- Architect, plan, and implement enterprise-level AD infrastructure.
- Perform domain/forest upgrades, consolidation, and restructuring.
- Design OU models, delegation structures, GPO architecture, and security baselines.
- Plan and implement multi-site deployment, replication topology, site links, and DC placement. Handle P1/P2 escalations, critical outages, and deep-dive troubleshooting. Troubleshoot:
- AD replication failures
- Kerberos/NTLM authentication issues
- Trust relationship issues
- SYSVOL/DFSR/FRS problems
- FSMO role failures
- DNS-integrated AD issues Perform advanced diagnostics with: dcdiag, repadmin, nltest, ktpass, klist, ldp, ADSI Edit, Event logs.
- Design and manage complex GPO environments.
- Perform GPO impact assessments and conflict resolution.
- Establish GPO standards, baselines (CIS, Microsoft Security Baselines), and enforcement
- Implement AD tiering models (Tier 0/1/2) and privileged access security.
- Manage privileged groups with PAM/PIM (e.g., Azure AD PIM).
- Enforce secure domain controller policies.
- Conduct frequent AD security posture reviews and audits.
- Work with SIEM/SOC teams on identity-related incidents. Support and integrate AD with enterprise apps:
- ADFS
- Azure AD / Entra ID
- Azure AD/Entra ID Connect (sync, filtering, staging mode)
- SSO/SAML/LDAP-based applications Troubleshoot synchronization, token issues, or authentication flows
- Manage domain controllers (on-prem cloud-hosted).
- Support DNS, PKI (ADCS), and time-sync architecture.
- Plan and implement backup/restore, authoritative/non- authoritative restores, and tombstone recovery.
- 12-20 years of experience managing and troubleshooting Active Directory in an enterprise environment.
- Lead AD/Identity projects end-to-end.
- Create RCA documents for high-severity incidents.
- Review L2 escalations and improve SOPs.
- Mentor L1/L2 team members.




- Advanced Active Directory architecture, forest/DNS design. Strong understanding of:
- Sites Services
- AD replication internals
- Authentication protocols (Kerberos, NTLM, LDAP, LDAPS)
- Token size, SID filtering, and trusts
- Strong troubleshooting experience in enterprise-scale AD.
- Extensive PowerShell expertise (modules, advanced scripting).
- Windows Server (2012-2022) advanced knowledge. Strong experience in:
- GPMC
- ADSI Edit
- LDP
- Event log RCA
- DFSR/SYSVOL troubleshooting Experience with:
- Azure AD / Entra ID
- ADFS
- Hybrid Identity architecture
- Azure AD Connect sync troubleshooting
- Understanding of AD replication topology and tools like repadmin, dcdiag.
- Familiarity with Azure Active Directory, MFA, or AD Connect is a plus. Microsoft Certifications (one or more):
- SC-300 - Identity Access Administrator
- AZ-305 / AZ-104
- AZ-800 AZ-801
- MS-102 (Microsoft 365 Administrator)
- ITIL Certified Legacy but valuable: MCSE: Identity / Server Infrastructure
- Experience in large global environments (50k+ users preferred).
- Experience with Red Forest / ESAE / hardened identity models.
- Knowledge of PKI, certificates, and MFA systems.
- Automation and Scripting
- Monitoring and Reporting
- Maintain highly available AD infrastructure with minimal downtime.
- Ensure zero-impact forest/domain upgrades and migrations.
- Resolve P1/P2 tickets within SLA.
- Automate repetitive tasks-reduce manual interventions by 40-60%.
- Conduct monthly AD health and security reports.
- Implement secure baselines and eliminate high-risk findings.
- Ability to lead crisis troubleshooting and restore services quickly.
- Strong documentation, architecture diagramming, and SOP creation.
- Cross-team collaboration (Security, Network, Apps, Cloud).
- Mentorship for junior engineers.
- Ability to handle on-call rotation and critical outages.
- Solid analytical and problem-solving mindset.

📌 Manager - Network Operations & Support (Pune)
🏢 Tata Communications
📍 Pune