Windows Server Support and Consulting in Kenya
CloudSpinx designs, migrates, secures and runs Windows Server for businesses in Kenya and across East Africa: Active Directory, Hyper-V, file and print, Exchange, SQL Server and Remote Desktop Services. Licensing is the part that decides the bill, so we cost the cores and the CALs with you before anyone buys hardware.
Who we build for
- 14organizations, from ISPs and payment platforms to a national regulator
- 6flagship engagements published in full, with the numbers counted
- 4thof all contributors to the open-source payment switch national systems run on
Everything in Our Windows Server Service
Every engagement covers the full scope: no hidden extras, no upselling.
Active Directory design and migration
Forest and domain design, OU and delegation model, Group Policy that is readable a year later, FSMO placement, and migrations off 2012 and 2016 without a flag-day cutover.
Hyper-V and Failover Clustering
Host sizing, cluster quorum and witness placement, live migration, Cluster Shared Volumes, and honest recovery timings rather than a promise that nothing ever restarts.
Windows Server 2016 and 2012 upgrades
In-place upgrades where they are safe and side-by-side rebuilds where they are not. Application compatibility tested in staging before a single production role moves.
File, print and DFS
DFS namespaces and replication across sites, quotas, shadow copies, access-based enumeration, and a permissions model that survives the person who built it leaving.
Exchange and hybrid mail
Exchange Server SE, hybrid with Microsoft 365, or a full move to the cloud. We tell you which of the three fits, including when the answer is to stop running mail yourself.
SQL Server hosting
Instance sizing, storage layout, Always On availability groups where the license supports it, backup chains that get tested, and the core-licensing math done before you commit.
Remote Desktop Services
Session hosts, RD Gateway and published apps for branch and remote staff, sized against real concurrency rather than headcount, with the RDS CAL position made explicit.
Hardening and privileged access
CIS-aligned baselines, LAPS, tiered admin accounts, legacy protocols removed, BitLocker, and MFA on anything reachable from outside the building.
Licensing review
Core counts, CAL type, Software Assurance and virtualization rights. Most estates we audit are either overspent or out of compliance, and both are expensive.
Backup and disaster recovery
Application-aware backups for AD, Exchange and SQL, an offsite copy, a documented recovery order, and a restore rehearsal someone other than us can run.
Monitoring and patching
Patch rings with a real test group, alerting on disk, replication and backup failure, and reporting that shows compliance rather than green ticks.
Managed Windows support
Named engineers, scheduled maintenance windows, capacity reviews, and someone who already knows your domain when authentication fails on a Monday morning.
Technologies we use
What Windows Server actually costs in Kenya
The server is rarely the expensive part. Windows Server 2025 is licensed per physical core, with a floor of 16 cores per server and 8 per processor, sold in 2-core and 16-core packs. A 24-core box needs a 16-pack plus four 2-packs whether or not you use all of it. On top of that sit Client Access Licenses, one per user or per device, and they are version-specific: a 2022 CAL does not license access to a 2025 server. Published Microsoft list is roughly USD 1,176 for a Standard 16-core pack and USD 6,771 for Datacenter, and that gap drives the biggest decision on this page.
Standard or Datacenter, and how to tell
Standard covers two virtual machines plus the Hyper-V host. Datacenter covers unlimited VMs on the same licensed cores. At list the crossover lands around 12 to 14 Windows guests per host, so a two-VM branch server is Standard and a consolidated virtualization host is almost always Datacenter. Buying Standard and then stacking licenses to reach a dozen guests is the mistake we correct most often, and it usually costs more than Datacenter would have.
What we quote on
Price scales with core count, edition, CAL type and count, whether SQL or RDS sit on top, and whether we manage the estate or hand it back. We do not publish a tier table, because a four-person office with one file server and a 200-seat manufacturer running AD, SQL and RDS are not the same job. Send the shape of the estate through the form and you get a licensing position and one monthly figure. Where the workload is better off on a Proxmox cluster with Windows guests licensed at the host, we say so: the license follows the physical cores no matter whose hypervisor runs on them.
Windows Server 2016 end of support, and what to do about it
Extended support for Windows Server 2016 ends on 12 January 2027. After that there are no security fixes outside a paid Extended Security Updates program, and ESU is priced to make migration look cheap. Windows Server 2012 and 2012 R2 passed the same point in October 2023, and we still find them running domain controllers in Nairobi. If 2016 is in production, the planning window is now rather than in December.
- Inventory first: every role, application, certificate and service account tied to the boxes going away. The surprise is never the OS, it is the line-of-business app whose vendor only certifies 2016.
- Domain controllers get rebuilt, not upgraded: introduce new DCs at the current functional level, move the FSMO roles, demote the old ones. In-place upgrading a DC works and carries a decade of accumulated cruft forward with it.
- Application servers get tested: staging clone, real data, real integrations, sign-off from whoever owns the application. This is where projects slip, so it goes first in the plan.
- File servers are the easy win: DFS namespaces let you stand the replacement up alongside and move shares without changing a single mapped drive.
- Keep the old estate standing until the new one has been through a month-end and a payroll run. Rollback is a plan, not a hope.
Active Directory that survives an audit
Most Kenyan AD estates we inherit were stood up correctly for a company a third of the current size and never revisited. The symptoms are consistent: one flat OU holding every object, Group Policy applied at the domain root, a dozen accounts in Domain Admins, service accounts whose passwords have not changed since installation, and no record of which of the four domain controllers actually holds the FSMO roles.
What we change first
Tiered administration, so a workstation compromise does not hand over the domain. LAPS for local administrator passwords. Separate admin accounts with no mailbox and no internet. Then Group Policy gets rebuilt against an OU structure that matches how the business is actually organized, and the legacy protocols come off. Security hardening work and AD work are the same project in practice, because identity is what an attacker is after.
Hybrid identity
If you use Microsoft 365, then Entra Connect sync, Conditional Access and MFA are part of the AD design rather than something bolted on later. We set password hash sync or pass-through authentication deliberately, document which one and why, and make sure the break-glass account exists and has been tested before it is needed.
Hyper-V, clustering and the honest recovery numbers
Hyper-V is a capable hypervisor and it is already licensed if you are buying Windows Server, which makes it the default for a Windows-heavy estate. Two hosts and shared storage give you live migration for planned maintenance. Failover Clustering restarts guests on a surviving host when one dies, which means the guest reboots. It does not keep it running. Anyone who tells you otherwise is selling something, and the difference matters when the workload is a database mid-transaction.
Where Hyper-V stops being the right answer
Once the estate is genuinely mixed Linux and Windows, or you want storage that scales by adding nodes rather than by buying a bigger SAN, the economics change. We run both, and on more than one engagement the recommendation has been a different platform entirely. Windows guests are licensed the same way on any hypervisor, so this is a technical decision rather than a licensing one.
Exchange Server after end of support
Exchange Server 2016 and 2019 went out of support on 14 October 2025, and the six-month Extended Security Updates bridge closed in April 2026. If you are still running either, you are running internet-facing mail with no security patches, and Exchange has a long history of exploited pre-authentication vulnerabilities. On most of the estates we audit, this is the most urgent item on the list.
- Exchange Server SE is the only supported on-premises build. It is code-equivalent to 2019 CU15 and moves you onto subscription licensing, so it is an upgrade path rather than a new product.
- Microsoft 365 is the honest answer for most organizations under a few hundred mailboxes with no data-residency constraint. We say so even though migration work pays less than running your Exchange for you.
- Hybrid makes sense while you migrate, or permanently where specific mailboxes genuinely cannot leave the building.
- Self-hosted on open source is a real option when residency or cost rules out the hosted suites, and it is a different conversation covered on our Zimbra page.
Where the server should physically live
A Windows estate in Nairobi fails for boring reasons far more often than clever ones. Grid power drops and the UPS carries eight minutes against a generator that starts in forty seconds, or does not start because nobody tested it this quarter. The comms room shares an air conditioner with a meeting room that gets switched off at night. The one person with the domain admin password is on leave. We size UPS runtime and cooling into the design, and where the honest answer is that the box belongs in a colocation facility rather than the office, we say so and arrange it. Placement and management of bare metal is covered on our dedicated servers page.
When we tell clients not to buy Windows Server
Plenty of the time it is the wrong purchase, and saying so early is cheaper for everyone.
- Under about fifteen staff with no line-of-business application, a domain controller is usually overhead you do not need. Entra ID with Intune, a hosted mail suite and cloud file storage will cost less and break less.
- If the only driver is file sharing, you are buying a license, a CAL per user, a server, a UPS and a backup target to do something a managed cloud share does for a fraction of it.
- If the application runs on Linux, run it on Linux. We see Windows bought for a workload whose vendor supports and prefers a Linux platform, and the license becomes a permanent tax on a decision nobody revisited.
- If you cannot resource a patch window, an on-premises Windows estate drifts out of support and becomes the security problem rather than solving one. Either budget the maintenance or move the workload somewhere the patching is somebody else's job.
What you own at handover
Everything. The AD design document, the Group Policy inventory, the licensing position with core counts and CAL math written down, network and storage diagrams, the runbooks for patching, backup and restore, and every credential in your own password manager rather than ours. Whether you then keep us on a managed support arrangement or run it in-house is a commercial decision you get to make freely, which is the only kind of handover worth having.
Tell us what you are running today
The questions an engineer would ask on a first call. Every one has an escape hatch, so answer what you know and leave the rest. You get back a licensing position and one figure, not a brochure.
Ready to discuss Windows Server?
A 30-minute scoping call, free, and it commits you to nothing.
How Every Windows Server Engagement Starts
Audit what is actually there
Roles, versions, licensing position, AD health, backup state and the applications nobody documented. Usually a day or two, and it frequently changes the plan.
Design and cost it
Target topology, host sizing, licensing math with the CAL count spelled out, migration waves and rollback points, and one figure covering the work.
Build, migrate, prove
New estate built alongside the old, workloads moved in waves, a real failover test and a real restore before anything is signed off.
Hand over or manage
Documentation, runbooks and training. Then either your team runs it, or we do, with named engineers and scheduled maintenance.