Active Directory(AD)

Without centralized identity management, IT administration in a company with more than a few computers is practically impossible. Every change (new employee, permission update, departure) would require manual work on each device separately.

AD simultaneously enables uniform rules: all users have the same password policies, the same security settings, and the same permissions for shared folders. Without this, a 'security policy' is just a note on paper rather than something that actually applies to all devices.

A typical example: a new employee gets a user account in AD, the administrator assigns them to the appropriate groups (e.g., 'Accounting'), and they immediately have access to the correct folders, printers, and applications. Upon their departure, the administrator disables the account, removing all permissions in one step.

Another common example: a Group Policy sets all work computers to automatically lock after 10 minutes, disables USB storage, and ensures updates are installed at a specific time. Without AD, this would have to be configured on each computer individually.

The most common issue is the domain controller as a single point of failure. With only one domain controller, its failure means users cannot log in, share files, or use internal services. At least two are recommended.

Another common mistake: permissions that have accumulated over the years based on the 'let’s just make it work, we’ll sort it out later' principle. The result is a disproportionately high number of users having access to shared folders containing sensitive data.

Third issue: administrative accounts (Domain Admin) used for everyday work. A breach of such an account means total control over the entire domain.

At VitalIT, we first check the domain health of existing AD environments: replication between domain controllers, DNS status, organizational structure, Group Policies, and a review of administrative accounts. Only then do we propose sensible steps.

In practice, we assist with upgrading domain controllers, organizing the structure and permissions, setting up hybrid connectivity with Microsoft 365 (Entra Connect), and managing Group Policies. We adapt solutions to the actual environment and the agreement with the client.