Active Directory Specialist

Role Overview The L3 Active Directory (AD) & Windows Server Engineer is a senior technical resource responsible for the end-to-end administration, upgrade, migration, and security hardening of enterprise Active Directory, Windows Server and Hyper-V environments. This role combines hands-on experience on complex Hyper-V, Windows server environments, operational ownership with the ability to lead complex AD initiatives including Domain Controller upgrades, migrations, and security hardening programs - and acts as the escalation point for issues beyond L1/L2 capability. The profile is designed to be broadly applicable across AD/Hyper-V/Windows Server engagements, not tied to any single project. Key Roles & Responsibilities 1. Own end-to-end administration and troubleshooting of enterprise AD environments - DNS, Group Policy, SYSVOL replication, and authentication services (Kerberos/LDAP/NTLM). 2. Lead AD and Windows Server upgrade/migration initiatives - Domain Controller builds, FSMO role transfers, functional level upgrades, and legacy decommissioning. 3. Design and implement security hardening measures - privileged access tiering, service account security, protocol hardening, and alignment with industry best practices. 4. Serve as the L3 escalation point for complex AD/Windows Server incidents - driving root-cause analysis and permanent resolution beyond L1/L2 capability. 5. Support hybrid identity and cloud integration - Microsoft Entra Connect sync, troubleshooting, and coordination with cloud/identity teams. 6. Administer Hyper-V virtualization and cluster infrastructure - host/cluster build and configuration, VM provisioning and lifecycle management, storage and networking, and troubleshooting across the virtualized environment. 7. Maintain documentation, drive change management, and mentor L1/L2 engineers - runbooks, as-built records, and knowledge transfer to strengthen operational maturity. Technical Skill Set Required Windows Server & AD DS: Strong hands-on experience with Windows Server 2016/2019/2022/2025 and Active Directory Domain Services. Windows Server upgrade/migration: 2016 2019/2022/2025 in-place and migration-based upgrade approaches, compatibility assessment, and rollback planning. Domain Controllers: Build, promotion/demotion, and multi-site replication topology. FSMO & Functional Levels: FSMO role management, Domain/Forest Functional Level upgrades and dependencies. DNS & DHCP: AD-integrated DNS and DHCP administration. Group Policy: Design, troubleshooting, and enterprise-scale management. SYSVOL/DFSR: Replication configuration and health validation. Authentication protocols: Kerberos, LDAP, and NTLM - configuration and troubleshooting. Hybrid identity: Microsoft Entra Connect (Azure AD Connect) sync, configuration, and troubleshooting. Azure fundamentals (basic): Working knowledge of Entra ID/Azure AD concepts and hybrid identity scenarios - AD/on-prem remains the primary focus, not deep Azure administration. Security hardening: Windows LAPS, gMSA, Tier 0/1/2 privileged access model, legacy protocol remediation. Hyper-V & Clustering: Host and Failover Cluster build/configuration, VM provisioning and lifecycle management, storage/networking, and general troubleshooting. PowerShell: Scripting for automation, auditing, and bulk administration. Backup/DR fundamentals: System State backup, restore validation, rollback planning. Monitoring & diagnostics: Familiarity with AD health-check and replication diagnostic tools. ITSM/ticketing: Working knowledge of ITSM/ticketing platforms for incident and change management. Preferred Qualifications 9+ years of hands-on AD/Hyper-V/Windows Server infrastructure experience. Relevant certification (e.g., Microsoft Certified: Windows Server Hybrid Administrator Associate, MCSE, or Azure Fundamentals AZ-900). Prior experience with large-scale AD migrations, Migrating to Hyper-V or Domain Controller/Windows Server upgrade projects. Strong written and verbal communication skills for client-facing documentation and reporting. .