Sometimes the answer really is 'this PC has to stay'. If a Windows 7 machine must keep running in 2026, do not rely on luck - fence it in. These are the measures that genuinely reduce the risk, in the order that matters, with their limits stated plainly.
Nothing can make Windows 7 safe in 2026 - Microsoft stopped patching it in January 2023. But there is a large difference between an exposed Windows 7 PC used for everything and an isolated, single-job machine with the last available protections in place. If you must run one, this checklist is how you keep the risk as small as it can honestly be.
Network - Isolated, internet blocked at the router
Patches - Final rollups installed + 0patch agent running
Account - Standard user for daily work
SMBv1 - Disabled
Backup - Full disk image, updated monthly
The target state for any Windows 7 PC that has to stay in service.
Attackers cannot exploit a PC they cannot reach. Put the Windows 7 machine on its own network segment - a guest network, a separate cheap router, or a VLAN - so it cannot see your main PCs. If its job does not need the internet, block its internet access at the router entirely. Isolation does more for a Windows 7 PC than any software you can install on it.
Bring the system to its final patched state: Service Pack 1, the SHA-2 update KB4474419, the servicing stack update KB4490628, and the final Monthly Rollup from January 2023, all still downloadable from the Microsoft Update Catalog. Then add 0patch by ACROS Security, whose micropatches cover the most serious holes found since - announced to continue at least until January 2027. This is the ceiling: after this, no further OS fixes exist anywhere.
reg add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" /v SMB1 /t REG_DWORD /d 0 /f, then restart the PCNo patch or setting makes a Windows 7 PC suitable for sensitive accounts. Keep the line absolute: no banking, no payments, no main email, no password manager, no shopping on this machine. Do that work on a phone or a supported PC. Most real-world damage comes from credentials typed into an unpatched system, not from the system quietly sitting there.
Take a full disk image of the finished, cleaned setup with an imaging tool you trust, store it on a separate drive, and refresh it after any change. If the machine is ever infected or breaks, wipe it and restore the image instead of trying to clean an unpatched OS - a clean restore is the only trustworthy recovery left for Windows 7.
See the whole hardening process applied to a real Windows 7 PC in the video.
▶️ Watch Full VideoNo. Most major antivirus vendors have also ended or frozen Windows 7 support, and even a perfect antivirus cannot repair unpatched holes inside Windows itself. It is one layer, not a solution.
A VPN hides your traffic from your network provider; it does nothing about the unpatched operating system, browser exploits or malicious downloads. Useful for privacy, useless as a security patch.
0patch is a long-running micropatching service by ACROS Security that fixes individual vulnerabilities in unsupported Windows versions. It is a legitimate, widely cited service - but its patches are unofficial and cover selected serious flaws, not everything.