Skip to content

Modernizing the Core: AD Redesign, PKI, and a Full Hardware Refresh

Regal Distributing March 1, 2023

Problem

Regal’s core infrastructure had grown organically under the prior MSP relationship: legacy Active Directory structure, no internal certificate authority, aging on-prem hardware, and no centralized way to manage or patch endpoints. None of it was actively broken, but none of it was built to scale, secure, or hand off cleanly — every change carried outsized risk because so little was documented or standardized.

Approach

I treated this as one connected modernization push rather than a series of disconnected upgrades:

  • Hardware refresh — moved the company onto a 3-server Dell PowerEdge R660 environment running Windows Server 2025 and Hyper-V, replacing aging hardware with a platform built for virtualization and future growth.
  • Active Directory redesign — restructured the domain architecture (spanning company.local, Regal.local, and ad.getregal.com) to support isolated network segments and proper trust boundaries, rather than a single flat domain.
  • Internal PKI — stood up RegalDistributing-CA as an internal certificate authority, moving the company off ad-hoc or manually-issued certs and onto a real chain of trust for internal services.
  • RMM deployment — rolled out NinjaOne across the endpoint fleet (including MDM for the mobile driver fleet via ABM/ADE), giving the team centralized visibility and patching for the first time.
  • Monitoring foundation — laid the groundwork for Zabbix and ELK-based monitoring so the new environment wouldn’t just be modern, but observable.

All of this was sequenced to minimize disruption — VLAN segmentation and firewall rules were tightened incrementally, and domain trust work was staged so production access never had a hard cutover moment.

Outcome

The result is infrastructure the two-person team can actually stand behind: a segmented, documented, monitored environment instead of a black box inherited from an outside vendor. Certificate issuance, patching, and endpoint visibility that used to require MSP tickets are now handled internally in minutes. This modernization also became the foundation every later project — the HQ26 relocation, the warehouse network buildout, the hybrid cloud work — was able to build on top of, rather than working around legacy constraints.

[Fill in: any concrete number worth citing — endpoints under RMM, certs issued, incidents avoided, time-to-resolution improvement, etc.]

Recommended for you