Active Directory Specialist

SHI Solutions India Pvt. Ltd.; Pune District; On-site; INR 1,400,000 - 1,800,000; Full time

Job summary

SHI Solutions India Pvt. Ltd. seeks an experienced L3 AD & Windows Server Engineer to own end-to-end AD/Windows Server administration, upgrades, migrations, and security hardening within enterprise environments.

Responsibilities include leading Domain Controller projects, implementing security controls, and mentoring L1/L2 engineers while supporting hybrid identity and Hyper-V infrastructure.

Qualifications

• Strong hands-on experience with Windows Server 2016/2019/2022/2025 and Active Directory.
• Experience with AD upgrades/migrations and domain controller operations.
• Design and implement security hardening measures for privileged access.
• Hands-on Hyper-V host/cluster administration and VM lifecycle management.
• Proficient in DNS, DHCP, Group Policy, SYSVOL, and Kerberos/LDAP/NTLM.
• Experience with Entra Connect/Azure AD hybrid identity concepts.

Responsibilities

• Own end-to-end administration and troubleshooting of enterprise AD environments.
• Lead AD and Windows Server upgrade/migration initiatives.
• Design and implement security hardening measures and access controls.
• Serve as the L3 escalation point for complex AD/Windows Server incidents.
• Support hybrid identity and cloud integration with Entra Connect.
• Administer Hyper-V virtualization and cluster infrastructure.
• Maintain documentation, runbooks, and mentor L1/L2 engineers.

Skills

Windows Server

Active Directory

Hyper-V

PowerShell

DNS/DHCP

Group Policy

Entra Connect

Azure basics

Security hardening

FSMO roles

VM provisioning

Job description

The L3 Active Directory (AD) & Windows Server Engineer is a senior technical resource responsible for the end-to-end administration, upgrade, migration, and security hardening of enterprise Active Directory, Windows Server and Hyper-V environments. This role combines hands-on experience on complex Hyper-V, Windows server environments, operational ownership with the ability to lead complex AD initiatives – including Domain Controller upgrades, migrations, and security hardening programs – and acts as the escalation point for issues beyond L1/L2 capability. The profile is designed to be broadly applicable across AD/Hyper-V/Windows Server engagements, not tied to any single project.

• Own end-to-end administration and troubleshooting of enterprise AD environments – DNS, Group Policy, SYSVOL replication, and authentication services (Kerberos/LDAP/NTLM).
• Lead AD and Windows Server upgrade/migration initiatives – Domain Controller builds, FSMO role transfers, functional level upgrades, and legacy decommissioning.
• Design and implement security hardening measures – privileged access tiering, service account security, protocol hardening, and alignment with industry best practices.
• Serve as the L3 escalation point for complex AD/Windows Server incidents – driving root-cause analysis and permanent resolution beyond L1/L2 capability.
• Support hybrid identity and cloud integration – Microsoft Entra Connect sync, troubleshooting, and coordination with cloud/identity teams.
• Administer Hyper-V virtualization and cluster infrastructure – host/cluster build and configuration, VM provisioning and lifecycle management, storage and networking, and troubleshooting across the virtualized environment.
• Maintain documentation, drive change management, and mentor L1/L2 engineers – runbooks, as-built records, and knowledge transfer to strengthen operational maturity.

Technical Skill Set Required

• Windows Server & AD DS: Strong hands-on experience with Windows Server 2016/2019/2022/2025 and Active Directory Domain Services.
• Windows Server upgrade/migration: 2016 → 2019/2022/2025 – in-place and migration-based upgrade approaches, compatibility assessment, and rollback planning.
• Domain Controllers: Build, promotion/demotion, and multi-site replication topology.
• FSMO & Functional Levels: FSMO role management, Domain/Forest Functional Level upgrades and dependencies.
• DNS & DHCP: AD-integrated DNS and DHCP administration.
• Group Policy: Design, troubleshooting, and enterprise-scale management.
• SYSVOL/DFSR: Replication configuration and health validation.
• Authentication protocols: Kerberos, LDAP, and NTLM – configuration and troubleshooting.
• Hybrid identity: Microsoft Entra Connect (Azure AD Connect) sync, configuration, and troubleshooting.
• Azure fundamentals (basic): Working knowledge of Entra ID/Azure AD concepts and hybrid identity scenarios – AD/on-prem remains the primary focus, not deep Azure administration.
• Security hardening: Windows LAPS, gMSA, Tier 0/1/2 privileged access model, legacy protocol remediation.
• Hyper-V & Clustering: Host and Failover Cluster build/configuration, VM provisioning and lifecycle management, storage/networking, and general troubleshooting.
• PowerShell: Scripting for automation, auditing, and bulk administration.
• Monitoring & diagnostics: Familiarity with AD health-check and replication diagnostic tools.
• ITSM/ticketing: Working knowledge of ITSM/ticketing platforms for incident and change management.

Preferred Qualifications

• 9+ years of hands-on AD/Hyper-V/Windows Server infrastructure experience.
• Relevant certification (e.g., Microsoft Certified: Windows Server Hybrid Administrator Associate, MCSE, or Azure Fundamentals AZ-900).
• Prior experience with large-scale AD migrations, Migrating to Hyper-V or Domain Controller/Windows Server upgrade projects.

Strong written and verbal communication skills for client-facing documentation and reporting