Small-Business Domain Migration

Before

Each computer had its own local accounts, and staff used local administrator accounts day to day. That meant anyone, or any malware someone clicked on, could install software, change security settings or reach other machines with the same shared password. There was no central way to add or remove a user, and patching and backups depended on each machine.

What I changed

• Set up an Active Directory domain on the company's Windows server and joined the workstations to it
• Created individual user accounts and security groups, so access follows the person's role
• Removed day-to-day local admin rights, following the least-privilege principle: admin access is a separate account used only when needed
• Brought patching and backups under central management tools/schedule you use
• Kept QuickBooks and shared files working for everyone throughout the move any downtime?

Results

• Onboarding or offboarding someone is now one account to create or disable, not a visit to every machine
• e.g., number of shared/admin accounts removed, patch compliance, backup restore test

Lessons

Small businesses usually have the same security gaps as large ones, without an IT department to catch them. Most of the risk here came from convenience: shared passwords and everyone being an administrator. Fixing identity first made every other control easier.