For anything that HAS to work and only runs on Windows (eat a dick Siemens) I put it in a VM with no network connection. A physical machine that gets regular updates is too unstable to rely on.

When ever I'm teaching a new guy I try to get them on board with using VMs at at minimum for reliability and a VM under Linux if they are interested.