I've done IT for labs. The PCs these insanely expensive machines are hoked to make me absolutely sick with how they have to be set up. You have a testing machine, be it a mass spec, PCR, whatever, costing 6 and 7 figures with a $500 PC that has every imaginable security hole and updates turned off. Drives me bonkers.
That PC is only for controlling this machine and no need to be on internet, right? If so, just config the windows firewall to disconnect it from the internet?
I do that on my home machines. All updates are disable and I manually enable them every 6-12 months to let win10 to go crazy for a day or so and everything is up to day.
One can also monitor the podcast such as "Security Now" to check if the latest windows update processes have any special BSOD or silently / randomly delete all users files/profiles before turn on the update.
Except you need them on the local LAN to share data, and you need them to have internet access through the local LAN so the vendor can log in remotely for maintenance and troubleshooting.
