Technical Solutions Architect - AD DS

We are currently seeking a Technical Solutions Architect - AD DS to join our team in Noida, Uttar Pradesh (IN-UP).Key Responsibilities:

• Design, administer, and support enterprise Microsoft Active Directory Domain Services (AD DS) environments across production and non-production domains.
• Manage domain controllers, forests, domains, trusts, organizational units (OUs), sites, subnets, and Global Catalog services.
• Administer and troubleshoot DNS, DHCP, Group Policy Objects (GPOs), FSMO roles, Kerberos, LDAP, NTLM, and Windows authentication.
• Manage Active Directory replication, Sites and Services, SYSVOL, DFS Replication (DFSR), and domain controller health.
• Support user, group, computer, service account, and managed service account administration, including gMSA.
• Manage domain joins, secure channel issues, account lockouts, authentication failures, and directory connectivity.
• Support Active Directory schema considerations, domain controller lifecycle management, and directory architecture changes.

Advanced L3 Troubleshooting and RCA:

• Own complex L3 escalations involving authentication failures, replication inconsistencies, DNS resolution, Group Policy processing, Kerberos, LDAP, trusts, and domain controller availability.
• Diagnose replication failures using tools such as repadmin, dcdiag, and event logs.
• Troubleshoot SYSVOL/DFSR synchronization issues, lingering objects, USN-related problems, time synchronization, and domain controller promotion or demotion failures.
• Perform detailed RCA for recurring and high-impact incidents and implement permanent corrective and preventive actions.
• Lead resolution of critical incidents involving directory outages, authentication disruptions, and cross-domain connectivity issues.
• Analyze directory service logs, performance counters, network traces, and authentication flows to identify underlying problems.
• Coordinate with Microsoft support and infrastructure, network, security, application, and IAM teams to resolve complex issues.

Directory Services Security and Hardening:

• Implement and maintain secure Active Directory configurations aligned with enterprise security standards and Microsoft security recommendations.
• Review privileged groups, delegated permissions, administrative accounts, service accounts, and access control lists (ACLs).
• Support remediation of excessive privileges, insecure configurations, legacy authentication protocols, and stale or unmanaged accounts.
• Implement and review Group Policy security settings, password policies, account lockout policies, and authentication controls.
• Support privileged access security, tiered administration, protected administrative accounts, and secure management of domain controllers.
• Identify and remediate risks involving Kerberos, NTLM, LDAP signing/channel binding, unconstrained delegation, and other directory security weaknesses.
• Support security audits, vulnerability remediation, compliance evidence collection, and access reviews.

Hybrid Identity and Enterprise Integrations:

• Support integration between on-premises Active Directory and Microsoft Entra ID.
• Troubleshoot hybrid identity synchronization and authentication dependencies, where applicable.
• Collaborate with IAM/IGA, PAM, SSO/MFA, endpoint, and cloud infrastructure teams on identity-related integrations.
• Support directory dependencies for enterprise applications, LDAP integrations, service authentication, and identity lifecycle workflows.
• Troubleshoot authentication and authorization issues across interconnected enterprise environments.
• Support directory-related migration, consolidation, trust configuration, and application modernization initiatives.

Required Technical Skills:

• Expert-level knowledge of Microsoft Active Directory Domain Services and enterprise Windows Server environments.
• Strong expertise in AD replication, DNS, Group Policy, FSMO roles, Global Catalog, trusts, and Sites and Services.
• Advanced troubleshooting of Kerberos, LDAP, NTLM, secure channels, authentication, authorization, and account lockouts.
• Strong knowledge of DFSR/SYSVOL, domain controller health, time synchronization, and directory recovery.
• Experience with PowerShell scripting and automation.
• Strong understanding of Active Directory security, delegation, ACLs, privileged groups, service accounts, and gMSA.
• Experience with Microsoft Entra ID and hybrid identity integration is desirable.
• Familiarity with monitoring, SIEM integration, vulnerability remediation, and security auditing.
• Experience with ITIL-based incident, problem, change, and service management processes.

Platform Lifecycle, Resilience and Change Management:

• Plan and execute domain controller patching, upgrades, replacement, promotion, and demotion activities.
• Support Active Directory backup, forest recovery planning, disaster recovery testing, and business continuity procedures.
• Validate replication, DNS, authentication, Group Policy, and dependent services following infrastructure changes.
• Lead technical impact assessments, risk reviews, implementation plans, rollback planning, and post-change validation.
• Support capacity management, performance optimization, platform availability, and operational readiness.
• Ensure compliance with change management, incident management, problem management, and release management procedures.

Skills

AD DS, Active Directory, PowerShell, Windows Server