At this point I’d take the malicious compliance route. Make sure you have it documented in a form of writing that shows he is refusing to upgrade his system. Send him an email confirming you the new laptop on standby and would like to know when he’d like to swap it out, he’ll obviously tell you to pound sand. If anything happens, it’s not on you. If you’re worried about getting fired, then it’s not worth it to pursue.

Your boss is aware of the problem and doesn't want you to leave a clear paper trail about it in writing. Think about that a little bit.

Welcome to IT.

Fellow IT guy here (welcome!). It's like everyone else said: have some proof that your boss was informed of the situation. As someone who worked for a few years in IT: avoid verbal agreements; you won't be able to prove they happened and they'll make it your fault. As an example, I refuse to do any work that might have long-term consequences if I don't have a ticket requesting as such or at the very least a mail in my mailbox. All agreements should be documented somewhere. Email is good, hard copies (paper) are even better.

Always, always, always document your requests. Bosses will not hesitate to throw you under the bus when something THEY fucked up goes wrong. Like southsamurai said: cover your ass, then follow orders. When shit inevitably hits the fan, you'll have something to point to.

I would absolutely send him an email to the effect of

"Per our multiple verbal conversations, this is just to serve as notice that, in my professional opinion, your refusal to allow me to upgrade a system at risk of multiple security vulnerabilities on a platform that is no longer supported is a risk that you are choosing to accept against my advise."

with a list of known major vulnerabilities attached if possible.

That way at least if this comes back to bite the company on the ass, he can't say "Well he never told me this was a problem!"

Cover your ass, then follow orders. The job is, whether anyone likes it or not, to do what a supervisor tells you. If the supervisor is an idiot like yours, that doesn't change. Do the job, cover your ass, and hope for the best.

Doesn’t sound like it needs web access to function. Block web and all other ports at switch/core/firewall etc.

Start looking for a new job. Don’t wait until you have certs, just look. And don’t describe this situation in any interview. Just say you’re looking for growth and new challenges

A couple additional thoughts:

• You sent your boss an email using your company email server. You do not control this server. You cannot rely on this email as a paper trail, any email you send could be deleted by someone else with administrative access. In Outlook it's possible to delete any email that was sent internally and the logs that it was sent.

• You should write down the date(s) and time(s) that you sent emails about this to your boss, on paper. Keep it with your other work notes.

• You should not include any specific technical information about your company's systems in this paper record as this might expose you to liability in the future. Just record when you sent the emails and a general description of the subject (e.g. "email to boss about upgrading out-of-date operating system"), and a short description of any response (verbal or written).

• You have offered to upgrade this system. Your boss said no. It's not your responsibility anymore.

• If I were in your position I would tell my boss explicitly that I won't be responsible for the security of this system or anything connected to it, at least not without a signed risk acceptance statement. You might not feel comfortable doing that, it is potentially confrontational.

• If you've been told that you're responsible for this system (your employment is dependent on it) in spite of your objections, please take a look at this article about security hardening for Windows 7 and try to implement as much as you can. If you're not responsible for it, don't mess with it.

Windows 10 will be in the same boat again in about a year and a half when Microsoft drops support.
Do you really want to have this fight a second time trying to get him to upgrade to Windows 11?

Just post the IP address and we can sort it out for you.

Back everything up first and you will be their hero.

You’re not employed to fix all the problems, you’re employed to fix the problems your boss wants you to. Save the emails where they deny your concerns for the inevitable subpoena but other than that shut your mouth on this topic and move along to other tasks.

Edit: further note since you’re new to IT. HIPPA requires that orgs keep patient data of children in an accessible manner until that child is around 25 iirc. When I first started in IT we still had a couple 3.1 and 95 machines running an old out of support EMR software until the patients in it were old enough we could pitch it. It’s entirely possible this is the reason your boss is keeping this machine, it may not be upgradeable because the software simply doesn’t work above windows 7. I will say there’s merit in moving that data local to the machine and getting it off the internet access though. But if your boss says leave it then leave it.

It's your first IT job and you've been there for a few months? While your safety concerns definitely can be relevant my advice is this

You should

1. Don't rock the boat as a new hire. Figure out what is going on first. Maybe there's a reason to some of the madness you see.
2. Do NOT contact the owners. Doing so will likely be seen as disloyalty by your boss and possibly the owners as well. Only go through your immediate superior.
3. Don't bring it up again with your boss. It's not your responsibility.
4. Leverage the user. Let the user be the one to push for a system switch.

You could

1. Figure out if you can get the system on a separate VLAN and get it locked down in firewall rules.
2. Research the system. Why don't your boss want it replaced? Does it run some ancient software? We've got some machinery that is running windows 7 at work. When I got hired, in the days if windows 8, the controller was running windows XP. The setting up of drivers and archaic proprietary software, involved in upgrading, is immense. When we switched to 7 this €60k equipment was down for days, and it was a week before it operated properly.

Soooo.. Haven't seen anyone ask this. Why DOESN'T he want it updated? Have you checked for running processes, keyloggers (hardware and software), hidden partitions, Veracrypt, etc?

There may be a reason that's not being shared.

Otherwise I agree with the email routes that get it in writing (or the lack of response as such).

The most chaotic good thing to do would be to use the known security issues to hack into your boss' computer in the most scarry looking but harmless way. That would possibly scare them into upgrading.

With that said, you should create a paper trail on how you warned your boss, and either wash your hands of the issue or kick it up the chain, depending on how much you care.

EDIT: since it seems some people didn't get it, I meant the first option as a joke. My actual advice is the second paragraph

Something I haven't seen mentioned yet - who is the company's HIPAA "Compliance Officer"? If it's anyone other than your boss, you could document the situation to them in an e-mail. If you want to be slick about it, ask them if there is "still any compliance need to keep the replacement machine ready or if it would be OK to repurpose it, given [your boss's name here]'s decision not to move forward with the upgrade." They're on the hook for compliance violations, so they'll likely see to it.

I would also suggest making a habit from now on of documenting verbal conversations that result in actionable decisions in short e-mails to the other party: " To recap our discussion, [bullet point list]"

You can excuse this as being for your own reference so you don't forget any to-do items or so that they can correct any misunderstanding on your part, but it makes for a fantastic CYA if that ever becomes necessary. For really important items likely to bite someone later, print a paper copy if you don't fully own and control the machine AND the e-mail local archive. Only bring those out if absolutely necessary, as in when SOMEBODY will be fired or you're about to be legally scapegoated. They'll save your butt once, but it will probably be time to start looking for another job because the boss will think either that you should have pushed harder earlier to fix the issue or be worried about their inability to scapegoat you in the future.

an email I sent to my boss about upgrading was never responded to

Dear Boss,

As per our recent discussion [blah blah]

Thanks for allowing me to leave early on Friday for my appointment.

HnK,
 -Staffy McStafferson

When you get a 'brown M&M' response ...

Staffy,

I don't remember the discussion about Friday.  

-Jefe Jefenbaum

Then you know you got 'im.

I don't have advice, just a worthless anecdote.

I work at a large tech company. We had a Windows XP system on our network get hacked. They used that to jump to our servers. IT had to quarantine off the whole lab, because they didn't know where the hacker had hopped next. So then IT had to do a post-mortem and figure out how they got in and what was affected. That process took 3 months. In the meantime, any team with servers in that lab couldn't use them. The team directly responsible for this couldn't work at all for the full 3 months.

Leave it until the system fails then when things go tits up you can tell the owner that you knew the problem was coming and gave multiple warnings to your boss about it and he shut it down.

Ah yeah just like the other post, make sure there is evidence.

You need a new job.

I grew up as the "IT guy" in small town America.

This guy, and the people here (not you) sound like a lot of people I know. I'd look for a different job and grow your passion somewhere else. It isn't worth it. You won't change them, and they're just going to make you feel like you're wrong, even though you're right. It's like the movie Idiocracy.

First few months in IT? Welcome to hell...

I'm kidding (mostly), I'm in IT also and if you're in for even a few years, you'll start to build a collection of horror stories like this one. We've all seen things you wouldn't believe.

So you need to have full buy-in from the owners. If you're able to talk directly to them, then it sounds like this isn't a huge company. If you clearly explain in a professional way to the owners the situation with documentation and they don't fully support you, leave the company asap.

As somebody who has been involved in multiple ransomware recoveries, trust me...you don't ever want to deal with a rogue unsecured machine on the network. And owners that don't care or take that risk seriously are absolute fools and this will only be the tip of the iceberg of stupidity.

That computer is a ticking time bomb. Please for the love of God tell me that your boss doesn't have local admin rights on his system.

If the only thing your boss uses that system for is to connect to a web app to manage inventory, why is he mad about switching from windows 7? Does he just like how windows 7 looks visually?

I guess it doesn't really matter. Also, windows 10 isn't a long term solution because it also goes EoL next year in October, so you'll be in this same position in less than 2 years.

You can either go to Windows 11, or if you wanna be a little wild, install a Linux distro like Mint on there and theme it like Windows 7. You solve the security problem and he gets to pretend he's still in the early 2010's.

Honestly though, start looking for another job if the owners don't support you 100%. IT is already a stressful and intense enough job, you don't need stubborn idiots like your boss to add flavor.

You've done your part.

Now send an email that states that you understand that he doesn't want to upgrade computer with asset tag X out of Windows 7, despite the security concerns and crashes, and if this changes, you have a windows 10 desktop ready to deploy when/if the time comes, then thank him for his time.

Edit: oh, and file this email (and any responses) in an easy to find place, just in case.

E2: also, windows 10 is EOL soon, so you may want to upgrade the new one to 11 if the software works with 11. And make dang sure the software works. The vendor's word might be misguided. It doesn't work, until you verify it works.

"This is my first IT job, I’ve only been working here 3 months"

Then you need to learn this lesson quickly: YOU ARE NOT THE BOSS. The Boss is the Boss. Not you. You make your concerns known to him then you leave it at that.

"I’m considering talking directly to the owners about this issue" Yeah, going over his head is really going to go down well /s. As you have proven you are hard of learning, let me state clearly: it won't, that was sarcasm. The owners will see you've gone over your boss's head and when he says "I've had enough of this jerk, let's get someone else in" they'll be hard pressed to disagree with him.

"my boss’s refusal puts our operations at risk" Your boss already knows this. Especially as you keep banging on about it. What you're doing here is heading for an unceremonious out-kicking. Your boss also knows a lot more about the business than you do. If he's keeping that machine on Win7 then he probably has some good reasons to do so.

"I want to ensure I handle this professionally" No you don't. You want to force your boss to do what you think he should do. If you were being professional you'd state your concerns, in email if necessary, then move on.

"I definitely feel like I’m going to be used as a scapegoat" That's why you put your concerns in an email (ONLY to your boss, nobody else. Or maybe a sympathetic team member). This creates a paper trail so that if and when they come knocking on your door saying "Why did you let this happen! You're fired!" you can point to that email which proves you did everything you could. (Which they won't by the way. You're an idiot newb three months into your first job. You don't have any responsibility yet. So this isn't on you.)

"I’m also planning on seeking employment elsewhere" It doesn't matter where you work while you have this attitude. Newsflash kiddo: you're the asshole here. You're a newb three months into your first job. No matter what you think you know, you don't know anything. Instead of trying to dictate to others what you think they should do, try to learn why they're doing it differently from what you expect. Maybe you have to find somewhere else now; that boat may have already sailed. Maybe if you approach your boss saying something like "er, sorry I was an asshole, I thought I knew more than I do, can we start over and I want to learn from you" (but obvs phrase it better than that) then MAYBE you stand a chance of getting through your first year.

[Sympathetic mode on.]

We all have to learn this stuff and it takes time. Your boss also knows this, and remembers when he was an overenthusiastic hothead. So while all the above might seem harsh, especially the YTA bit, hopefully it'll cause a course correction (which is my intent here) and you'll be back on track to a successful career in IT. This position may still be salvageable but you need to go in on Monday understanding clearly that it might not be, and that it is your fault. And maybe you need to be fired a few times before this sinks in. Good luck.

Just curious, what are his reasons for not wanting to upgrade?

CYA at this point. Email the relevant info to your boss, bcc a non-company personal email, or print out and store a copy of the email for reference. When shit goes tits up, it probably won't save your job (big IT event like that usually kills a family business), but it will save you from getting sued or smeared for the catastrophe.

I would resend the email and request a read receipt (this is an option in outlook, thunderbird and other email clients likely have this feature as well but I'm only familiar with outlook), if they still do not reply, then I would go over their head.

you can advise but the boss man has the final say