This, this right here is the correct approach. Unfortunately, it is rarely taken, as economics are directly opposed to it. Usually you have a mixture of company

This, this right here is the correct approach. Unfortunately, it is rarely taken, as economics are directly opposed to it. Usually you have a mixture of company wide LAN, with directly connected machines, accessible on demand via VPN from service-contractors. My fallback approach is, to insist on machines incapable of self-destruction and Whole System BackUps. Its easier & cheaper, to unplug, replace some spare-parts, reinstall some acronis images and go. Sad world, but real world