$ cat "Directory Services & Domain Architecture.md"

Directory Services & Domain Architecture

We design, deploy, and maintain enterprise Active Directory and Linux directory environments (FreeIPA, ALD Pro). We establish centralized identity management, access control, and automated workstation configuration, implement Single Sign-On (SSO), and unify Windows and Linux into a single managed infrastructure.

What We Do

  • Domain Architecture & Trust Relationships:

    • Design and deployment of Active Directory Domain Services (AD DS) forests and trees, multi-master replication, and FSMO role redundancy.
    • Configuration of one-way and two-way cross-forest trusts, AD Sites and Services topology optimization for branch offices.
    • Internal domain zones (.int, .corp) with redundant split-horizon DNS and DNSSEC.

  • Group Policy (GPO) & Security Hardening:

    • Automated endpoint provisioning: centralized drive mapping, network printers, certificates, and application baselines.
    • OS hardening adhering to CIS Benchmarks: deprecation of legacy protocols (NTLMv1, SMBv1, LLMNR, NetBIOS).
    • Application whitelisting via AppLocker to protect against unauthorized software and ransomware.
    • Granular password policies and automated local administrator password rotation (Microsoft LAPS).

  • Linux Directory Integration (FreeIPA, ALD Pro, Samba DC):

    • Centralized identity and access management for enterprise Linux via FreeIPA and ALD Pro.
    • Two-way cross-forest trusts between Active Directory and Linux domains.
    • Joining Linux hosts via SSSD and Winbind: unified corporate credentials and centralized sudo delegation.

  • Single Sign-On (SSO) & Access Security:

    • Enterprise Public Key Infrastructure (PKI / AD CS): internal SSL/TLS certificates, smart card and hardware token authentication (YubiKey, Rutoken).
    • Seamless Single Sign-On (SSO) via Kerberos, SAML 2.0, and OpenID Connect (Keycloak, AD FS) for 1C, corporate email, CRM, and internal web services.
    • Multi-Factor Authentication (MFA / 2FA) for administrative accounts, RDP terminal access, and external entry points.

  • Security Audits, Migration & Disaster Recovery:

    • Directory security assessments: identifying dormant accounts, excessive privileges, and unsafe delegation.
    • Seamless user and computer migration between domains and forests (ADMT) without password resets.
    • Automated System State backups and verified Bare-Metal Recovery procedures for domain controllers.

Technology Stack

  • Directory Platforms: Active Directory DS (Windows Server 2016–2025), FreeIPA, ALD Pro, Samba 4 AD DC, OpenLDAP.
  • Protocols: Kerberos, LDAP / LDAPS, DNS, DHCP, RADIUS, SAML 2.0, OpenID Connect.
  • Security & Policies: Group Policy (GPO), Microsoft LAPS, AppLocker, BitLocker, PKI / AD CS, FreeRADIUS.
  • Linux Integrations: SSSD, Winbind, Realmd, PAM, KRB5.
  • Identity & SSO: Keycloak, Active Directory Federation Services (AD FS), 2FA/MFA.

Outcomes

  1. Centralized Identity Governance: Instant onboarding and offboarding across all corporate services from a single console.
  2. Standardized Endpoints: Consistent system configurations applied automatically via GPO without manual intervention.
  3. Unified Windows & Linux Ecosystem: Single credential set across all operating systems and corporate platforms.
  4. Lateral Movement Protection: Reduced attack surface through LAPS, AppLocker, and Least Privilege enforcement.
Discuss Project