Case Studies

Case Studies provide detailed documentation of real-world infrastructure, networking, and security system deployments delivered by Kent-ITS across commercial and specialist environments.

Each case study focuses on practical engineering delivery: the constraints present in the environment, the technical challenges encountered, the design decisions made, and the final system outcome. These are not marketing summaries, but structured technical breakdowns of how systems are designed, integrated, and stabilised in live operational conditions.

Case Study: Virtualisation Platform Evolution & Tape‑Based Backup Architecture

Over more than a decade of continuous operation, Kent ITS engineered and maintained a highly resilient enterprise virtualization and backup platform built entirely on secondary-market hardware and open-source software. Supporting critical multi-tenant business workloads—including core identity services, corporate email, file storage, and active application servers—the infrastructure was designed to counter tight capital constraints and aging hardware. By replacing restrictive, vendor-locked solutions with an agile XCP-ng hypervisor cluster and establishing a bare-metal, fully CLI-driven dual LTO tape rotation architecture, the platform successfully delivered continuous high-availability, complete data sovereignty, and a reliable, physically air-gapped disaster recovery pipeline without relying on costly commercial software licensing.
Section
Case-Studies

This long-term engineering initiative demonstrates the viability of executing high-availability infrastructure entirely within strict capital constraints. By shifting away from vendor-locked hypervisors to open-source XCP-ng virtualization, Kent-ITS established a resilient, three-node enterprise cluster utilizing secondary-market hardware. To solve the critical requirement for secure, cloud-independent data sovereignty, a custom CLI-driven dual-drive LTO tape backup pipeline was engineered. This architecture successfully sustained continuous multi-tenant business workloads, proving that rigorous, root-cause systems design can deliver absolute uptime and definitive air-gapped ransomware immunity without relying on costly commercial software licenses.

Operating over a ten-year evolutionary lifecycle, this infrastructure faced severe, compounding real-world constraints across compute, storage, and licensing. The initial environment relied on secondary-market enterprise hardware (HP ProLiant DL380 G5 and DL360 G6 hosts) backed by a modest QNAP NAS, which severely restricted iSCSI/NFS storage capacity and VDI retention depth. This hardware limitation was further exacerbated by restrictive vendor licensing; VMware’s free hypervisor actively blocked essential API access, native backup capabilities, and live migrations.

With zero budget allocated for commercial enterprise backup utilities, all data protection workflows had to be engineered entirely from scratch using native Linux CLI tools. As the virtualized workloads expanded, standard LTO4 and LTO5 tape capacities became insufficient to hold a rolling 30 days of unmanaged VDI snapshots. The core engineering challenge demanded maintaining a highly reliable, long-term retention platform with true, cloud-independent, air-gapped physical media security—all while enforcing strict zero-downtime requirements that mandated hypervisor upgrades and hardware migrations be performed entirely live on production systems.

1. Open-Source Hypervisor Migration & Cluster Architecture

To bypass restrictive vendor limitations, the entire platform was migrated from VMware to XenServer 7, followed by seamless, in-place upgrades to XCP-ng while critical production workloads remained entirely online. This migration established an agile, licensing-free infrastructure with open storage formats, granular command-line interface (CLI) control, and native live-migration capabilities. The underlying hardware topology was structured as a resilient three-node HP ProLiant DL360 G6 compute cluster, backed by a central QNAP NAS delivering shared iSCSI block storage and NFS data volumes for VM disks and transactional backups.

2. Hardware Lifecycle Evolution

As workload compute demands increased, Kent-ITS executed a live rolling hardware refresh, swapping out two legacy G6 nodes for high-density DL360 G9 enterprise servers. This mixed-generation host pool remained completely stable due to XCP-ng’s robust legacy and modern hardware abstraction layer. This targeted upgrade substantially optimized the infrastructure's aggregate CPU performance, available RAM capacity, and thermal/power efficiency without requiring a complete, high-capital system replacement.

3. Bare-Metal, CLI-Driven Tape Backup Architecture

A dedicated DL360 G6 node was decoupled and re-engineered into an isolated, bare-metal backup server. This server was fitted with a dual-drive physical tape array comprising an LTO4 tape drive mapped to /dev/st0 and an LTO5 tape drive mapped to /dev/st1. Completely avoiding the overhead of commercial backup suites, the entire automation engine was custom-built using standard Linux utilities (tar, mt, cron), direct NFS/iSCSI storage mounts, and native Xen Orchestra API streams.

Key engineered features include:

  • Direct-to-Tape Stream Optimization: Xen Orchestra streamed full and incremental Virtual Disk Image (VDI) chains at a sustained ~110 MB/s directly into the raw tar container interface. This completely bypassed local filesystem overhead, eliminated local scratch-disk requirements, prevented the creation of millions of unmanageable small metadata files, and maintained optimal tape transport speeds to stop destructive tape "shoe-shining."
  • Localized File-Level Compression: High-churn application data sets (Zimbra mail spools and Samba file sharing data) were compressed locally into consolidated backup.tar.gz archives, maximizing tape block capacity and streamlining bare-metal file restoration.
  • Dual-Drive Workload Segregation: To achieve maximum hardware throughput, backup routines split the parallel tasks across both tape drives simultaneously. The LTO4 drive handled the compressed local file archives, while the higher-capacity LTO5 drive independently managed continuous VDI streams and hypervisor metadata.
  • Low-Touch Automation Engine: Specialized cron shell scripts handled low-level tape operations—dynamically setting variable tape block sizes via mt, generating point-in-time archives, running the data stream, and triggering physical media ejection upon task verification. This restricted on-site human intervention to a simple, foolproof daily task: pulling the ejected tape and transferring it to off-site archival storage.

4. Pragmatic Retention & Capacity Management

The storage architecture implemented a tiered retention policy designed to balance physical storage limitations with strict business continuity requirements:

  • Near-Line: 14-day native hypervisor snapshots combined with rolling incremental VDI chains within Xen Orchestra for immediate local recoveries.
  • Air-Gapped: Daily full backups and months of chronological VDI history preserved across a strict physical rotation of offline LTO tape cartridges.

Retention depths were dynamically tuned and optimized over time as VDI structural chains expanded, safely operating within the physical constraints of the QNAP NAS while guaranteeing an uncompromised, long-term historical recovery pipeline.

  • Zero Data-Loss Incidents: Achieved total data preservation and absolute recovery verification over a continuous ten-year operational lifecycle.
  • Continuous System Availability: Maintained uninterrupted uptime for business-critical services during live hypervisor cluster migrations and major enterprise hardware refreshes.
  • Air-Gapped Ransomware Immunity: Established a definitive, vendor-independent backup format with a true physical air-gap, keeping historical archives completely safe from network-based encryption attacks.
  • Maximum Lifecycle Value: Extracted peak utility and enterprise performance from secondary-market hardware, completely eliminating the need for recurring commercial licensing fees.
XCP-ng
VMware ESXi
Offices
Meta Tag Description

Learn how Kent ITS engineered a high-availability XCP-ng cluster with custom, CLI-driven dual LTO tape backups on refurbished hardware to deliver absolute uptime and air-gapped ransomware protection.

Title Card Summary

A deep dive into a decade-long virtualisation platform that achieved zero data loss on refurbished hardware. Combines XCP-ng hypervisors with a custom, CLI-driven dual LTO tape architecture to deliver resilient, air-gapped ransomware protection.

Case Study: Microsoft 365 Data Extraction & Local Sovereign Backup Deployment

To establish complete data sovereignty and eliminate long-term cloud dependency, Kent ITS engineered and deployed an on-premise data extraction and retention architecture for a client's Microsoft 365 tenant environment. The initiative focused on mitigating the ongoing subscription costs, lack of physical data control, and systemic vendor lock-in risks associated with public cloud ecosystems. By implementing a dedicated enterprise-grade local repository powered by a hardware-accelerated backup platform, the solution safely extracted all corporate communication channels, file structures, and collaborative data stores. This deployment successfully returned absolute data ownership and immediate, self-hosted historical access to the client without introducing fragile, unmaintainable migration code.
Section
Case-Studies

This data protection initiative demonstrates a streamlined, zero-scripting approach to achieving absolute data sovereignty from public cloud tenants. Tasked with extracting critical business assets from Microsoft 365, Kent ITS bypassed fragile custom automation scripts and complex manual exports in favor of a robust, API-driven hardware integration. Deploying an on-premise Synology infrastructure running Active Backup, the architecture securely authenticated at the tenant admin level to pull complete mail, user directories, and document libraries into a private repository. This engineering approach delivered immediate cloud independence, verified multi-tenant disaster recovery, and an immutable local data archive while requiring zero ongoing maintenance overhead.

The client's operational dependency on the Microsoft 365 ecosystem created significant vulnerabilities, primarily driven by compounding monthly subscription overhead, an absolute lack of physical control over data locations, and the absence of an independent backup framework outside of Microsoft's infrastructure. This architecture exposed the business to severe disruption or data lock-in risks should tenant access ever be compromised.

Conventional remediation strategies typically rely on complex PowerShell scripting loops, third-party migration software, or staged manual exports. These traditional approaches introduce substantial risks, as they are inherently time-consuming, prone to API rate-limiting failures, difficult to audit, and require continuous administrative maintenance to account for upstream cloud changes. The core challenge was to build a reliable, repeatable data extraction pipeline that maintained structured data access without introducing systemic complexity.

1. Hardware-Accelerated Storage Provisioning

The foundational layer of the architecture utilized a dedicated, enterprise-grade Synology NAS array deployed directly on-site within the client’s physical infrastructure. The storage pool was provisioned with high-endurance enterprise drives configured in a redundant RAID array to handle heavy parallel disk I/O operations during large-scale historical data ingestion.

2. Secure Tenant Authentication & API Integration

Rather than using basic authentication or brittle screen-scraping techniques, the platform integrated directly with the Microsoft 365 tenant using secure, token-based administrative authentication. Leveraging native, officially supported Microsoft Graph APIs, the local system established an encrypted, high-throughput pipeline capable of reliable data extraction while strictly adhering to tenant security boundaries.

3. Automated Monolithic Data Extraction

The backup system was configured to systematically harvest all core data silos within the cloud tenant, translating disparate cloud objects into an organized local repository. The automation engine targets three critical business zones:

  • Exchange Online: Full archival extraction of all corporate mailboxes, calendars, and contacts.
  • OneDrive for Business: Systematic downloading of individual user directories, personal files, and configuration data.
  • SharePoint Online: Complete retention of corporate document libraries, team site data assets, and structural file hierarchies.

4. Low-Maintenance Orchestration

By utilizing a supported, hardware-integrated backup suite rather than custom-coded infrastructure, the platform maintains structured access to the data without requiring complex file format conversions. The automated scheduler runs incrementally outside of core business hours, utilizing delta-sync technology to pull down only modified data, minimizing local network saturation and ensuring the on-premise archive remains perfectly synchronized with minimal oversight.

  • Absolute Cloud Independence: Successfully mirrored the entire Microsoft 365 tenant environment onto private, locally controlled enterprise hardware.
  • Elimination of Vendor Lock-In: Mitigated the risk of data loss or access denial by maintaining a secure, fully structured backup completely isolated from Microsoft infrastructure.
  • Turnkey Operational Simplicity: Replaced complex scripting loops with a highly stable, API-driven automation engine that requires near-zero administrative upkeep.
  • Future-Proof Hybrid Architecture: Established a highly scalable, on-premise data platform capable of supporting seamless future migrations or localized hybrid cloud strategies.
Meta Tag Description

Learn how Kent ITS used enterprise-grade local storage and native APIs to securely extract Microsoft 365 data, delivering true data sovereignty and cloud independence.

Title Card Summary

A practical guide to securing public cloud data sovereignty. Explains how Kent ITS paired on-premise enterprise storage with native Microsoft APIs to extract mailboxes, OneDrive, and SharePoint data into an independent, zero-maintenance local archive.

Case Study: The "Connectivity Gap" – 200Mbps via Mast-Head LTE

Kent ITS engineered and deployed a high-throughput, mast-head LTE cellular broadband architecture to bridge a critical connectivity gap for a remote commercial facility. The location was stranded in a digital dead zone due to prohibitive five-figure Openreach civil engineering quotes for traditional fiber installation. To overcome the extreme signal attenuation associated with long coaxial cable runs, the solution deployed an integrated high-gain radio and modem directly at the mast-head, utilizing carrier aggregation to deliver commercial-grade broadband over external-grade digital copper cabling. This deployment provided reliable high-speed member wireless access, a static public IP for secure VPN monitoring, and lightning surge protection for a fraction of the cost of physical infrastructure excavation.
Section
Case-Studies

This network engineering project demonstrates the use of advanced RF (Radio Frequency) engineering to defeat severe geographical infrastructure limitations. Faced with a £10k+ fiber installation barrier, Kent ITS bypassed traditional landlines entirely by building an on-site wireless local loop. By utilizing an integrated mast-head processing architecture, the design eliminates high-frequency coaxial signal degradation by converting cellular signals to digital data directly at the antenna focus. Featuring Category 18 carrier aggregation, specialized atmospheric surge protection, and a managed wireless mesh integration, this project successfully delivered 200Mbps speeds to a remote facility, proving that precision radio engineering can substitute for costly civil infrastructure.

A newly constructed remote facility was left completely isolated from traditional telecommunications networks. Openreach quoted civil engineering and trenching costs exceeding £10,000 to bring a dedicated fiber or copper line to the site, creating an immediate project standstill. The facility strictly required high-speed, low-latency internet to support open guest WiFi networks for its members alongside a static public IP address to allow for secure, encrypted inbound VPN remote monitoring.

Typical consumer-grade deployments fail in these environments because providers install an internal cellular router coupled to an external antenna via long coaxial cables. At high 4G/5G radio frequencies, the signal loss ($dB$ attenuation) across coaxial cabling is incredibly severe, often reducing the captured signal to an unusable state before it ever reaches the router's modem. The core challenge required capturing weak, distant cellular signals at peak strength and delivering it into the local network without cable-borne signal degradation or exposing the internal network to atmospheric electrical hazards.

1. Mast-Head Processing & Advanced RF Engineering

To completely eliminate coaxial signal loss, Kent ITS deployed a specialized MikroTik LHGG integrated dish architecture mounted to a 6-foot external mast. This system places the cellular modem and high-gain directional antenna inside a single weatherized enclosure at the focal point of the dish. By processing the raw radio frequency waves at the mast-head, the cellular signal is immediately converted into standard digital data packets directly at the source, ensuring maximum signal capture and link quality.

2. Digital Transport & Industrial Cabling

Once converted at the mast-head, the data is transmitted down into the facility using heavy-duty, external-grade Category 6 SFTP (Shielded and Foiled Twisted Pair) copper network cabling. Because digital Ethernet signals suffer zero degradation over these distances compared to raw RF cables, the internal router receives an uncompromised, full-strength data stream regardless of mast height or cable length.

3. Carrier Aggregation Hardware Optimization

Rather than utilizing basic Category 4 cellular equipment which binds to a single wireless frequency band, Kent ITS sourced an advanced Category 18 radio subsystem. This hardware level unlocks multi-band "Carrier Aggregation," allowing the modem to establish simultaneous, concurrent connections across multiple cellular frequency bands at once. This significantly multiplies the aggregate network throughput and stabilizes low-latency data streams even during peak cell-tower congestion windows.

4. Electrical Integrity & Surge Hardening

To safeguard the internal network assets from lightning strikes and atmospheric static build-up inherent to high external masts, a rigorous electrical grounding framework was integrated. A dedicated, heavy-duty inline network surge protector was installed at the building's entry point, bonded directly via a low-resistance functional earth drain lead back to the facility's MET (Main Earthing Terminal).

5. Local Mesh Distribution & Remote Access Routing

The incoming high-speed digital link was fed into a managed network switch and distributed across the facility using a Ubiquiti UniFi Access Point wireless mesh array, ensuring seamless coverage for on-site members. Simultaneously, the WAN interface was configured with a static public IP address, facilitating secure inbound VPN tunnels for encrypted, real-time remote monitoring and administrative site management.

  • Enterprise-Grade Throughput: Achieved a highly stable, symmetric 200Mbps downstream connection in a geographic dead zone previously deemed completely offline.
  • Massive Capital Savings: Eliminated over £10,000 in upfront Openreach civil trenching costs, delivering a fully operational network topology for a small fraction of traditional leased-line capital expense.
  • Secure Remote Infrastructure Monitoring: Enabled continuous, encrypted remote facility management and closed-circuit security auditing via a dedicated static public IP and hardware-level VPN termination.
  • Atmospheric Surge Protection: Guaranteed long-term system survivability against static and transient over-voltage surges through structured, shielded cabling and direct building earthing integration.
  • Seamless Local Wireless Capacity: Provided high-density, multi-user guest wireless connectivity across the property via an integrated Ubiquiti UniFi local distribution mesh.
MikroTik LTE Gateway
Meta Tag Description

Learn how Kent ITS defeated a digital dead zone with a high-gain MikroTik mast-head LTE system, delivering 200Mbps speeds and saving over £10k in fiber install costs.

Title Card Summary

See how Kent ITS bypassed a £10k fiber trenching quote by engineering an on-site wireless local loop. Uses a mast-head MikroTik Cat18 LTE system to deliver a stable 200Mbps connection with full surge grounding and a UniFi mesh network.

Case Study : Enterprise Imaging & Identity Integration

Kent ITS transformed an enterprise printing and document imaging asset from a vulnerable network peripheral into a highly secure, identity-driven network node for a specialist distillery. Following a severe hardware failure where third-party vendors misdiagnosed the system—quoting costly full-board or machine replacements—a first-principles root-cause analysis identified a localized drive failure, recovering the node at a 98% capital savings. The infrastructure was then re-engineered to resolve systemic data privacy risks by replacing unauthenticated public "Scan-to-Folder" paths with a robust Single Sign-On (SSO) framework. Interfacing the hardware directly with a Linux Samba4 Active Directory server via secure LDAP, the solution routes sensitive financial and HR documentation directly into encrypted, user-specific private home directories.
Section
Case-Studies

This case study highlights the shift from reactive IT maintenance to strategic infrastructure management through first-principles engineering and identity integration. Confronted with a critical document workflow failure and a costly vendor quote, Kent ITS used advanced fleet diagnostics to isolate the true point of failure to an internal Self-Encrypting Drive (SED), bypassing unnecessary capital expenditure. Upon restoring the hardware, the solution integrated the imaging fleet into the core identity layer using Samba4 Active Directory and LDAP authentication. By implementing a "Privacy by Design" model that maps scanning workflows directly to private user directories, this initiative eliminated public-share data exposure, extended enterprise hardware lifecycles, and established proactive, centralized remote management.

A long-term client within the specialist distilling sector experienced a catastrophic failure of their primary document imaging system (an HP LaserJet Enterprise M575 multi-function printer). A third-party service provider misdiagnosed the issue as a dead main formatter logic board, presenting a restrictive quote of £500 for a replacement board or over £2,000 for an entirely new machine.

Beyond the immediate hardware failure, the client’s existing document routing workflow introduced a severe data privacy vulnerability. The system used an unauthenticated "Scan-to-Folder" configuration that dumped all scanned paperwork into an open, public network share. This layout created an unacceptable security risk, exposing highly sensitive human resources, payroll, and corporate financial records to unauthorized internal access and potential data leaks. The challenge required resolving the underlying system failure cost-effectively while hardening document transmission pathways.

Root-Cause Storage Analysis & Recovery

Rather than accepting the third-party diagnosis, Kent ITS conducted a remote system analysis via HP Web Jetadmin. The diagnostics confirmed that the primary logic board was completely healthy and responsive, but the internal 80GB AES-256 Self-Encrypting Drive (SED)—which houses the device's FutureSmart Firmware operating system—had reached its operational end-of-life. Kent ITS sourced a compatible enterprise-grade replacement SED for just £10, installed it, and re-initialized the secure firmware stack using professional deployment imaging tools, restoring full system functionality at a 98% cost reduction.

2. Identity-Driven Directory Integration (LDAP & Samba4)

With the hardware cluster successfully stabilized, Kent ITS addressed the file-security vulnerability by creating a Single Sign-On (SSO) environment directly on the printer’s touchscreen interface. The multi-function device was configured to act as an active, authenticated node within the local area network, establishing a secure connection to the distillery's primary Linux-based Samba4 Active Directory server via the Lightweight Directory Access Protocol (LDAP).

3. Secure "Scan-to-Home" Path Architecture

To enforce absolute data sovereignty and compliance, the unauthenticated public shares were completely dismantled. Under the new identity-driven system, when an operator authenticates at the hardware terminal using their corporate credentials:

  • The system dynamically references the user's Active Directory security token.
  • The device securely opens an isolated SMB/CIFS connection directly to that specific user’s Private Home Directory on the local Linux server.
  • Document scans are transmitted natively and directly into the individual's encrypted, restricted storage folder, entirely bypassing public directory visibility.

4. Proactive Fleet Management & Baseline Control

To prevent unexpected operational downtime across the distillery's lifecycle, the device was integrated into a centralized HP Web Jetadmin monitoring system. This administrative layer allows Kent ITS to oversee firmware baselines, tracking storage integrity, toner health metrics, and overall node security configurations remotely to intervene before a component reaches critical degradation.

  • 98% Capital Repair Savings: Avoided more than £1,900 in unnecessary hardware replacement costs by isolating the system failure down to a basic, low-cost internal storage drive.
  • Elimination of Public Data Leaks: Enforced strict data privacy parameters by permanently removing unauthenticated public shares and routing corporate assets into private folders.
  • Single Sign-On (SSO) Workflow Efficiency: Simplified the office user experience by mapping network identities directly to physical touchscreen terminal authorization paths.
  • Hardware Lifecycle Extension: Promoted long-term sustainability by repairing and keeping high-performance enterprise-grade equipment in active service rather than contributing to e-waste.
  • Proactive Remote Oversight: Established continuous, automated infrastructure monitoring to track hardware health and secure firmware compliance.
Meta Tag Description

Learn how Kent ITS used Samba4 Active Directory and LDAP to turn an enterprise printer into a secure network node, protecting sensitive data with authenticated scanning.

Title Card Summary

See how Kent ITS fixed a misdiagnosed enterprise printer for £10 instead of £2,000. This case study details how the hardware was transformed into a secure network node using Samba4 Active Directory and LDAP to route sensitive scans into private home directories.

Case Study : Self‑Hosted Zimbra Email Platform for UK Distillery – Private Cloud Case Study

Kent ITS engineered and deployed a high-performance, private cloud email and directory services platform for a UK distillery, replacing an unstable and non-scalable third-party hosted architecture. Designed to overcome severe local infrastructure limitations—including early dependencies on highly latent connectivity—the system was built on dedicated, refurbished enterprise hardware using open-source workloads and robust application-aware backup utilities. Over more than a decade of active production, the platform underwent continuous live evolution, migrating hypervisors, hardening security boundaries, and integrating independent mail gateways to provide near-instant performance, absolute data sovereignty, and an 86% reduction in long-term licensing costs compared to public cloud alternatives.
Section
Case-Studies

This long-term private cloud initiative demonstrates the immense economic and operational value of engineered system longevity over short-term public cloud dependency. Tasked with modernizing a failing, high-latency hosted mail setup for a UK distillery, Kent ITS built an independent, on-premise application environment. By decoupling core workloads into specialized virtual machines and transitioning from commercial VMware to open-source XCP-ng, the architecture eliminated vendor lock-in while vastly increasing compute efficiency. Featuring multi-layered threat mitigation, an application-aware backup matrix, and resilient LTE failover boundaries, this deployment has sustained business-critical communications for over ten years—proving that strict root-cause systems design can deliver unparalleled speed, absolute control, and massive capital savings.

The distillery's legacy email infrastructure, hosted externally via TSOhost, had devolved into a severe operational bottleneck and an escalating risk to business continuity. Because the site originally lacked a fixed broadband connection and relied on unstable early mobile links, external IMAP latency caused routine email actions to take minutes instead of seconds. This performance degradation was compounded by unstructured shared mailbox habits and exponential growth in message volumes, which the hosted platform could not scale to support even after basic ADSL lines were introduced.

Administratively, the organization possessed zero control over system configurations, lacked any native performance-tuning mechanisms, and had no reliable, independent backup or recovery pipeline. The enterprise was entirely dependent on a black-box third-party provider, creating an unacceptable operational environment where business data lacked sovereignty, visibility, and basic disaster resilience.

1. Bare-Metal Infrastructure & Hypervisor Lifecycle Evolution

To achieve absolute performance control, Kent ITS established an on-site, rack-mounted private cloud environment utilizing structured cabling. The initial compute foundation relied on a refurbished HP ProLiant DL380 G5 server subjected to complete firmware lifecycle updates prior to production. The environment was initially virtualized using VMware ESXi, but as the platform evolved, it was seamlessly migrated in-place to an open-source XCP-ng ecosystem running on newer G6 hosts, achieving total hypervisor independence with zero operational downtime.

5. Decoupled Workload Architecture

To ensure systemic stability and simple administrative scaling, workloads were strictly isolated into dedicated Ubuntu Server virtual machines:

  • Directory Services: Centralized identity and user access control.

  • File Services: Secure local storage repositories.

  • Email Core: A dedicated Zimbra Collaboration deployment.

3. High-Performance Mail Engineering & Migration

Kent ITS executed an IMAP-based migration from the legacy TSOhost server, transferring historical mail volumes with zero data loss. By hosting the Zimbra instance locally within the private cloud network, external IMAP latency was completely eliminated, collapsing multi-minute mail delays down to near-instantaneous client responsiveness.

4. Storage Optimization & Application-Aware Backups

While shared storage originally allowed for virtual machine mobility, it introduced dangerous file locks and snapshot-related system instability. An engineering decision was made to prioritize absolute data integrity over live-migration capabilities by migrating the VM disks onto high-speed, local RAID-backed storage arrays—completely eliminating read-only disk state risks. For data protection, the architecture integrated Zextras, an application-aware backup suite that handles continuous incremental protection and allows granular object-level restores (from a single message up to a full disaster recovery).

5. Multi-Layered Security Hardening & Threat Reduction

Following a credential reuse event, a rigorous hardening framework was applied across the perimeter:

  • Brute-Force Mitigation: fail2ban was deployed across both the primary mail core and edge gateways.

  • Access Control: System-wide credential resets paired with strict, complex password policies.

  • Proxmox Mail Gateway (PMG) Integration: A dedicated, isolated edge mail gateway layer was built in front of the mail server (Internet → Mail Gateway → Mail Server), shielding it from direct exposure. This gateway enforced strict security filters: greylisting ($450$ temporary rejections), Reverse DNS validation, DNSBL blocklists (including Spamhaus), explicit recipient verification, and firewall-level blacklists.

6. Resilient Business Continuity Engineering

During a severe, week-long broadband outage caused by a physical ISP infrastructure failure, Kent ITS activated an automated failover path. Utilizing a specialized MikroTik LTE gateway, inbound and outbound mail traffic was instantly rerouted over cellular networks, maintaining continuous, uninterrupted business operations with zero mail drops or data loss.

  • Near-Instant Performance: Transformed the user experience by lowering email processing latencies from multi-minute delays to instant, real-time access.

  • 86% Licensing Capital Reduction: Saved the business over £18,000 across a 10-year horizon by opting for a self-hosted Zimbra/Zextras environment (~£3,000 total) over an equivalent 25-seat Microsoft 365 licensing model (~£21,000 total).

  • Definitive Threat Reduction: Drastically shrunk the mail network's visible attack surface and slashed inbound spam volumes via a multi-layered Proxmox Mail Gateway topology.

  • Proven Operational Resilience: Verified absolute site survivability during a catastrophic 7-day ISP broadband failure through rapid MikroTik LTE failover orchestration.

  • Engineered System Longevity: Validated a long-term architecture that seamlessly survived complete hypervisor changes (VMware to XCP-ng), underlying hardware generation upgrades (G5 to G6), and multiple major operating system updates over more than a decade without requiring a platform replacement.

HP ProLiant DL380 G5
MikroTik LTE Gateway
RAID Storage
Rack Hardware
VMware ESXi
Zimbra Collaboration Suite
Zextras Backup
Proxmox Mail Gateway
fail2ban
XCP-ng
Ubuntu Server
Offices
Meta Tag Description

Discover how Kent ITS built a self-hosted Zimbra email platform on XCP-ng for a UK distillery, cutting licensing costs by 86% while ensuring near-instant performance.

Title Card Summary

A look into a ten-year private cloud email platform built on refurbished hardware for a UK distillery. Details the migration from VMware to XCP-ng, a Proxmox Mail Gateway threat defense layout, and an 86% cost reduction over public cloud alternatives.

Case Study : High‑Security Access Control & Alarm Integration for a Rifle Range in Kent

Kent ITS designed and deployed an integrated high-security access control and intruder alarm architecture for a newly constructed center-fire rifle range in Kent. The system replaces insecure physical key systems with a centralized electronic credential framework to facilitate secure, unstaffed out-of-hours member access. By interfacing a Paxton Net2 controller network with a Texecom Premier alarm panel, the solution enforces automated arming sequences, precise real-time door-state monitoring, and battery-backed fail-secure locking boundaries. This deployment ensures a predictable, fully auditable operational environment that meets strict regulatory compliance without compromising end-user simplicity.
Section
Case-Studies

This high-security infrastructure project demonstrates the integration of independent access control and intrusion detection systems into a unified safety ecosystem. Faced with the strict monitoring and compliance demands of a center-fire rifle range, Kent ITS engineered a hardware-level integration using Paxton Net2 and Texecom Premier platforms. The solution automates complex security logic—such as cross-system arming tokens, forced-entry triggers, and fail-secure power isolation paths—hiding this complexity behind a seamless, single-credential user experience. This architecture delivers total administrative visibility, automated threat reduction, and complete operational flexibility, showcasing how robust hardware engineering can secure high-risk facilities during unstaffed operational windows.

1. Centralized Electronic Access Control Infrastructure

Kent ITS deployed a centralized Paxton Net2 electronic access control system to replace all physical lock-and-key points. Authorized users are issued secure electronic credentials that dynamically map to granular schedules, specific permissions, and restricted physical zones within the Net2 software interface. This centralized control allows administrators to modify user rights or revoke compromised credentials instantly across the entire facility without disrupting regular member operations.

2. Cross-Platform Alarm System Integration

To eliminate human error regarding building security states, the Paxton Net2 access control array was directly integrated with a Texecom Premier intruder alarm platform. The system uses automated sequential logic: when an authorized credential is validated at a primary entry point during armed hours, the system verifies permissions and automatically executes a disarming sequence before unlocking the perimeter. Conversely, arming cycles are tied to designated exit credentials, ensuring the building is never left unmonitored or vulnerable to accidental operator abandonment.

3. Advanced Door-State Monitoring & Lock Engineering

Every high-security access barrier was outfitted with heavy-duty monitored locking hardware and precise door-position sensors. This setup goes beyond checking if a lock is engaged; it provides continuous data feedback to detect subtle structural states, allowing the system to instantly flag and broadcast specific alerts for:

  • Forced Entry: Unauthorized physical breaches or lock bypass attempts.

  • Held-Open Conditions: Doors intentionally left open beyond a pre-configured time threshold.

  • Failed-to-Latch Events: Mechanical misalignments preventing a door from locking securely upon closure.

4. Battery-Backed Power Resilience

To protect against targeted physical grid sabotage or standard utility failures, the entire security layout runs on a distributed matrix of dedicated, battery-backed uninterruptible power supplies (UPS). These specialized power arrays continuously support the central controllers, communication modules, state sensors, and locking mechanisms. The mechanical locking infrastructure is strictly engineered to be fail-secure, ensuring all restricted perimeters remain locked, secure, and structurally predictable throughout any extended power outage.

5. Centralized Management & Auditing Interface

All access records, physical alarm triggers, and individual telemetry events are funneled into a single, comprehensive management dashboard. This centralized hub gives system administrators a highly detailed, real-time look at facility security, providing instant audit capabilities that track every historical entry, exit, and system state change for compliance and safety reporting.

  • Elimination of Key Management Risks: Mitigated all administrative and security liabilities linked to physical keys through a centralized, instant-revocation electronic token framework.
  • Automated Threat & Security Management: Eradicated human error regarding building security states by linking alarm arming and disarming directly to authorized user entry patterns.
  • Real-Time Aperture Awareness: Gained instant insight into physical building security via continuous door-state telemetry, stopping latch failures or propped doors from creating vulnerabilities.
  • Secure Unstaffed Operations: Achieved safe out-of-hours member usage by relying on strict automated logic parameters, maximizing facility utility without compromising regulatory compliance.
  • Resilient Grid Autonomy: Guaranteed complete security infrastructure uptime and predictable fail-secure physical locking states across all entry points during critical utility power losses.
Texecom
Net2 Plus Control Unit
Net2 Pro Software
Meta Tag Description

Learn how Kent ITS integrated Paxton Net2 and Texecom Premier systems at a high-security rifle range to automate arming, deliver door-state monitoring, and enable safe unstaffed access.

Title Card Summary

Discover how Kent ITS engineered a high-security access control and alarm system for a Kent rifle range. Combines Paxton Net2 with Texecom Premier to deliver door-state monitoring, fail-secure power resilience, and automated arming logic.

Subscribe to Case-Studies