Setup and Security of XP Mode in Windows 7 SP1

Question

I purchased my new ThinkPad W530 with Windows 7 SP1 and XP Mode factory installed to allow use of some "legacy" programs.  Presumably the first thing I have to do (if I can figure out how to get XP activated) is to download all the updates before extended support ends in April.  Reading the accompanying Lenovo documentation, I see the statement, "Note: For secuirty reasons, you should run a version of the antivirus program and firewall that you use with your Windows 7 operating systems."  (I presume they mean inside the virtual machine.)
Has anyone satisfactorily accomplished this?  Does it mean I have to install (for example) MSE in the virtual copy of XP, somehow keep it updated as well, and, of course, turn on the Windows XP SP3 firewall (and/or purchase and install another copy of, for example, W78C)?  Will such installations and settings persist from session to session of XP Mode, or do they have to be renewed at every new session?  Similarly with Windows Updates -- do they persist through a shutdown once installed?
Once XP support ceases, I suppose the only safe thing to do is shut off Internet access to XP entierely through its built-in firewall.  Does that agree with prevailing wisdom?
Any experience or suggestions would be most welcome! -- JCW2

Answer 1

Nobody has answered your questions, so I'll give it a shot, but I emphasize I'm not any kind of expert.
Here's how I set up Windows 7 Virtual PC XP Mode:
1) Both the XP Mode and Virtual PC install packages are available on the download.microsoft.com web site and can be installed once your PC has passed the "Genuine Windows" test, so it's convenient to visit that website with Microsoft's Internet Explorer--an ActiveX control will be used.
2) The Windows XP Mode is installed first, then the Virtual PC "Update" (.msu) package. I think a reboot was necessary the last time I did it.
3) Once rebooted, use the "Windows Virtual PC"-->"Windows XP Mode" shortcut to start the process rolling. You don't need to be logged into an admistrative account to do this--use your regular login account--since the Windows Virtual PC machines are set up for each individual user of your machine.
4) You will be asked various questions, such as to set a password for XP Mode--make sure you tick the option to store the password, and later to enable automatic Windows Updates. Depending on the speed of your PC, the complete setup might take 5-10 minutes.
5) Finally, the window opens to the complete XP desktop, and the first thing to do is to start the MSIE 6.0 browser using the "Windows Update" shortcut in the Start Menu. The browser will ask for permission to install various bits and pieces of the Windows Update program, and eventually get you to a web page that offers a choice of Automatic or Custom updates. I always choose Custom, since I don't want extra programs like Bing Bar or Windows Live Blog/Video/Picture editors. I do install "Windows Search 4.0" for easy searches in the virtual XP machine.
N.B. If you install a program in Windows XP mode that registers itself as the default program for particular file types, these choices will often be transferred to the host Windows system! So you have to be really careful when installing e.g. an old version of Microsoft Office in Windows XP mode, since you may then find that opening an Office document in Windows 7 suddenly starts up the program version installed in the virtual XP Mode. You can correct these missteps in the Windows 7 Control Panel's "Default Programs" area.
6) Using the Windows Update website displayed in the browser choose and install all the updates you want--I install everything except the optional standalone programs like the ones I mentioned earlier.
7) You'll need to go through 2 or 3 reboot cycles of the virtual XP machine to get all the updates. I also switch to the "Microsoft Update" web site choice given on the "Windows Update" website in order to obtain the maximum number of critical and optional updates. make sure the XP system's "System Restore" feature is enabled!
8) Install all the other programs you want in the virtual XP machine and their updates.
9) At this point, I shutdown the XP machine entirely via the "Ctrl+Alt+Del" menu point of the XP Mode window and choosing "Shutdown" in the XP dialog--remember that XP Mode is configured to hibernate when the close button is used on the XP Mode enclosing window.
10) Each time before I make major changes in the virtual XP machine I go via the Windows 7 Start Menu into the Settings of the Windows XP Mode machine (i.e. "Windows Virtual PC"-->"Windows Virtual PC" and enable "Undo Disks". This setting is useful when you recognize that something has gone wrong/mis-configured in the XP Mode and you want to completely drop the changes. After the major changes are shown to work, use the "Apply changes" choice in the Undo Disk settings panel. I keep the Undo Disk always enabled in any case.
Windows XP mode security (set in the Settings panel of the XP Mode machine):
1) if you are not going to use any Internet connection from programs running in the virtual XP, set the Networking to "Internal Network" or "Not Connected" except when updating the machine.
2) if read/write access to the local disks of the Windows 7 host system is not really required from the XP machine, disable it in the "Integration Features" panel.
3) Microsoft Security Essentials has steadily lost ground in its detection rates of malware activity over the last 2 years, eventhough it is very efficient in use of system resources. One of the lighter weight free anti-malware XP compatible products that keep a local off-line signature database and monitor system activity (e.g. Avira or AVG) will probably keep the XP virtual machine healthy.
4) If you use Internet via the XP machine, you should have good current anti-malware-behavior software installed on the host Windows 7 machine, so that anything that "jumps the gap" from XP to the host is caught--XP is still a relatively greater security risk.
Anyway, that is roughly how I set up Windows XP Mode.