Most people I speak to in Canada, Europe and Central America seem perplexed why Americans they know do not seem more alarmed.
The massive amount of legacy .NET and older software still running in many enterprises isn’t a problem, but a huge business opportunity.
My prediction is that Microsoft will push hard their “Azure Virtual Desktop” product: remote, virtualized Windows instances hosted on their own servers to these enterprises.
In this model, the operating system running on the client devices will becomes largely irrelevant.
My personal experience says that the best way is that Ops team shouldn not be repurposed as Developers, rather put the experienced Developers into Production Support (incident management, that's intense Ops, working in shifts and weekends, etc.). And rotate them whenever needed. Over a period of time, you'll invariably see less defects and issues percolating down from the Devs, and then after both sides are stable and working well together with less friction and open tickets, then some more tech savvy Ops members can be rotated into Development teams as rookie devs to help reduce costs a bit (as there'll invariably be some natural attrition among the Devs and Ops, so this gives an alternative career path to the Ops team (who are usually less paid, and more stressed), and pushes the Devs not to become complacent). Such an approach is doable and productive.
Use a dependency cooldown, okay … but don’t commit your lockfile so you are always running the latest transitive deps? That’s nuts.
The old NT based ACL's/GPO's and such are obsolete as I said when a cheap Linux KVM server can do tons of stuff by itself and firewalls (even professional ones) are dirt cheap. The old world died long ago.
You shouldn't be backing up profiles, accounts or settings from an AD domain. We should already have instant VM booting (from the network) with everything snapshotted to a working state since long ago.
Different users will have licenses to different software. Maintaining individualized VM images isn't sustainable.
I think this blog demonstrates the problem. To a lot of people this is perfectly straightforward. Others might think, “but my GitHub account is where I keep all my private repos.”
When listing access controls, I think most nouns need to very carefully map back to a clear definition, ideally full of examples and bulleted lists of “what this is” and “what this isn’t”
> "If the app is requesting any kind of repository, organization, or enterprise permission (read or write) then the note still appears."
And then "what this is":
> "This allows applications to sign in users and get their profile information and email addresses (if requested) without undue alarm."