Microsoft warns IT admins against using unsupported .NET runtimes on Windows

As time passes by and technology modernizes, Microsoft tends to deprecate and eventually remove legacy components of Windows. One such example is Windows Internet Name Service (WINS), a name resolution service pretty much replaced by DNS, with Microsoft emphasizing that Windows Server 2025 will be the last edition to support the tech. Now, the Redmond tech giant has warned IT admins against using unsupported versions of .NET runtimes as well.

Microsoft has highlighted that although the classic .NET Framework used to be a core component of Windows, the modern .NET Core is not. It is typically installed when needed by an application, but that also means that multiple versions of .NET can coexist. While this approach brings several benefits such as modularity, ease of open-source cross-platform development, and faster updates, a potential drawback is that the presence of an unsupported runtime can open the door for malicious actors, stability issues, and compliance problems.

Right now, .NET follows an annual release cycle and anything older than .NET 8 is unsupported. It is also worth highlighting that upgrading a .NET runtime in an environment does not mean that all applications will automatically use it, they must be updated separately with a new target framework, dependencies, and more.

To work around this problem, Microsoft has noted that it is very important that IT admins identify the .NET versions being used by each application. This can be done by running the following command in an elevated Command Prompt:

listdlls.exe -d coreclr.dll -accepteula -v

The next step is to upgrade applications which use outdated .NET versions. This is not something that IT admins can do alone since it requires access to the application's source code so the only way is to contact the developers of an outdated software. Once this is done and the application has been re-deployed, run the previous command again to ensure that no unsupported .NET runtime is being used. The final step is to then uninstall outdated .NET runtimes through the process detailed here.

Microsoft says that it "strongly discourages" the use of .NET installations which have reached end of life (EOL) as they don't cater to compliance requires, and they don't receive bugfixes, security updates, and technical support either. If you continue using them, certain endpoint security software will also flag it as a vulnerability, so it's best to proactively upgrade your deployments anyway.