On the original question, it depends. The .gov I work for has been trying to expunge XP with a vengeance. If an agency we support insists they need it for some outdated app, they have to document it, get a security exception, and officially own the fact that if they get infected we will block their asses from the network and will not let them bring it back online.