NT offers no cryptographic protection of information or other sensitive operating system files. Instead, Microsoft suggests users do their own. So with NT, you're on your own if security has any place in your organization's plans. Dont connect machines that don't need to be connected. Connecting NT machines immediately downgrades their security.
Air gaps make the best firewalls.
Shut off as many services as you can. Use only those that are required to do the functions you specify. Enforce anonymous File Transfer Protocol connections. Consider splitting services on multiple machines. If you try to do too many functions on a single server, you will have to open more services, and that can increase security weaknesses.