Now you have all peaked my interest. I have several XP machines on the network, and even a few older machines that now log on with Linux on a Server where AC resides and runs with Windows server 2008. Is there any vulnerability to the system when a local, old machine goes out to the internet? (I am fearing the answer will be a big YES). These machines don't run AC locally, but some (my desk for example) run locally for everything else, and log on as a remote client to run AC. The Linux boxes function strictly as a thin client.
The short answer is that it is a risk. Wipe them and put Ubu, RedHat or CenTOS on them. Or wipe them and turn them into home machines.