working but stops receiving security fixes. Vulnerabilities discovered after that date stay without a fix from the manufacturer, unless there is a paid extended support programme. These are the official dates for systems that still turn up often in hotels:

SystemEnd of supportNote
Windows 714 January 2020The paid extended updates programme has also ended
Windows 8.110 January 2023No security fixes since then
Windows 1014 October 2025Paid updates (ESU) for businesses for up to three years, on version 22H2
Windows Server 200314 July 2015No fixes for more than ten years
Windows Server 2008 and 2008 R214 January 2020Extended updates ended in January 2024 (the last year only on Azure)
Windows Server 2012 and 2012 R210 October 2023Paid updates (ESU) ended on 13 October 2026
VMware ESXi 6.5 and 6.715 October 2022Technical guidance ended in November 2023; no security fixes
VMware ESXi 7.02 October 2025No new fixes; the date had already been postponed once by Broadcom
CentOS Linux 730 June 2024Common on servers and appliances; no updates from the project
CentOS Linux 831 December 2021Ended years earlier than planned, when the project moved to CentOS Stream
Red Hat Enterprise Linux 730 June 2024Fixes only with paid extended support (ELS)
Ubuntu 18.04 and 20.04 LTS31 May 2023 and 31 May 2025Fixes only with Ubuntu Pro (ESM)
Warning: Windows Server 2012 and 2012 R2

The last year of paid updates (ESU) ended on 13 October 2026. If the hotel still depends on this version, migration needs to be in the immediate plan and, until then, the server should be isolated as described below.

VMware deserves separate attention. In many hotels, one or two ESXi servers run all the virtual machines: PMS, POS, domain controller, files. An out-of-date host exposes all of them at once, and there is ransomware built specifically to encrypt ESXi servers; in 2023, the ESXiArgs campaign compromised thousands of out-of-date hosts worldwide, according to CISA and the FBI. With VMware's move to subscription-only licences, a perpetual licence without an active support contract loses access to new versions and to most fixes, which often delays updating the host.

Embedded versions of Windows, used in kiosks and terminals, follow their own calendars, and each Linux distribution has its own. Hardware has a deadline too: switches, firewalls, access points and servers stop receiving firmware updates when the manufacturer declares the model end of life, and spare parts become hard to find.

The risks for the hotel

  • Security. Public vulnerabilities in unsupported systems stay open, and automated attack tools look for exactly those. It is a known way in for ransomware in hotels.
  • PCI DSS. For systems in card payment scope, PCI DSS v4.0.1 asks for critical fixes to be installed within one month of release (requirement 6.3.3), which is impossible on a system that no longer receives fixes. Requirement 12.3.4 calls for reviewing, at least every 12 months, whether hardware and software still receive fixes from the manufacturer, and for keeping a plan approved by senior management to replace end-of-life technologies. Read more in PCI DSS for hotels.
  • LGPD. Article 46 of Brazil's data protection law requires technical and administrative security measures able to protect personal data. An unpatched system that holds guest data makes it harder to demonstrate those measures after an incident.
  • Cyber insurance. Many insurance questionnaires ask about unsupported systems, and the answer can affect the premium or the cover.
  • Operations. Old hardware fails, parts are hard to find and recovery depends on someone who still knows the system. Without an IT contingency plan (in Portuguese), a failure turns into days of manual operation.

When you cannot replace it yet

It is not always possible to replace everything at once. What you can do now is reduce the exposure of each system that has to stay:

  • Isolate it on the network. Put these machines on their own segment, with a firewall allowing only what the system needs, and never on the same network as the guest Wi-Fi.
  • Cut off internet and email. An unsupported machine should not be used for browsing or reading email.
  • Restrict what can run. Where technically possible, allow only the programs and services the equipment needs. This works well on dedicated machines, such as the maintenance computer, kiosks and access controllers.
  • Restrict remote access. No remote desktop exposed to the internet. Supplier access should go through a controlled channel, with MFA and logging.
  • Use extended updates where they exist. Windows 10 ESU keeps critical and important security fixes coming for up to three years for businesses, as a bridge to replacement. It does not include technical support, other fixes or new features, and it does not make the system a supported version again.
  • Virtualise with care. Moving the old system to a virtual machine on supported hardware reduces the risk of physical failure, but it does not fix the operating system. And the virtualisation host also needs to be on a supported version.
  • Monitor and back up. Include these machines in monitoring where the tool supports them, and keep backups with tested restores. The backup also needs to include what is required to rebuild the service: installers, licences, the database version, configuration files and integration credentials.
  • Document the exception. Record the risk, the protective measures, the person responsible and the deadline for replacement.

How to build the replacement plan

  1. Inventory. Every computer, server and piece of network equipment, with operating system, version, role and end-of-support date.
  2. Dependency map. For each legacy system, which applications, integrations, equipment and suppliers depend on it. The highest-risk server is not always the first one you can replace.
  3. Risk ranking. First whatever touches card or guest data, whatever is exposed to the internet, whatever stops the operation if it fails and whatever has no known supplier, spare part or recovery procedure. For each item, the decision is one of three: update, when a supported version exists; replace, when it does not; or isolate temporarily, with the measures above and a deadline.
  4. Talk to the suppliers. Ask which version they support and until when. Sometimes updating the system itself, such as a PMS migration (in Portuguese) to the cloud, removes the legacy along with it.
  5. Budget in phases. Put the replacement into the annual IT budget instead of waiting for the failure.
  6. Secure disposal. Before disposing of, returning or reusing a server, computer, POS terminal or backup device, securely erase the data, credentials and configuration, and record the disposal.
  7. Annual review. Update the inventory once a year. For hotels that accept cards, this is the same review PCI DSS asks for.

How HotelTI helps

Our team carries out the inventory and risk assessment of legacy systems as part of the hotel IT assessment, sets the protective measures for what has to stay and builds the replacement plan with priorities and budget. Technical execution, such as network isolation, migrations and equipment replacement, stays with the hotel's support team or supplier, under our coordination. Legal questions, such as LGPD obligations, should be confirmed with the hotel's own lawyers.

Questions to assess your hotel

  • Is there an up-to-date list of every computer, server and piece of network equipment, with the system version?
  • Does any unsupported system process card or guest data?
  • Are those machines isolated from the rest of the network and cut off from the internet?
  • Do we know which systems and integrations depend on each old server?
  • Have the PMS, POS and door lock suppliers said until when they will support the current version?
  • Is the replacement in this year's or next year's budget?

Next steps

The first step is knowing what is there. With the inventory in hand, it becomes clear what needs to be isolated now, what can wait and how much the replacement will cost over the next few years. Talk to our team.

Sources

IT assessment

Inventory, risk assessment and a replacement plan for your hotel's legacy systems, in 2 to 4 weeks.

View service
  • Inventory of systems and equipment
  • Prioritised risks for the board
  • Protective measures for what stays
  • Replacement plan with budget

Related reading

Service IT assessment Ransomware Protecting a hotel against ransomware PCI DSS PCI DSS for hotels In Portuguese IT contingency plan for hotels

Frequently asked questions

Is it forbidden to run unsupported Windows 7 or Windows 10 in a hotel?

There is no general ban. But for systems in card payment scope, PCI DSS requires security fixes and a plan approved by senior management for end-of-life technologies, and Brazil's LGPD requires security measures able to protect personal data. In practice, an unsupported system needs to be isolated, have its risk documented and have a date for replacement. The legal assessment should be done with the hotel's own lawyers.

What should a hotel do if the PMS or POS supplier only supports an old version of Windows?

Ask the supplier, in writing, until when the current version will be supported and what the plan is for supported versions of the operating system. Meanwhile, isolate those machines on their own network segment and restrict remote access. If the supplier has no plan, that is an important criterion at the next renewal or system change.

Does virtualising an old server solve the problem?

Only in part. Moving the system to a virtual machine on new hardware reduces the risk of physical failure and makes backup easier, but the operating system still gets no security fixes. The virtual machine needs the same isolation and the same replacement date the physical server would have, and the virtualisation platform itself, such as VMware ESXi, also needs to be on a supported version.

Is it worth paying for Windows 10 Extended Security Updates (ESU)?

Generally, as a bridge, yes. For businesses, Microsoft offers Windows 10 ESU for up to three years after the end of support on 14 October 2025, with the price doubling each year and version 22H2 required. It keeps security fixes coming while the replacement happens, but it should not become the permanent solution.

Not sure which of your hotel's systems are unsupported?

Talk to our team and start with the inventory: what is there, what is at risk and what needs replacing first.

Book an initial call IT assessment