All work
Case study 032024 — Present

Active Directory Modernisation

Part of the programme that took the group's directory from a Windows Server 2008 functional level to 2025, retired eight legacy domain controllers and re-anchored hybrid identity.

8
Legacy DCs decommissioned
2008 → 2025
Functional level
5,000+
Identities in scope

The problem

Years of acquisitions had left the identity layer on old infrastructure: a 2008 functional level, SYSVOL still on the deprecated FRS, and domain controllers spread across legacy sites. Everything authenticated against it, so it could never go offline.

What I did

  1. 1

    Clear the blockers

    Moved SYSVOL replication from FRS to DFSR, then raised functional levels in staged steps.

  2. 2

    Rebuild the controllers

    Transferred FSMO roles to new Windows Server 2025 controllers, with replication health checked at each step, and decommissioned the old ones.

  3. 3

    Protect hybrid identity

    Upgraded Entra Connect and moved the source anchor to mS-DS-ConsistencyGuid, so users can move between domains without duplicate cloud accounts.

  4. 4

    Consolidate users

    Cross-domain user migration with UPN normalisation and access remapping.

Before
  • 8 legacy DCs
  • FFL 2008
  • FRS
Transition
  • FRS → DFSR
  • FSMO transfer
  • Source anchor change
After
  • Server 2025 DCs
  • FFL 2025
  • ConsistencyGuid
Legacy controllers retired, hybrid identity re-anchored.

Result

  • A current, supported directory with eight legacy controllers gone.
  • Hybrid identity ready for the remaining domain consolidations.
  • Authentication and DNS stable throughout.