Due to many recent e-mails and discussions, we would like to address some questions and confusion about endpoint quarantines and the upcoming end-of-support date for Windows 7, Windows Server 2008, and Windows Server 2008 R2.
Quarantines for lack of endpoint management (EPM) are done on a different schedule than quarantines of unsupported operating systems (EOL). EPM quarantines happen on specific dates, with the next EPM quarantine date displayed in the Planisphere Dashboard (in this case, January 30, 2020). Warnings are sent to a targeted device’s Support Group 16 days before quarantine and to the device’s user 2 days before if the lack of EPM has not been addressed.
EOL quarantines, on the other hand, will be put in place the day after the operating system’s end-of-support date (in the case of Windows 7/2008/R2, January 14, 2020), with the quarantine taking place immediately upon device identification. No warnings will be sent; Support Groups are expected to use Planisphere or other tools to stay apprised of the support state of the devices they manage.
Due to the questions and confusion around these dates, the quarantine date for Windows 7/2008/R2 has been extended from January 15 (the day after the end-of-support date) to January 30 (the next planned EPM quarantine date). However, no warnings will be sent for the EOL quarantines; Support Groups can identify their devices at risk of EOL quarantine using Planisphere or other tools.
Other operating systems that are already past their end-of-support date (macOS 10.12 and below, Windows 8.0, Windows 10 Enterprise 1703 and below, Windows 10 Pro 1803 and below), will not be immediately quarantined. Instead, a future quarantine date–likely within the next 3 to 6 months–will be established and communicated very soon. These devices are currently visible in Planisphere as running an Unsupported OS.
Operating systems that fall out of support in the future will be quarantined immediately starting the day after end-of-support. In the near-term, this includes Windows 10 Enterprise (1709) on April 15, 2020, and Windows 10 Home/Pro (1809) on May 13, 2020. We are discussing plans to add a “device OS will be unsupported within N months” warning within Planisphere. Until such a solution is in place, devices running these particular operating systems can be identified using Planisphere or other tools.
If you have any questions or concerns regarding the unsupported operating system quarantines, please let us know at security@duke.edu.
(NOTE: This information applies only to the Duke University network and Duke University-owned devices. Members of the Duke Health IT community should consult with the DHE ISO regarding Duke Health policies for devices running unsupported operating systems.)
