I am looking for some insight and input for protecting legacy servers. Since Microsoft stopped supplying patches and updates for NT it poses somewhat of a security risk, but in some cases there are specialized applications running which the vendors have not updated yet and they require NT.

What sort of processes, tools, applications or devices do you use to segregate and protect your network from your NT servers and vice versa??

Any thoughts and contributions appreciated.