The databases sit on two of 34 servers highlighted in Auditor-General Maxine Cooper's latest report as being in need of a system update.

In 2015-16, 65 per cent of the 106 servers identified as having unsupported operating systems were upgraded or replaced but Dr Cooper said many servers with outdated systems remained.

Systems that use servers with unsupported operating systems include those used for medical transcription, recording adverse drug reactions, land titles, business licensing and managing territory revenue.

"The continued use of unsupported operating systems on servers increases the risk of the ACT government network, including applications and data, having security vulnerabilities or performance problems," Dr Cooper said.

Dr Cooper recommended government directorates either update their systems posthaste or, if vendor support couldn't be gained, find ways to minimise the risk of security and performance problems.

The Chief Minister, Treasury and Economic Development Directorate said a program to either decommission, upgrade or replace was underway, with the matter expected to be addressed by June 30.

In the interim, Trend Micro Deep Security has "laced" all vulnerable systems in a "virtual bubble" to protect them from attack, the directorate said.

Meanwhile, Health told the auditor-general four of the 10 servers she fingered in her report had been decommissioned, two more were being upgraded now, two would only be used for retrospective data enquiries and solutions were being sought for the other two. It said the process would be finished by next June.

The Environment and Community Services Directorates said its server problems would be fixed by June 30, while Transport and City Services said it was in the tender phase with a replacement system expected to be completed in 2019.

Dr Cooper also recommended the government removed all generic user accounts and give all users unique log-ins and passwords.

"Generic user accounts are a threat to security because the sharing of accounts between users prevents the tracing of activities, including irregular or fraudulent activities, performed using these accounts to individual users," Dr Cooper said.

But the government said removing shared user accounts would undermine its ability to "deliver critical services" across health, education and emergency services.

"Many of the generic accounts are only activated during specific events, e.g. disasters or when undertaking specific tasks such as testing and training," the Chief Minister's directorate said.

"As such, implementing an expensive solution may not be a warranted determination."

Although it rejected Dr Cooper's recommendation, the government said it would restrict the issue of new generic accounts, review shared accounts and remove as many as possible.

At the time of the audit, there were 1132 generic accounts. This was cut to 1090 as of March 27.

The auditor-general also recommended the government bump up security on the territory revenue system, which records tax and fee revenue, by forcing users to create more complex passwords.

"This increases the risk of inappropriate or fraudulent access to this application and its data, as staff will be less likely to use complex passwords when they are not forced to do so by the application," Dr Cooper said.

However the government said the new revenue system, which will be commissioned from this August until the end of next year, would include the capacity for complex passwords.