# Technical Documentation: Sandboxing Unmanaged Legacy Windows Assets

1. Scope & Objective
------------------------

This documentation provides a security architecture for enterprises that have standardized their modern fleet (Windows 10/11) on Hexnode UEM, but must retain legacy Windows 7/8 machines for business-critical operations (e.g., CNC machinery, legacy ERP access, or medical imaging).

Since these legacy machines cannot be managed via Hexnode (due to OS incompatibility or air-gap requirements), this guide focuses on Compensating Controls—securing the environment around the legacy OS to prevent lateral movement into the managed fleet.

2. Risk Assessment: The “Unmanaged” Gap
---------------------------------------

Legacy Windows 7/8 systems represent a “blind spot” in a modern UEM-managed infrastructure.

- **Vulnerability**: EOL (End-of-Life) status means zero-day vulnerabilities (e.g., BlueKeep, EternalBlue) remain unpatched.
- **Credential Risk**: Legacy OS lacks modern Credential Guard, making them susceptible to Pass-the-Hash attacks.
- **The Management Disparity**: * Managed (Win 10/11): Enforced by Hexnode; real-time compliance; BitLocker active. 
    - **Unmanaged (Win 7/8)**: No Hexnode visibility; manual audit only; high risk of “Shadow IT” drift.

3. The Sandboxing Architecture
------------------------------

To mitigate risk, administrators must implement a **Layered Sandbox** that treats the legacy machine as a “Hostile Guest” on the network.

### 3.1 Logical Network Isolation (Micro-segmentation)

The network is the only reliable control for a device that lacks a management agent.

- **Legacy VLAN Assignment**: Isolate all Windows 7/8 devices into a dedicated “Legacy VLAN” (e.g., VLAN 99).
- **Stateful Firewall Rules**: * Deny All Outbound: Block the legacy machine from accessing the internet. 
    - **Deny Lateral Movement**: Block all traffic from the Legacy VLAN to the Managed VLAN (Windows 10/11 subnet).
    - **Scoped Inbound**: Allow only specific ports required for the legacy application (e.g., Port 1433 for SQL).
- **MAC Filtering**: Enable Port Security on physical switches to ensure a Windows 10/11 device cannot be plugged into a “Legacy” port to bypass Hexnode policies.

### 3.2 Host-Based Hardening (Manual SOP)

Without Hexnode to push GPOs, the following must be performed manually on each Windows 7/8 unit:

1. **Disable SMBv1**: Run dism /online /disable-feature /featurename:SMB1Protocol to mitigate ransomware propagation.
2. **Remove Non-Essential Services**: Disable Print Spooler, Remote Registry, and NetBIOS over TCP/IP.
3. **Local AppLocker Policy**: Configure Local Security Policy to allow only specific application paths (Whitelisting).
4. **Least Privilege**: Ensure no domain accounts have local admin rights on legacy machines.

4. Protecting the Hexnode-Managed Fleet
---------------------------------------

The goal is to ensure that even if a legacy machine is compromised, the infection cannot reach your Hexnode-managed devices.

### 4.1 Hexnode Policy Configuration (The “Shield” Policy)?

Apply a specific Security Policy in Hexnode to your Windows 10/11 devices that may coexist in the same facility:

- **Firewall Rules**: Add a rule to the Hexnode Firewall profile that explicitly **Blocks** all inbound traffic from the IP range of the Legacy VLAN.
- **USB Restrictions**: In Hexnode, disable “Allow External Storage” for any managed device that shares physical proximity with legacy machines to prevent “Sneakernet” malware transfer.
- **Network Threat Protection**: Enable “Intrusion Prevention” within your Hexnode-managed AV settings to flag legacy-style exploits (e.g., SMB probes).

5. Summary Table: Compensating Controls
---------------------------------------

Risk FactorControl MethodImplementationLateral MovementNetworkMicro-segmentation / VLAN IsolationData ExfiltrationPhysicalBIOS Lock / USB DisablementMalware PersistenceOSDeep Freeze or Unified Write Filter (UWF)Identity TheftIdentityLocal-only accounts (No Domain Sync)Visibility GapMonitoringFirewall Log Auditing (SIEM integration)6. Maintenance & Sunset Plan
--------------------------------

Sandboxing is a **temporary risk-mitigation strategy**, not a permanent solution.

- **Quarterly Audit**: Manually verify that the legacy machine’s software hasn’t changed.
- **VDI Evaluation**: Assess if the legacy application can be migrated to a Windows 10/11 virtual machine with “Compatibility Mode” active, allowing it to be brought under Hexnode management.
- **Hardware Bridge**: For industrial equipment, consider a “Protocol Gateway” that allows the legacy machine to talk to the network via a secured, managed Linux or Windows 11 bridge.

**Disclaimer**: *The configurations mentioned (SMB disablement, VLAN isolation) should be tested in a staging environment, as legacy industrial software often relies on insecure protocols for operation.*