Every member of staff and every pupil gets one account. It signs them into the shared drives, the print queue and the apps, on any PC in the building, and it shows them the folders they are allowed to see and nothing else. Underneath it is a standard directory. A Windows PC joins the domain the way it always has, and a device from a supplier that expects Active Directory works without special pleading. The difference is the console on top. You add a new starter, tick the classes or teams they belong to, and their shares and print rights follow. No group-policy editor, no schema to learn. Deleted a file, or saved over one? The person who lost it gets it back from an hourly snapshot in the same console, in under fifteen minutes, without raising a ticket.

Most small organisations run one or two applications they cannot replace: an accounts package, a school MIS, a booking or dispensing system that only runs on an old Windows server. CalyOS Server runs each of those as a virtual machine on the same box, walled off from the rest, so one crashing app cannot take the file server down with it. Before any update or supplier change, the console takes a snapshot. If the update breaks the app, you roll the whole machine back in a few minutes and carry on. No lost day rebuilding it from scratch. An 8-core, 64 GB box comfortably runs three to five of these alongside the file and identity job. A heavier estate splits the roles across two boxes.

The server owns the print queues, so no PC has to hold its own driver for every printer. A joined device sees the right printers for where it sits, with the driver pushed to it automatically. A new laptop prints on its first day with nothing to set up. Follow-me release holds a job until the person taps their card or signs in at the device. That clears the pile of unclaimed printouts on a shared machine, and it keeps a sensitive report from sitting in a tray where anyone can read it. Per-person and per-class counters show where the paper and toner actually go. It speaks standard IPP and PostScript, so it drives the multifunction devices you already lease. There is no hardware to swap.

Backup is not a product you bolt on later. It is how the box ships. Local snapshots run every hour and stay for thirty days, so a file deleted this morning or wrecked by a bad save comes back from the console in minutes. Each night, an encrypted copy leaves the building: either to a rotating drive a member of staff swaps, or to a managed Calyraen off-site target. That gives you the 3-2-1 rule without a spreadsheet to track it. Three copies, two kinds of media, one off the premises. Snapshots are read-only and versioned, so ransomware that encrypts the live shares cannot reach back and rewrite the history. A restore test runs on its own every week, and the result lands in the weekly report. You find out the backups work before you need them, not after.