Active Directory Specialist

SHI; Pune District; On-site; INR 1,800,000 - 2,800,000; Full time

Job summary

SHI is seeking a senior L3 AD/Windows Server Engineer to oversee end-to-end administration, upgrades, migrations, and security hardening of enterprise AD, Windows Server, and Hyper-V environments.

The role requires hands-on expertise in domain controller upgrades, DNS/DHCP, GPOs, and hybrid identity with Entra Connect/Azure AD Connect, plus mentoring L1/L2 engineers and driving complex AD initiatives.

Qualifications

• Extensive experience with enterprise AD/Windows Server environments.
• Experience leading Domain Controller upgrades and migrations.
• Strong ability to design and implement security hardening for privileged access.
• Proven escalation point for complex AD/Windows Server incidents.
• Experience with hybrid identity and cloud integration.
• Ability to administer Hyper-V, clustering, and virtualization infrastructure.
• Proficient in runbooks, documentation, and knowledge transfer.

Responsibilities

• Own end-to-end administration and troubleshooting of enterprise AD environments.
• Lead AD and Windows Server upgrade/migration initiatives.
• Design and implement security hardening measures.
• Serve as the L3 escalation point for complex AD/Windows Server incidents.
• Support hybrid identity and cloud integration.

Skills

Windows Server

Active Directory

AD Migration

FSMO Roles

DNS

DHCP

Group Policy

Kerberos

LDAP

NTLM

Entra Connect

Azure AD Connect

Hyper-V

Clustering

PowerShell

Backup/DR

ITSM

Monitoring

Tools

Azure AD Connect

PowerShell

Job description

Role Overview

The L3 Active Directory (AD) & Windows Server Engineer is a senior technical resource responsible for the end-to-end administration, upgrade, migration, and security hardening of enterprise Active Directory, Windows Server and Hyper-V environments. This role combines hands-on experience on complex Hyper-V, Windows server environments, operational ownership with the ability to lead complex AD initiatives including Domain Controller upgrades, migrations, and security hardening programs - and acts as the escalation point for issues beyond L1/L2 capability. The profile is designed to be broadly applicable across AD/Hyper-V/Windows Server engagements, not tied to any single project.

Key Roles & Responsibilities

• 1. Own end-to-end administration and troubleshooting of enterprise AD environments - DNS, Group Policy, SYSVOL replication, and authentication services (Kerberos/LDAP/NTLM).
• 2. Lead AD and Windows Server upgrade/migration initiatives - Domain Controller builds, FSMO role transfers, functional level upgrades, and legacy decommissioning.
• 3. Design and implement security hardening measures - privileged access tiering, service account security, protocol hardening, and alignment with industry best practices.
• 4. Serve as the L3 escalation point for complex AD/Windows Server incidents - driving root-cause analysis and permanent resolution beyond L1/L2 capability.
• 5. Support hybrid identity and cloud integration - Microsoft Entra Connect sync, troubleshooting, and coordination with cloud/identity teams.
• 6. Administer Hyper-V virtualization and cluster infrastructure - host/cluster build and configuration, VM provisioning and lifecycle management, storage and networking, and troubleshooting across the virtualized environment.
• 7. Maintain documentation, drive change management, and mentor L1/L2 engineers - runbooks, as-built records, and knowledge transfer to strengthen operational maturity.

Technical Skill Set Required

• Windows Server & AD DS: Strong hands-on experience with Windows Server 2016/2019/2022/2025 and Active Directory Domain Services.
• Windows Server upgrade/migration: 2016 2019/2022/2025 – in-place and migration-based upgrade approaches, compatibility assessment, and rollback planning.
• Domain Controllers: Build, promotion/demotion, and multi-site replication topology.
• FSMO & Functional Levels: FSMO role management, Domain/Forest Functional Level upgrades and dependencies.
• DNS & DHCP: AD-integrated DNS and DHCP administration.
• Group Policy: Design, troubleshooting, and enterprise-scale management.
• SYSVOL/DFSR: Replication configuration and health validation.
• Authentication protocols: Kerberos, LDAP, and NTLM - configuration and troubleshooting.
• Hybrid identity: Microsoft Entra Connect (Azure AD Connect) sync, configuration, and troubleshooting.
• Azure fundamentals (basic): Working knowledge of Entra ID/Azure AD concepts and hybrid identity scenarios - AD/on-prem remains the primary focus, not deep Azure administration.
• Security hardening: Windows LAPS, gMSA, Tier 0/1/2 privileged access model, legacy protocol remediation.
• Hyper-V & Clustering: Host and Failover Cluster build/configuration, VM provisioning and lifecycle management, storage/networking, and general troubleshooting.
• PowerShell: Scripting for automation, auditing, and bulk administration.
• Backup/DR fundamentals: System State backup, restore validation, rollback planning.
• Monitoring & diagnostics: Familiarity with AD health-check and replication diagnostic tools.
• ITSM/ticketing: Working knowledge of ITSM/ticketing platforms for incident and change management.

Preferred Qualifications

• 9+ years of hands-on AD/Hyper-V/Windows Server infrastructure experience.
• Relevant certification (e.g., Microsoft Certified: Windows Server Hybrid Administrator Associate, MCSE, or Azure Fundamentals AZ-900).
• Prior experience with large-scale AD migrations, Migrating to Hyper-V or Domain Controller/Windows Server upgrade projects.
• Strong written and verbal communication skills for client-facing documentation and reporting.