Enterprise deployment

Start with a small verified fleet

Use an independent control service for accounts, inventory, billing and jobs. On the compute side, assign one host to one tenant and run a managed guest when hardware and licensing permit. Keep customer access behind a gateway; only the management service reaches the hypervisor.

Separate the networks

Plan distinct management, tenant, storage and backup boundaries. Deny customer traffic to the local LAN and other tenants. The pilot's unmanaged switch is not a production tenant-isolation system. Add a managed switch/firewall and a UPS before public multi-customer use.

Scale out

Enroll a new host, verify serial/specifications, patch and burn it in, test storage/network isolation, then publish capacity. Keep spare hosts outside the sellable pool. A queue should represent demand above capacity; never turn a reservation into an invented running computer.

Scale down

Stop accepting new rentals on selected hosts, let existing allocations end or arrange an agreed migration, export/retain data under policy, revoke all access, sanitize and verify. Only then power down or retire the host. A dedicated reservation remains billable capacity even if the customer is idle unless the contract explicitly releases it.

Recovery expectations

A whole-host fleet cannot promise seamless live migration from every failed machine. Recover from a tested image/data backup onto a compatible spare and reconnect the customer. Publish measured recovery objectives only after drills. One NAS, one switch, one ISP or one site creates a shared failure risk.

Windows licensing

Consumer/OEM Windows activation is not proof that commercial hosted desktops are properly licensed. The appropriate Windows virtualization/hosting and application rights must be established with an authorized licensing specialist before launch.