[iurisilvio]

My reason: I don't live in an IT perfect world. Moving parts that always break with updates.

I have third party provided configuration in some machines and most of the Windows updates break these configurations. When it happens, I have to call these third party and a non-IT person come here to reconfigure things.

These configurations are mostly client certificates that work only with IE8 or older (!!!). Their websites use ActiveX, Flash or some other buggy tech. I have the option to maintain my computers working without patches or I update my Windows and wait 2 days (or more) before they're able to reconfigure my machines (and this downtime costs a lot).

I try to sandbox these machines in my network, but you know it is not perfect.