Room2.07Floor 2 Servers and cloud
Active Directory and Microsoft Entra ID support
We clean up Active Directory, set up Microsoft Entra ID and the sync between them, and move sign-in toward passwordless, whether you keep a domain controller or retire it.
- Active Directory cleaned up
- Entra ID set up and synced
- Passwordless sign-in
- Windows Server 2016End of support January 12, 2027
Two directories, one set of people
Every account your staff sign in with lives in a directory. In most GTA offices there are two of them. Active Directory runs on a Windows server in your office and has done since the network was first set up. Microsoft Entra ID, formerly Azure AD, is the directory behind Microsoft 365. Between them, they decide who can sign in, to what, from where, and with what proof.
Active Directory
- Runs on domain controllers, which are Windows servers you own
- Controls sign-in to domain-joined PCs, file shares and printers
- Applies settings through Group Policy
- Needs the PC to reach a domain controller, in the office or over a VPN
Microsoft Entra ID
- Runs in Microsoft’s cloud, included with Microsoft 365
- Controls sign-in to Microsoft 365 and thousands of other cloud apps
- Applies rules through Conditional Access and Intune
- Works from anywhere with an internet connection
When the two are connected properly, staff have one username and one password, and leaving the company switches off everything at once. When they are not, offices end up with duplicate accounts, passwords that do not match and former employees who can still reach something. We look after both, and the link between them.
Three ways offices run identity today
| Setup | How it works | Suits | Watch for |
|---|---|---|---|
| Hybrid | Active Directory is the source of accounts, synced to Entra ID by Entra Connect Sync or Entra Cloud Sync | Offices with a domain, file servers or applications that still need it | The sync server is a critical system that has to be kept current, monitored and backed up |
| Cloud only | Entra ID is the only directory. PCs are joined to Entra ID and managed by Intune | New offices, and offices whose servers have been retired | Older applications that expect a domain, and Wi-Fi or printing that relied on the server |
| Cloud first, with a small domain kept | Staff and PCs are cloud only, and a domain controller remains for one or two applications | Offices partway through retiring their server | The remaining domain still needs patching, backup and an end date |
For a new PC we recommend joining it to Entra ID only, even in a hybrid office. Our Intune page explains why, and how existing domain-joined PCs move across.
What an Active Directory health check finds
Active Directory rarely fails loudly. It degrades quietly over years of staff changes, quick fixes and departed administrators, until it becomes the easiest way for an attacker to take over the whole network. These are the findings we see most often in GTA offices.
| Finding | Why it matters | The fix |
|---|---|---|
| Too many Domain Admins | Every one is a full key to the network, and everyday accounts with admin rights are what attackers phish for | Separate admin accounts used only for admin work, and the group cut to the people who need it |
| Stale user and computer accounts | Accounts of people who left still work, and nobody watches them | Disabled, then removed after a set period, with a monthly report from then on |
| Service accounts with old passwords | Weak, never-changed passwords on service accounts can be cracked offline from any normal user account | Long random passwords, managed service accounts where possible, and AES encryption set explicitly |
| One shared local admin password | The same password on every PC lets an attacker move from one machine to all of them | Windows LAPS, giving every PC its own rotating password |
| A single domain controller | If it fails, nobody signs in, and its backup has often never been tested | A second domain controller or a tested system-state backup and recovery plan |
| Domain controllers on old Windows Server | Windows Server 2012 R2 is already out of support, and 2016 follows on January 12, 2027 | New domain controllers on a current version, or a plan to retire the domain |
| Group Policy sprawl | Dozens of overlapping policies that nobody can explain, some undoing others | Policies documented, consolidated and, where possible, moved to Intune |
The 2026 Kerberos changes, and what they break
Kerberos is how Active Directory proves who you are when you open a file share or a business application. For decades it allowed an old, weak cipher called RC4, which attackers use to crack service account passwords. In 2026 Microsoft switched RC4 off by default, in three steps through the monthly Windows updates on domain controllers.
| Update | What changed |
|---|---|
| January 2026 | Domain controllers began logging audit events whenever a request still depended on RC4 |
| April 2026 | Accounts with no encryption types set explicitly began receiving AES-only tickets by default, with a temporary way to roll back |
| July 2026 | The rollback option was removed, so RC4 is off unless an administrator deliberately allows it for a specific account |
What usually breaks is something old: a NAS or copier that authenticates to the domain, an accounting or ERP application running under a service account created a decade ago, or a Linux or Java system using an old keytab file. The symptoms are vague sign-in failures that started after a Patch Tuesday. We read the audit events on your domain controllers, find every account still asking for RC4, and fix them properly by enabling AES and resetting the password, rather than turning the weak cipher back on.
Entra ID, set up the way Microsoft intends
Most tenants we inherit were created in a hurry to get email working, then never revisited. These are the pieces that turn Entra ID from a list of mailboxes into real access control. Most are included with Microsoft 365 Business Premium through Entra ID P1.
- Conditional Access policies that require multi-factor sign-in for everyone, block old sign-in protocols, and require a managed, compliant device for administrators
- Passwordless sign-in with passkeys, Windows Hello for Business and the Microsoft Authenticator app, which also resists phishing pages that steal one-time codes
- Two emergency access accounts, excluded from every policy, stored safely and monitored, so a broken policy cannot lock everyone out
- Admin roles granted by task, so the person who resets passwords is not a Global Administrator
- Self-service password reset, written back to Active Directory in hybrid offices, so a forgotten password is not a phone call
- Sync scoped to the accounts that belong in the cloud, with Entra Connect or Cloud Sync kept on a supported version and monitored
- Sign-in and audit logs reviewed, with alerts for risky sign-ins and changes to admin roles
Sign-in security is the layer that stops the mailbox takeovers described on our email security page.
Retiring the domain controller
Many offices can now run without a domain controller at all. Whether yours can depends on what still leans on it. Each dependency has a cloud replacement, and the work is in finding all of them before the server is switched off.
| What depends on the domain | Usual replacement |
|---|---|
| Sign-in to PCs | PCs joined to Entra ID and managed by Intune |
| File shares | SharePoint and OneDrive, or a NAS for files that cannot sync. See SharePoint migration |
| Group Policy settings | Intune configuration profiles |
| Printing through a print server | Cloud printing, or printers deployed directly by Intune |
| Wi-Fi sign-in through the server’s RADIUS role | Certificate-based Wi-Fi pushed by Intune, with a cloud RADIUS service |
| Applications that use LDAP or Kerberos | Updated to modern sign-in, moved to Entra Domain Services, or kept on a small domain until replaced |
Retiring the domain usually goes hand in hand with replacing an ageing server. Our Windows Server and Exchange page covers the server itself, and our VMware migration page covers the virtual machines that often run alongside it.
Directory work we quote
Day-to-day account changes, password resets and new starters are handled by our help desk on the managed IT plan. Larger directory work is quoted at a fixed price before it starts.
- Active Directory health check and clean-upFixed quote
- Kerberos RC4 audit and service account fixesFixed quote
- Entra ID and Conditional Access setupFixed quote
- Passwordless sign-in rolloutFixed quote
- Entra Connect upgraded or moved to Cloud SyncFixed quote
- Domain controller retired, office moved to cloud onlyFixed quote
Questions people ask
What is the difference between Active Directory and Entra ID?
Active Directory runs on Windows servers in your office and controls sign-in to domain-joined PCs, file shares and printers. Microsoft Entra ID, formerly Azure AD, runs in Microsoft's cloud and controls sign-in to Microsoft 365 and other cloud apps. Many offices use both, kept in step by a sync tool.
Do we still need Active Directory if we use Microsoft 365?
Not always. If PCs are joined to Entra ID, files are in SharePoint or OneDrive and no application needs a domain, the domain controller can be retired. Many offices keep a small domain for one or two applications until those are replaced.
What changed with Kerberos and RC4 in 2026?
Microsoft disabled the weak RC4 cipher by default on domain controllers in stages: audit events from January 2026, AES-only defaults from April, and no rollback option from July. Older devices and service accounts that relied on RC4 can fail to sign in until they are moved to AES.
Is Entra Connect or Cloud Sync better?
Cloud Sync is lighter and suits most small offices with a single domain. Entra Connect Sync is still needed for some advanced scenarios. Whichever you use must be kept on a supported version and monitored, since it decides who can sign in.
Can staff sign in without passwords?
Yes. Passkeys, Windows Hello for Business and the Microsoft Authenticator app let staff sign in without typing a password, and these methods also resist phishing pages that steal one-time codes. Most offices roll them out in stages, starting with administrators.
What happens if a Conditional Access policy locks everyone out?
That is what emergency access accounts are for. We set up two, excluded from every policy and stored securely, and we test new policies in report-only mode first so problems show up before anyone is blocked.
Our domain controllers run Windows Server 2016. What should we do?
Plan now. Windows Server 2016 reaches end of support on January 12, 2027. The choice is new domain controllers on a current version, or retiring the domain and moving to cloud-only sign-in. We help you decide which suits your applications.
Can you clean up Active Directory without disrupting staff?
Yes. Accounts are disabled before they are deleted, admin changes are made with the people affected, and service account changes are tested in maintenance windows. Staff usually notice nothing except that sign-in becomes simpler.
Tell us what’s going on
Pick how urgent it is and leave a way to reach you. The help desk replies by phone or email. If work has stopped, call 647-812-3775 instead.
Something broken, or something to plan?
For anything urgent, call. A technician answers the emergency line 24/7. For everything else, open a ticket and tell us what is going on.