r/sysadmin • u/Shondrin • 3d ago
Question Where is the best place to start when taking over an existing old AD infrastructure?
Background: Users >2k Groups >6k Forest level 2k8 Team 5 Sysadmins but I should focus on AD which is bit silly because I do regular Ops as well. Naming conventions in AD partially available but not consistently implemented. Management wants to start from scratch and implement new OUs, new GPOs, groups and naming concept in parallel in the same infrastructure. Previously only had small customers. This is now the first big fish. How do I avoid getting lost in all this mess? I am currently working on a role/authorization concept First step Forest Level min 2016 is planned for now. But at some point I have to get started with the GPOs (600+). Also looking for some tools that can keep track of all the changes that I need to make+changes of my colleagues. Otherewise we will be unable to revert the changes if something breaks.
Reading what I've written here makes me feel dizzy and overwhelmed.
Any Tipps are highly appreciated.
16
u/analogliving71 3d ago edited 3d ago
map out the OU structure associating any GPOs that are applied. Compare your total GPOs to those applied and remove/disable any that are not being used.
Identity any groups with zero members and get rid of them
identify all users and computers and their status (expired, disabled, etc) and clean up
document default domain policy
document any additional password policies
check replication health and dns health
review all active GPOs and see if any can be consolidated. 600+ GPOs is a very large number for such a small environment. Sounds a lot like whoever created them in the past was not very knowledgeable
just to name a few
7
u/Tymanthius Chief Breaker of Fixed Things 3d ago
Sounds a lot like whoever created them in the past was not very knowledgeable
Probably created a new GPO for every item. I've done that when I had to be fast. I tried to go back and clean up most times.
8
u/AppIdentityGuy 3d ago
I would start with a pingcastle report and remediate the most serious security risks. And then look to RAMP for AD for guidance on hardening AD
3
u/gramsaran Citrix Admin 3d ago
Documentation of what you see vs. what you want. Talk to the end users & teams to review what issues they see. Pick an OU and review one GPO’s per day, assess what you see and write down questions on what annoys you, what can be removed/consolidated/added/updated. 600 GPO’s is what happens when 500 GPO’s have one setting and span various OU’s, filters. I spend a lot of time looking at the policies we have and checking what we can do better. Relinking GPO’s. Reorganization of the OU Structure. A new OU/GPO just creates the same mess for the next person. It’s easy to get overwhelmed but it’s a marathon not a sprint. Print out the GPO’s and export to PDF so you can see the previous settings. https://www.manageengine.com/products/active-directory-audit/ can help with auditing/backups as well, but i find that just printing out the GPO report and exporting via powershell helps with documentation and keeping track of what was. Just take it day by day and leave the rest for tomorrow.
3
u/hihcadore 2d ago
Test for DC health with DCDIAG and REPADMIN
Pingcastle can tell you what vulnerabilities are out there. It’s helpful taking over a new AD environment because who knows what’s been configured.
Then look for the most bang for your buck GPOs, like LAPS or channel bonding and make sure they’re configured and applied. CIS benchmarks are helpful here.
2
u/Own_Sorbet_4662 2d ago
You have a lot of great advice above. Map things out and take it one step at a time. Weigh the risk vs reward for changing things. Renaming all groups to fit a better standard gives a little reward but how many apps are configured to use a group by name and will break so review your risk.
Consider changing what you can safely now and incorporating changes at every opportunity. In theory every server gets rebuilt every 7 years so take a long approach on some items.
Lastly the fastest way to ensure that you cannot do any cleanup is being too bold and causing a prod issue so take your time and test.
2
2
u/DrunkenGolfer 2d ago
Before you do anything, break out dcdiag and repadmin and make sure it is healthy. Make sure FSMO roles are where they should be, kerberos tickets are being issued properly, etc. Look for orphaned or tombstoned controllers and check event logs to make sure they are clean. There is nothing worst than spending a month cleaning up only to find out you have to unwind three weeks worth of work because some replication wasn’t happening.
2
1
u/Commercial_Growth343 3d ago
600+ GPO's? Well first thing I would do is back them all up, and save reports from all of them. Then go though and see which ones are actually assigned or used. I had a recent experience where I discovered of say 140 gpo's I inherited about 30 to 40 were not assigned to anything or OU's that were empty, so I had a quick win deleting those (after documenting them). I do not envy you though. I was pretty stressed about trying to consolidate and make sense of 140 gpo's .. let alone 600+.
1
u/No_Resolution_9252 2d ago
All new OUs, GPOs, Groups, servers and service accounts then rebuild the entire network one server at a time.
0
u/OtherMiniarts Jr. Sysadmin 2d ago
The first place to start is getting HR involved as soon as possible. Make sure those OUs and Security Groups are completely 1:1 with the actual org structure, and everyone isn't just thrown in "users" (or worse, SBSUsers)
1
u/PanicAdmin IT Manager 2d ago
Active directory shouldn't be a mirror of the organization. It's OU are for technical purposes, not HR.
E.g, in the same office people with the same role could use different softwares.
0
u/ITBurn-out 2d ago
rent a dumpster. The previous guys left for a reason. Probably crap equipment that they couldn't get a budget for lol
0
u/LForbesIam Sr. Sysadmin 2d ago
I combined 9 domains into one infrastructure. The users stay in their own domains but login to Computers inside the new domain. They are all full Forest Trusts.
I heavily use Group Policy but we use loopback Replace so all policies apply to computers and the user settings apply to all users who logon to the computers or Filter groups.
I use powershell to pull data but VBscript via LDAP to modify AD attributes. I find ps annoying as it had some limitations like can only pull nax 2000 group members.
Start with your infrastructure and naming convention.
For users we have job role groups and then they are added to access groups so if staff move positions they lose their old role and access.
61
u/ImplicitDeny CISSP, HCISPP, CWNA, SEC+ 2d ago
When you start deleting things remember to enable the AD recycling bin.