Windows and Linux, One Operator
Most small and mid-size businesses I work with are not a pure Linux shop or a pure Windows shop. They run a Windows domain controller for logins and shared drives, a Windows box for the accounting or line-of-business application the vendor only ships for Windows, and then Linux underneath for the hypervisor, the web stack, the mail server, and the firewall. Splitting that between two providers is how tickets get bounced. I handle both sides of the line.
On the Windows side that means Windows Server 2016 through 2025, Active Directory Domain Services, DNS and DHCP, Group Policy, file and print, certificate services, Hyper-V where it is already in place, and patching via a third-party agent or Intune, with WSUS still supported on the estates that run it since Microsoft deprecated it in 2024 rather than removing it. On the Linux side it is Proxmox, nginx and Apache, Docker, hosting panels, and Barracuda firewalls. The same person plans the migration, builds the VM, joins it to the domain, opens the firewall rule, and restores the file share when someone deletes a folder on a Friday afternoon.
That matters most in the places where the two worlds touch: a Windows file server living as a guest on a Proxmox host, LDAP authentication from a Linux application against Active Directory, a Windows print queue reached over a site-to-site VPN, or a Veeam job writing to a Synology NAS over SMB. Those are the tickets that stall when the Windows admin and the Linux admin are different companies.
Active Directory Done Deliberately
Most inherited domains have the same three problems: an organizational unit tree that grew by accident, service accounts with passwords that never expire and nobody remembers, and Group Policy applied to the wrong scope.
I start by documenting what is actually there. Every domain controller and its FSMO roles, replication health, the OU structure, every Group Policy object and where it links, every account with domain admin rights, and every account that has not logged on in six months. That inventory is usually the first time anyone has seen the domain written down in one place.
From there the work is unglamorous and specific. Rebuild the OU tree so policy can be targeted by role and location instead of by exception. Move machine and user policy onto separate objects so a change to one does not silently touch the other. Strip standing domain admin rights off day-to-day accounts and give the people who need elevation a second, named admin account. Replace shared service-account passwords with managed service accounts where the application supports them. Turn on the audit policy that lets you answer the question of who changed a permission, before you need the answer.
Permissions on the file server get the same treatment. Groups get nested by role, share and NTFS permissions stop fighting each other, and the folders where everyone was granted Full Control get walked back to something defensible. I test every change against a real user account before it reaches everyone, because a Group Policy object that maps the wrong drive at 8am is a whole morning of lost work.
What I Manage
Active Directory & Identity
Domain controller builds and promotions, forest and domain functional level upgrades, FSMO role placement, replication troubleshooting, DNS and DHCP scopes, trust relationships, and clean decommissioning of the old DC nobody wanted to touch.
Group Policy
Policy design by organizational unit, drive and printer mapping through Group Policy Preferences, security baselines, software restriction, loopback processing where it is genuinely needed, and resolving the conflicting objects that cause slow logons.
File & Print Services
Share and NTFS permission structure, DFS namespaces and replication, shadow copies so users can self-restore a previous version, quotas, print server consolidation, and driver isolation so one bad driver does not take down the spooler.
Patching & Update Control
A real patch schedule instead of automatic reboots at random. WSUS or agent-based patching, staged rings so a pilot group takes the update first, reboot windows agreed in advance, and a rollback plan for the month a cumulative update breaks a line-of-business app.
Backup & Restore Testing
Image and file-level backup to local storage plus an offsite copy, system state for domain controllers, and scheduled restore tests. A backup job that has never been restored from is an assumption, not a backup.
Hardening & Remote Access
RDP off the public internet and behind a VPN or gateway, SMBv1 disabled, LDAP signing enforced, local administrator password randomization, least-privilege service accounts, and Windows Firewall rules that match how the servers actually talk to each other.
How an Engagement Starts
Inventory
Every server, its role, its operating system version and support status, where it runs, what depends on it, and what backs it up. Includes the domain, the shares, the print queues, and the licensing.
Triage
A ranked list separating things that are actively risky from things that are merely untidy. Out-of-support operating systems, unrestored backups, and exposed RDP go to the top. Cosmetic cleanup goes to the bottom.
Remediate
Changes staged during agreed windows, tested against a pilot account or machine first, documented as they go, and handed over with runbooks you can give to any future administrator.
I am a solo operator, so the person who does the inventory is the person who does the work and the person who answers the phone about it later.
Proof of the Infrastructure Work
Infrastructure Estate
The hypervisors, hosting panels, NAS storage, git remotes, and deployment hooks I run day to day, including how backups are mirrored to a geographically separate location and how production changes actually reach a server.
Server Builds
How I stand a server up from bare metal or a fresh VPS: hypervisor install, hardened access, firewall rules, hosting panel, backups, and monitoring. Windows guests get built on the same hosts and the same discipline.
Need Windows Server Help?
Tell me what you are running now and what keeps breaking. A 24 hour answering service picks up and routes straight to my cell when something is down; scheduled work happens in agreed windows. I am based in Lynchburg, onsite across Central Virginia, and remote for clients nationwide.
Get in Touch