Windows 7
Enable an AI agent to recognise Windows 7, assess a particular installation's usability and exposure, and decide whether to preserve, repair, isolate or migrate it.
Research draft, second pass
A second pass drafted this model: the structure a model of this thing needs, and what is known about it in the world. The line under this one says how the second half was obtained - researched against sources, or recalled without web access, in which case nothing here was read anywhere and every claim is a lead to verify. Unreviewed either way.
Researched by: Codex + Grok
Purpose and description
Enable an AI agent to recognise Windows 7, assess a particular installation's usability and exposure, and decide whether to preserve, repair, isolate or migrate it.
Microsoft Windows 7 is the Windows NT 6.1 client operating system Microsoft released to manufacturing on 22 July 2009 and to general availability on 22 October 2009, succeeding Windows Vista on IBM-compatible x86 and x64 PCs as a fixed-lifecycle product whose extended support ended on 14 January 2020.
It can be Inspect and corroborate Windows 7 edition, architecture, service-pack level and installation provenance.; Evaluate update applicability and support evidence for the identified Windows 7 installation.; Test required applications, device drivers and workflows against explicit acceptance criteria.; Restrict connectivity and privileges when authorised to contain an installation's exposure.; Create and verify a recoverable image before authorised servicing or migration.; Plan and validate migration, controlled legacy operation or retirement using recorded dependencies..
Distinguishing features
Establish Windows 7 identity from installed-system metadata and corroborating system files; a desktop theme or user-supplied label is insufficient.
Distinguish Windows 7 from Windows Server 2008 R2 using client/server product identity and edition evidence; an NT 6.1 version report alone does not separate them.
Check the Windows product family when a name includes 'Embedded' or 'POSReady'; a shared Windows 7 foundation does not by itself establish membership in this registry entry.
Distinguish an installed Windows 7 operating system from installation media, a recovery environment or a compatibility setting selected by an application.
Record edition, x86 or x64 architecture and service-pack baseline separately so materially different Windows 7 installations are not treated as interchangeable.
Scope
+ Windows 7 product identity, edition, architecture and service-pack baseline
+ Installation provenance, activation state and evidence of permitted use
+ Bootability, servicing condition and recovery readiness
+ Compatibility dependencies involving applications, drivers and hardware
+ Security configuration, network exposure and applicable support arrangements
+ Permitted maintenance, containment, preservation and migration actions
- The physical computer's identity, ownership and component lifecycle
- Application functionality and application-specific business records
- User identities and organisational access-governance policies
- Network infrastructure and organisation-wide security operations
- Windows Server 2008 R2 and other Windows releases as separate operating-system products
- Installation-media inventory and software-contract management beyond their relationship to Windows 7
Characteristics
- Observed product identity
- Windows 7 client; related server product; related embedded product; conflicting evidence; unknown Prevents similarly named or technically related products from inheriting the wrong model.
- Installed edition
- Observed Windows 7 edition, including any N or KN designation; unknown Edition affects available capabilities and the applicability of maintenance or migration paths.
- Operating-system architecture
- x86; x64; unknown Constrains drivers, applications and replacement choices independently of processor capability.
- Servicing baseline
- Observed build, service-pack level and installed-update evidence, with inspection date A Windows 7 label alone does not establish update applicability or patch coverage.
- Activation condition
- Observed activation status; not inspected; unknown Identifies activation-related constraints while keeping activation separate from proof of permitted use.
- Support applicability
- Installation linked to dated lifecycle evidence and any documented support arrangement Support must be assessed for the actual product, date and arrangement rather than inferred from installed updates.
- Boot and recovery condition
- Normal boot verified; degraded boot; recovery-only; unbootable; untested, with recovery evidence Determines whether an agent can inspect or repair the installation without first securing a recovery path.
- Network exposure
- Offline; restricted network; general internal network; internet-connected; directly reachable from untrusted networks; unknown Exposure changes the acceptability of continued operation and the urgency of containment.
- Legacy dependency
- Installation linked to applications, peripherals or workflows with documented Windows 7 requirements Makes preservation or migration decisions depend on demonstrated needs rather than assumed incompatibility.
Where this came from
wikidata · CC0 1.0
Drafted structure
Bundle to layer to finding to question, as the second pass will find it: 7 bundles · 13 layers · 20 findings · 32 questions.
Windows 7 identity Establishes which Windows product and variant the evidence actually describes.
Windows 7 can be confused with related NT 6.1 products, embedded variants and compatibility environments.
Product-family boundary
Separates Windows 7 client installations from adjacent products and representations.
Corroborated client identity
Record the evidence supporting Windows 7 client identity and any contradictory product labels.
- Which installed-system records and system-file evidence identify this as Windows 7? provenance
- Does the evidence instead identify Windows Server 2008 R2, an embedded product, installation media or a recovery environment? boundary
Edition, architecture and baseline
Identifies the Windows 7 variant needed for subsequent compatibility and servicing judgments.
Installed variant
Record edition, regional variant where relevant, operating-system architecture, build and service-pack level.
- What edition, x86 or x64 architecture, build and service-pack level are reported by the installation? measurement
- Do offline image metadata and running-system observations agree on this Windows 7 variant? provenance
Installation and use basis Connects an installed Windows 7 instance to its origin, activation condition and documented basis for use.
Recovery, relocation and continued operation can depend on installation history and licence terms that activation alone does not establish.
Installation lineage
Tracks the source and transformations of the Windows 7 installation.
Image and host history
Record whether the installation originated from OEM recovery, retail media, organisational deployment or another evidenced source.
- What evidence identifies the original Windows 7 media or deployment image and subsequent rebuilds? provenance
- Has this installation been cloned, restored onto different hardware or converted into a virtual machine? provenance
Activation and entitlement
Separates technical activation observations from documented permissions.
Permitted installation actions
Record activation condition and the evidence needed to judge restoration, transfer or virtualisation without storing secret product keys.
- What activation status and licensing channel can be established without exposing a full product key? measurement
- Which applicable licence documents and approvals govern restoring, moving or virtualising this Windows 7 installation? action
Servicing and support Assesses the installation's update baseline and the dated evidence for available maintenance.
A working Windows 7 installation can have substantial servicing gaps, and historic update receipt does not establish present support.
Update baseline
Relates installed packages and servicing prerequisites to the identified Windows 7 variant.
Applicable update evidence
Record installed and failed updates, pending servicing operations and prerequisites relevant to proposed updates.
- Which installed-package records and servicing logs establish the Windows 7 update baseline? measurement
- Which service-pack, servicing-stack or signing-support prerequisites must be verified before applying the proposed update? action
Dated maintenance coverage
Distinguishes historical lifecycle phases from maintenance actually available to this installation.
Support claim applicability
Record authoritative lifecycle evidence and the scope of any claimed extended or third-party maintenance arrangement.
- What dated provider evidence establishes support availability for this exact Windows 7 product and edition? provenance
- Does a cited update or support entitlement apply to this installation, or only to another product, period or deployment arrangement? boundary
Legacy workload compatibility Establishes what the Windows 7 installation must run and which dependencies make replacement difficult.
An agent needs demonstrated application and device requirements to judge whether retaining Windows 7 serves a necessary function.
Application execution
Captures required application versions, runtimes and execution conditions.
Verified Windows 7 dependency
Record reproducible workflow requirements and distinguish tested constraints from unsupported assumptions.
- Which required workflows have been tested on this Windows 7 edition and architecture, with what results? measurement
- What evidence shows that a workflow requires Windows 7 rather than a particular runtime, privilege setting or application configuration? boundary
Device and driver fit
Relates Windows 7 to the drivers and peripherals required for useful operation.
Required driver chain
Record required devices, installed driver versions and recoverable driver sources for the operating-system architecture.
- Which required devices lack a functioning driver on this Windows 7 installation? measurement
- Where are verified compatible drivers available for restoring this installation, and what evidence establishes their origin? provenance
Exposure and containment Assesses reachable services, access controls and the practical boundaries of continued Windows 7 operation.
Bootability and application compatibility do not establish that a Windows 7 installation is acceptable for its network and workload.
Reachable legacy services
Records actual network reachability and enabled remote-access or file-sharing services.
Observed service exposure
Record exposure of services such as Remote Desktop and SMB, including protocol configuration and observed access paths.
- Which Windows 7 services are reachable from each relevant network, and which SMB protocol versions are enabled? measurement
- Which reachable services are required by a documented workflow and which may be disabled or restricted? action
Effective protective controls
Checks whether configured protections remain functional for this Windows 7 installation.
Containment and control evidence
Record firewall enforcement, privilege boundaries, protection-software maintenance and independently verified isolation.
- What observations show that firewall rules, account restrictions and installed protection software are functioning on Windows 7? measurement
- What authorised containment changes preserve required workflows while reducing untrusted access? action
Recovery and exit Determines how to recover the installation and how to end or constrain dependence on Windows 7.
Servicing or migration can fail unless boot recovery, legacy dependencies and restoration constraints are understood first.
Boot and restoration readiness
Assesses current startup condition and whether recovery resources match the installation.
Tested recovery path
Record boot failures, recovery-environment availability, verified images and restoration dependencies.
- Does Windows 7 boot normally, and what evidence identifies any startup or system-integrity failure? measurement
- Has restoration been tested with suitable recovery media, storage drivers and any required disk-encryption recovery material? action
Migration or controlled retention
Defines evidence and acceptance conditions for replacing, preserving or retiring the Windows 7 environment.
Validated disposition
Record the selected disposition, workflow acceptance tests, responsible owner and rollback or retirement conditions.
- Which application, peripheral and data-access tests must a replacement environment pass before this Windows 7 installation can be retired? action
- If Windows 7 must be retained, who authorises that decision and what isolation, review date and exit conditions apply? action
Evidence and external alignment What the world already says about this thing, gathered so the model can be checked against it.
A model that cannot be lined up against existing standards, identifiers and practice cannot be adopted by anyone who already uses them.
Reported evidence
Findings from the breadth pass, kept separate from the structural claims.
Kinds and varieties
Reported by the breadth pass; each item needs checking against its source before it becomes normative.
- Windows 7 Starter (OEM, 32-bit-only, emerging-market SKU)
- Windows 7 Home Basic (emerging-market consumer SKU)
- Windows 7 Home Premium (mainstream consumer SKU)
- Windows 7 Professional (domain join, BitLocker on some channels, XP Mode)
- Windows 7 Enterprise (volume-licensed; AppLocker, DirectAccess, full BitLocker)
- Windows 7 Ultimate (retail superset of Enterprise-class features)
- Windows 7 N and KN (EEA and South Korea SKUs without bundled Windows Media Player; KN also without Media Center)
- Windows Embedded Standard 7, POSReady 7, and Windows Thin PC (industry, POS, and thin-client NT 6.1 SKUs)
- Which of these kinds and varieties hold for the sense of Windows 7 this model covers, and on what evidence? provenance
Identifiers and schemes
Reported by the breadth pass; each item needs checking against its source before it becomes normative.
- Wikidata - Q11215 - Item commonly used for the Windows 7 product; treat as a join key only after confirming the label on Wikidata
- Microsoft NT version - 6.1 - Reported by winver and by the kernel as 6.1; not a marketing name
- Microsoft build - 6.1.7600 (RTM) or 6.1.7601 (Service Pack 1) - SP1 is the last service pack; later fixes were rollups and monthly updates
- CPE 2.3 - cpe:2.3:o:microsoft:windows_7:*:*:*:*:*:*:*:* - NIST NVD product identifier family; edition and service-pack are encoded in later CPE fields when known
- Marketing product name - Windows 7 - Often qualified by edition and architecture, e.g. Windows 7 Professional 64-bit SP1
- Which of these identifiers and schemes hold for the sense of Windows 7 this model covers, and on what evidence? provenance
Standards and regulation
Reported by the breadth pass; each item needs checking against its source before it becomes normative.
- Microsoft Software License Terms (EULA) for the relevant OEM, retail, or volume-license channel, issued by Microsoft
- Microsoft Fixed Lifecycle Policy for Windows 7 (mainstream end 13 January 2015; extended end 14 January 2020), issued by Microsoft
- Windows 7 Extended Security Updates (ESU) program, issued by Microsoft as a paid, time-boxed add-on after extended support
- Windows Hardware Quality Labs / Windows Hardware Certification requirements for signed drivers, issued by Microsoft
- Common Criteria evaluations of Windows 7 as a client OS, issued under national CC schemes (including NIAP in the United States)
- FIPS 140-2 validation of Windows cryptographic modules used on Windows 7, overseen by NIST (CMVP)
- European Commission Microsoft media-player tying remedies, which produced the N editions without Windows Media Player
- South Korea Fair Trade Commission remedies, which produced the KN editions without Windows Media Player and Windows Media Center
- Which of these standards and regulation hold for the sense of Windows 7 this model covers, and on what evidence? provenance
Real-world use
Reported by the breadth pass; each item needs checking against its source before it becomes normative.
- Shipped as the OEM desktop and laptop OS on most consumer and business PCs from late 2009 through the Windows 8 transition
- Run as a domain-joined, Group Policy-managed workstation in enterprises throughout the 2010s (Professional and Enterprise)
- Still found after end of support on shop-floor controllers, medical and laboratory instruments, kiosks, and air-gapped industrial PCs that cannot move off a vendor-certified image
- Used as a DirectX 11 gaming and multimedia client in its supported lifetime
- Hosted Windows XP Mode (Virtual PC) on Professional and higher for last-generation XP line-of-business applications
- Which of these real-world use hold for the sense of Windows 7 this model covers, and on what evidence? provenance
Typical measurements
Reported by the breadth pass; each item needs checking against its source before it becomes normative.
- Published minimum RAM, 32-bit install - 1 (period machines commonly 2-4 usable) - GiB
- Published minimum RAM, 64-bit install - 2 (period machines commonly 4-8; later holdouts 8-16) - GiB
- Published minimum system-volume size - 16 (32-bit) to 20 (64-bit) - GB
- Minimum CPU clock in Microsoft's requirements - 1 - GHz
- NT version and build - 6.1.7600 (RTM) or 6.1.7601 (SP1) - version.build
- Microsoft extended-support window from general availability - 2009-10-22 to 2020-01-14 (ESU for eligible licenses through 2023-01-10) - date
- Which of these typical measurements hold for the sense of Windows 7 this model covers, and on what evidence? provenance
Failure modes and hazards
Reported by the breadth pass; each item needs checking against its source before it becomes normative.
- Internet-facing or SMB-exposed installs after January 2020 receive no ordinary security patches; SMBv1/EternalBlue (CVE-2017-0144) and later unfixed bugs remain a ransomware and worm path (WannaCry-class)
- Current browsers, TLS stacks, and code-signing PKI have dropped the platform, so HTTPS, software download, and update channels fail or silently weaken
- Modern GPU, Wi-Fi, storage, and chipset hardware lack Windows 7 drivers; 32-bit installs also hit the ~3-4 GiB usable RAM ceiling
- Product activation / OEM SLIC and BIOS-locked keys fail after motherboard replacement or imaging onto dissimilar hardware
- BitLocker recovery lockout after TPM, firmware, or boot-path changes on still-encrypted disks
- Which of these failure modes and hazards hold for the sense of Windows 7 this model covers, and on what evidence? provenance
Regional variation
Reported by the breadth pass; each item needs checking against its source before it becomes normative.
- Starter and Home Basic were sold mainly as OEM SKUs in emerging markets (including China, India, Brazil, and Russia), not as the usual North American or Western European retail lineup
- N editions were the EEA SKU without Windows Media Player; KN editions were the South Korean SKU without Windows Media Player and Media Center
- Default UI language, MUI pack availability, and input locales followed market SKUs rather than a single worldwide image
- Post-EOS continuation under ESU, isolation, or national procurement rules varied by sector and country; some industrial and public-sector estates kept Windows 7 long after retail support ended
- Which of these regional variation hold for the sense of Windows 7 this model covers, and on what evidence? provenance
Neighbouring kinds and how to tell them apart
Reported by the breadth pass; each item needs checking against its source before it becomes normative.
- Windows Vista - winver reports NT 6.0 on Vista and NT 6.1 on Windows 7; Vista's last service pack is SP2, Windows 7's is SP1
- Windows 8 / Windows 8.1 - winver reports 6.2 (Windows 8) or 6.3 (8.1); those releases replace the Start menu with a Start screen, which Windows 7 does not
- Windows Server 2008 R2 - Same 6.1 kernel family, but the product is a server SKU (roles/features, no consumer Aero edition set); check product name in winver and whether Server Manager is present
- Windows 10 - winver reports 10.0; servicing is cumulative feature/quality updates under a different lifecycle, not a single SP1 plus monthly rollups
- Windows XP - winver reports NT 5.1 (or 5.2 for x64); XP has no Aero desktop and a different driver and security model, despite often being lumped with Windows 7 as "old Windows"
- Windows Embedded Compact 7 - Compact/CE is not the NT 6.1 kernel; it appears on non-PC embedded targets. NT-based industry SKUs are named Embedded Standard 7, POSReady 7, or Thin PC
- Which of these neighbouring kinds and how to tell them apart hold for the sense of Windows 7 this model covers, and on what evidence? provenance
Sources
- Windows 7. Wikipedia, Wikimedia Foundation - RTM and GA dates, NT 6.1 identity, edition roster including N/KN and embedded relatives, architectures, SP1, predecessor/successor, and published hardware minima
- Windows 7 product lifecycle. Microsoft Learn, Microsoft - Fixed Lifecycle Policy dates: mainstream support end 13 January 2015, extended support end 14 January 2020, and the existence of a paid Extended Security Updates program after EOS
- Windows 7 support ended on January 14, 2020. Microsoft Support, Microsoft - End of security-update servicing for retail/OEM Windows 7, and the practical consequence that remaining instances are out of Microsoft's ordinary patch channel
What the second pass must settle
- Does registry entry vr.tr.windows-7 denote the Windows 7 product family, individual installations or both, and how should that interpretation fit its PHY / PHY.OBJ placement?
- Are Windows Embedded Standard 7, Windows Embedded POSReady 7 and similarly branded derivatives separate registry concepts, or does this entry explicitly include any of them?
- Which authoritative lifecycle and servicing sources establish the exact edition-specific support periods, update prerequisites and exceptions that the completed model should reference?
- Which licensing sources establish restoration, hardware-transfer and virtualisation permissions for the installation channels the model must cover?
- What evidence threshold and organisational authority should determine whether a Windows 7 dependency justifies continued isolated operation?