Skip to content
Ekovolt

A Reinsurance Organisation in West Africa

Active Directory modernisation and risk mitigation

A routine assessment uncovered an Active Directory close to failure. Over four weeks we stabilised and modernised it with zero downtime, and logins became 40% faster.

Request a free assessmentAll case studies
Orphaned objects cleaned
150+
Faster authentication
40%
Replication success
100%
Estimated downtime costs avoided
$50K+

The client

The client is a reinsurance organisation serving insurance companies across West Africa. It had grown quickly, but its IT infrastructure had not kept pace.

What began as a routine project to move the FSMO roles, the key operations roles in Active Directory, revealed a much deeper problem. Active Directory controls every login, access permission and security policy in the organisation, and it was failing.

The challenge

Our first assessment found five compounding risks. Any one of them could have brought down the whole domain and locked staff out of their systems.

  • Staff locked out

    Any more instability could have locked users out of systems across the company.

  • Compliance exposure

    Unstable infrastructure in a regulated industry invites regulatory action.

  • Limits on growth

    Fragile infrastructure cannot support expansion.

  • No safe way back

    There was no clear path to recovery without risking total failure.

RiskEffect on the business
Broken replicationDomain controllers were not syncing, so logins behaved differently across regions
Orphaned and tombstoned domain controllersA corrupted directory database that threatened complete domain failure
Undocumented serversMore Active Directory servers than anyone knew about, with unknown roles and risks
DNS misconfigurationIncorrect IPv6 settings stopped hostnames from resolving
FSMO roles concentrated in one placeCritical operations roles had a single point of failure

Why the client chose Ekovolt

  1. 01

    Discovery before action

    We mapped the full extent of the problem before changing anything, and reported it openly to leadership before proposing a fix.

  2. 02

    Phased, controlled changes

    Moving FSMO roles in a failing environment would have collapsed the domain, so we confirmed stability at every step before moving on.

  3. 03

    Zero-downtime migration

    We migrated, retired the old primary domain controller and added a third for redundancy, all without interrupting logins.

  4. 04

    A partner, not a vendor

    Daily collaboration and shared accountability kept the client's team part of the process throughout.

What we did

  1. Phase 1

    Assessment and stabilisation (week 1)

    • Health checkMapped every domain controller, found the replication failures and documented configuration issues.
    • Risk validationConfirmed that the planned FSMO transfer would have risked collapsing the domain.
    • Hidden infrastructureFound more Active Directory servers than the two originally on record.
    • Clear reportingTold leadership plainly what state their infrastructure was really in.

  2. Phase 2

    Cleanup and preparation (week 2)

    • Orphaned objectsRemoved more than 150 tombstoned objects that were corrupting the directory.
    • Old domain controllersRemoved two orphaned domain controllers.
    • DNS fixesResolved the IPv4 and IPv6 conflicts that were blocking hostname resolution.
    • FSMO planningDocumented where each role sat and planned a safe transfer order.

  3. Phase 3

    Migration and modernisation (week 3)

    • New serverSet up a new on-premises domain controller on Windows Server 2022, with a static IP address and correct DNS settings.
    • Controlled FSMO transferMoved the operations roles to a domain controller hosted on AWS, without disrupting the domain.
    • Third domain controllerAdded the new server as a third domain controller for redundancy.
    • Old primary retiredSafely shut down and removed the original primary domain controller.

  4. Phase 4

    Validation and handover (week 4)

    • Replication testingConfirmed 100% synchronisation across every domain controller.
    • Login checksVerified that domain joins and sign-ins work.
    • User acceptanceThe client's team confirmed normal operations.
    • DocumentationHanded complete documentation of the environment to the client's IT team.

Before and after

AreaBeforeAfter
ReplicationFailing100% successful across all domain controllers
Authentication speedSlow and inconsistent40% faster
Orphaned objects150+ tombstoned objectsNone, with a clean database
DocumentationPartial or wrongComplete and accurate
FSMO rolesConcentrated, a single point of failureDistributed safely across controllers
DNSIPv4 and IPv6 conflictsFully resolved
Failure riskHighEliminated
IT capabilityReliant on outside supportBriefed and managing it independently

Zero unplanned downtime during the four-week migration, and zero login failures during the transition. We estimate more than $50,000 in downtime, lost productivity and compliance exposure was avoided.

Lessons from the project

  1. 01

    Regular health checks prevent crises

    A routine assessment found a failure already in progress.

  2. 02

    Documentation is an asset

    Undocumented servers are unknown risks, so records need to stay complete and accurate.

  3. 03

    Phased changes reduce risk

    Validating each step before the next made a safe migration possible.

  4. 04

    Partnership beats a vendor relationship

    Daily collaboration and shared responsibility got results a hands-off approach would not.

  5. 05

    Capability transfer is the measure

    The client's IT team now manages Active Directory on their own.

More case studies

Is your Active Directory at risk?

Many organisations don't find Active Directory problems until operations stop. Our infrastructure health assessments find hidden risks early.

Ask for a free assessment and our team will get back to you within 24 hours.