Legacy, On-Premises & Air-Gapped Systems

Why Open Stack Forge

Founder-led, with habits built for systems that can't fail quietly

Open Stack Forge is led by founder Calvin Gould, a systems administrator for 12 years, with 10 of those years supporting on-premises, legacy and air-gapped systems, including in environments that run 24/7. That experience was gained in full-time industry roles and independent work. Open Stack Forge is an independent company and is not affiliated with or endorsed by any employer.

Our support hours: Monday to Friday, 8:30 a.m. to 4:30 p.m. Atlantic. On IT Secure plans, P1 issues (a total outage or an active security incident) get a 1-hour, 24/7 response by phone. On-site visits by appointment on agreed weekdays.

That background sets how we work on your systems:

✓Change control: planned maintenance windows, an image or backup before every change, a written rollback plan and a check afterwards.
✓Recovery first: restore tests with evidence, gold images, and a plan for spare hardware nobody sells anymore.
✓Disconnected operations: offline update cycles, and removable-media transfers that are scanned and logged.
✓Documentation: runbooks another administrator could follow.
✓Lifecycle tracking: a register of what's past end of support, who owns it and when it's being replaced.

You work directly with the person who founded the company.

Support Hours

Monday to Friday

8:30 a.m. to 4:30 p.m. Atlantic. On IT Secure plans, P1 issues (a total outage or an active security incident) get a 1-hour, 24/7 response by phone. Cutovers can be scheduled in the evening or on a weekend by agreement.

Other after-hours requests handled the next business day
Every job scoped in writing before work starts

Book a Conversation

Why Now

Microsoft end-of-support dates

Several widely used Microsoft products have reached, or are about to reach, the end of their updates.

Windows Server 2012 / 2012 R2

The last paid security update was released on Oct 13, 2026.

Exchange Server 2016 / 2019

Paid updates end in October 2026, with no further extension.

Windows 10 (business PCs)

The first year of extended updates ended on Oct 13, 2026.

Windows Server 2016

Extended support ends on Jan 12, 2027.

If you still run any of these, you have options: replace, pay for extended updates, isolate, keep on-premises on a supported version, migrate or move off the cloud. We'll help you choose for each system, in writing, with the reasoning.

Is It Right for You?

Who this is for

Any business with systems that can't simply be upgraded or moved. For example:

✓Offices of 5 to 50 people with an on-prem file server, Active Directory, line-of-business software, an older Exchange server, or a hybrid setup.
✓Seafood processors, cold storage, food and small manufacturing with older PCs running scales, labellers, inventory or refrigeration software.
✓Clinics, labs and dental offices with instrument or imaging PCs locked to an older Windows version by the device vendor.
✓Municipalities and public bodies that need on-premises or Canadian-hosted systems.
✓Organizations with networks that are deliberately kept offline.
✓Anyone who wants off subscription lock-in or US-hosted services.

No Default Answer

On-premises, hybrid or cloud: decided per system

We don't push everything to the cloud, and we're not against it either. For each system we recommend on-premises, hybrid or cloud in writing, with the reasons, the costs and the trade-offs.

And we'll be straight with you: staying on-premises with Microsoft products is still Microsoft licensing. Where an open-source or non-Microsoft option really fits your software, we'll show it to you.

Services

What we do

Each service is scoped and quoted in writing after a first conversation.

A1

Assessment

Legacy, End-of-Life & On-Prem Assessment

For offices of 5 to 50 people. Often the next step after the Free IT and Security Checkup.

An inventory of your servers, PCs, apps, network edge devices and backups, with their support status and end dates
A check of what's visible from the internet, only for addresses you own and authorize in writing
A backup and restore reality check
A list of PCs tied to equipment or locked to line-of-business software
An evidence pack for your cyber insurance application
Options for each system: replace, extended updates, isolate, keep on-premises, migrate, or move off the cloud

A2

Isolation

Isolation & Compensating Controls

For systems that can't be upgraded yet. Isolation reduces the risk around an old system. It doesn't remove it, so the plan always ends with a replacement date.

Moving the system onto its own restricted network segment
No internet access, or a tightly limited allowlist
Application allowlisting where the system supports it
Admin access through a jump host with MFA
Removable-media rules
Logging and alerting
A gold image and a spare-hardware plan
A signed control sheet that records the remaining risk and the replacement date

A3

Offline Networks

Air-Gapped / Disconnected Systems Administration

Monthly care for networks that are deliberately kept offline:

A monthly update cycle. Updates are downloaded and approved on a connected server, tested, moved across on scanned and logged media, and deployed in an agreed window with a rollback plan.
Offline antivirus definition updates
Active Directory and server health checks, account reviews and log review
Scheduled on-site visits on agreed weekdays

An offline network can't be monitored remotely, so we also give your staff a written disconnected-operations runbook for first response.

A4

Backups

Backup & Restore Assurance

3-2-1 backups with an offline or immutable copy, encrypted
Full images for legacy PCs and equipment-connected PCs
Test restores every quarter, with evidence
A restore runbook

The approach is aligned with the Canadian Centre for Cyber Security's backup guidance.

A5

Documentation

Documentation & Runbooks

As-built documentation of your network, servers, Active Directory and dependencies
Disaster-recovery and restore runbooks
A procedure for keeping admin credentials in escrow
A vendor and licence register, and an end-of-life register with review dates

Written so another administrator could take over.

A6

Servers

On-Prem Server & AD/Hybrid Management

Monthly care for the servers you keep:

Patching, including extended updates where you've licensed them
Monitoring and backup checks
Active Directory hygiene: stale and privileged accounts, and Group Policy review
Hybrid identity health (Entra Connect)
Hypervisor care, plus certificate and licence renewals
A monthly report

A7

Migration

Migration & Modernization

Mapping what depends on what
Options for each workload: refresh on-premises, Exchange Server SE, hybrid, cloud or open-source
A cost comparison of extended updates against replacement, plus help sorting out the licensing (which we can supply as a reseller)
The migration itself: a verified backup first, a planned cutover window and a rollback plan

A8

Repatriation

Cloud Repatriation

The infrastructure side of the way off Big Tech:

Your cloud bill compared with the total cost over 3 to 5 years of on-premises or Canadian-hosted options
A data-residency check
The target design, the migration and planning for cloud exit fees
Shutting down the cloud services you no longer need

Clear Scope

PCs connected to equipment: where our work stops

Many plants and clinics have a Windows PC that runs a machine, a scale, an instrument or refrigeration software. We look after the Windows PC: its image or backup, its network isolation, and OS-level care where the equipment vendor's support terms allow it.

Included

What We Look After

The Windows PC's image or backup, taken before any change
Network isolation for the PC
OS-level care where the equipment vendor's support terms allow it

Not Included

What We Don't Touch

Control logic, PLC or HMI configuration, safety or protection systems, or instrument settings. Those stay with your staff, the equipment vendor or integrator, or a licensed P.Eng.
Any change to an equipment PC without your change approval and, where the vendor's support contract requires it, the vendor's agreement. We always image or back it up first.
This is IT administration, not security work on control systems.

Cyber Insurance Readiness

Evidence for your application, not answers on it

Cyber insurance applications commonly ask whether you run end-of-life or unsupported software and how it's separated from the rest of your network. They also ask about offline, tested backups.

We give you an end-of-life inventory, documented isolation controls, restore-test evidence and a dated replacement plan, so you can answer those questions accurately.

You answer and sign the application. We supply the evidence. We never fill in or attest to the answers.

We can't promise coverage, a premium or an approval. Those decisions belong to your insurer and broker.

Cyber Insurance Readiness →

How We Work

Hours, licensing and scope

✓Business hours: Monday to Friday, 8:30 a.m. to 4:30 p.m. Atlantic. On IT Secure plans, P1 issues (a total outage or an active security incident) get a 1-hour, 24/7 response by phone. On-site visits are by appointment on agreed weekdays. Cutovers can be scheduled in the evening or on a weekend by agreement.
✓After hours: on IT Secure plans, P1 issues (a total outage or an active security incident) get a 1-hour, 24/7 response by phone. Other after-hours requests are handled the next business day.
✓Licensing: we can supply licences as a reseller (Microsoft, backup software and others) and earn a margin from the distributor, or you can buy them directly. You'll see the price, term and cancellation window before you approve, and nothing is ordered without your written approval. You stay responsible for licence compliance.
✓Every job is scoped in writing before work starts.

1

A conversation

Tell us what you're running, what's past end of support and what your insurer asked.

2

A written scope

What we'll do, what we won't touch, and the windows and rollback plans.

3

A plan for each system

One you can act on. Every job is quoted in writing after the first conversation.

Straight Answers

Frequently Asked Questions

Can you make our old server secure?+

No one honestly can, once it's out of support. What we can do is reduce the risk around it: isolate it, limit its access, back it up, test the restore and document the remaining risk. Then we plan its replacement.

Our packing-line PC runs Windows 7. Do we have to replace it?+

Not necessarily, and not overnight. We can image it, isolate it on the network and plan for spare hardware. We won't touch the machine's own software or settings. That's for your equipment vendor or integrator.

Do you think the cloud is bad?+

No. Some systems belong in the cloud and some don't. We recommend per system, in writing.

Can you patch a network that's never connected to the internet?+

Yes. Updates are downloaded and approved on a connected server, carried across on scanned and logged media, and installed in a planned window with a rollback plan.

Are you available around the clock?+

On IT Secure plans, yes, for P1 issues (a total outage or an active security incident): we respond within 1 hour, 24/7, by phone. Everything else is handled Monday to Friday, 8:30 a.m. to 4:30 p.m. Atlantic.

Start with a conversation

Tell us what you're running

Every job is scoped and quoted in writing after the first conversation.

Book a Conversation Free IT and Security Checkup

Download the one-page overview (PDF, 1 page)

Open Stack Forge · Serving Halifax Regional Municipality, Nova Scotia · info@openstackforge.ca · 902-706-8753 · Monday to Friday, 8:30 a.m. to 4:30 p.m. Atlantic

Legacy, On-Premises & Air-Gapped SystemsFor the systems you can't just upgrade, or shouldn't hand to Big Tech.