Active Directory Engineer

Role Summary

The Windows Active Directory Engineer is responsible for stabilizing, securing, and modernizing the enterprise Active Directory environment with a strong focus on directory cleanup, identity hygiene, replication health, and security hardening. This role ensures AD remains healthy, compliant, resilient, and aligned with Zero Trust identity principles across on-prem and hybrid cloud environments.

Key Responsibilities

1. Active Directory Cleanup & Optimization

• Perform comprehensive AD cleanup including stale objects, unused OUs, orphaned SIDs, legacy GPOs, and deprecated configurations.
• Normalize and restructure OU hierarchy, naming standards, and attribute consistency.
• Identify and remediate duplicate SPNs, conflicting UPNs, and misconfigured service accounts.
• Clean up old domain controllers, decommission legacy forests/domains, and remove deprecated trust relationships.
• Conduct ACL cleanup to eliminate excessive permissions and privilege creep.

1. AD Security Hardening & Identity Protection

• Implement CIS/NIST/Microsoft security baselines for domain controllers and AD objects.
• Harden authentication by reducing NTLM, enforcing Kerberos protections, and implementing authentication policies/silos.
• Deploy and maintain Privileged Access Workstations (PAW) and tiered admin model (Tier 0/1/2).
• Remediate identity vulnerabilities such as DC Sync exposure, unconstrained delegation, Golden Ticket risks, and weak ACLs.
• Integrate AD logs with SIEM platforms (Sentinel, Splunk, QRadar) for continuous monitoring.
• Implement secure service account management, including gMSA adoption and rotation policies.

1. AD Replication Health & Domain Controller Management

• Monitor and maintain AD replication topology, site links, and inter-site connectivity.
• Troubleshoot replication failures (USN rollback, lingering objects, tombstone issues).
• Perform authoritative and non-authoritative restores as needed.
• Ensure domain controllers are patched, hardened, and compliant with security standards.
• Validate SYSVOL health (DFSR), replication convergence, and GPO consistency.

1. Group Policy Management & Cleanup

• Audit and clean up legacy, conflicting, or redundant GPOs.
• Standardize GPO structure, naming, and versioning.
• Implement GPO security baselines for servers, workstations, and privileged accounts.
• Troubleshoot GPO processing issues and configuration drift.

1. Hybrid Identity & Azure AD (Entra ID) Integration

• Support and optimize Azure AD Connect sync, attribute flows, and identity lifecycle.
• Remediate sync errors, duplicate identities, and hybrid identity conflicts.
• Implement Conditional Access, MFA enforcement, and modern authentication policies.
• Support migration toward Zero Trust identity and passwordless authentication.

1. Documentation, Governance & Continuous Improvement

• Maintain detailed documentation of AD topology, GPOs, replication, and security configurations.
• Develop identity governance standards, naming conventions, and lifecycle processes.
• Provide recommendations for AD modernization, consolidation, and long-term stability.
• Participate in audits, compliance reviews, and security assessments.

Required Skills & Experience

• 5-10+ years of hands-on experience with Active Directory, DNS, DHCP, GPO, and Windows Server.
• Deep expertise in AD cleanup, replication troubleshooting, and security hardening.
• Strong PowerShell skills for automation and bulk remediation.
• Experience with Azure AD / Entra ID, hybrid identity, and AAD Connect.
• Familiarity with SIEM, identity threat detection, and AD attack paths.
• Understanding of Kerberos, NTLM, LDAP, SAML, OAuth, and modern auth.

Preferred Qualifications

• Knowledge of Red Forest / ESAE, Tiered Admin Model, and Zero Trust identity.
• Certifications: Microsoft Identity & Access Administrator (SC-300), Azure Administrator

Important Notice: Protecting Your Information
Medvacon Talent Acquisition only conducts initial video interviews via Microsoft Teams or Zoom. All communication will come from an email address ending in @medvacon.com. If you receive a message that seems suspicious or is not from our official domain, please report it immediately to View email address on click.appcast.io.