Active Directory Consulting
Active Directory
High End
Consulting
Why Active Directory is never a standard project
Active Directory is more than 25 years old – and yet it decides, today more than ever, whether an attacker stops at the first compromised client or takes over the entire company. Almost every successful ransomware attack ends with domain admin rights. Almost every failed migration ends with duplicate identities, broken permissions and a project that will be finished “at some point”.
This is where Wendel Security comes in. Andy Wendel is one of the most experienced Active Directory specialists in the German-speaking world: trainer and consultant since the late 1990s, Microsoft Certified Trainer and one of only 56 Microsoft Certified Learning Consultants worldwide, trained by Paula Januszkiewicz (CQURE) and Sami Laiho – two of the internationally leading minds in Windows and identity security.
What sets him apart from classic system integrators: he sells no licences and no hardware. He delivers architecture, migration and hardening from a single source – and explains it in a way that lets your team run the result themselves afterwards.
The right choice: Andy Wendel
More than 25 years of Active Directory. From the first Windows 2000 forest to hybrid Entra ID integration – the entire evolution witnessed first-hand.
Trained by the best. Trained by Paula Januszkiewicz (CQURE) and Sami Laiho, internationally leading experts in Windows security and identity.
Trainer and practitioner in one. Microsoft Certified Trainer and Microsoft Certified Learning Consultant – one of 56 worldwide. Anyone who can teach complex topics has understood them.
Enterprise experience. Projects at large organisations in [insurance, industry, public sector, higher education, mid-market] – references on request.
Crisis-proven. Project lead for the rebuild of the University of Duisburg-Essen after the 2022 ransomware attack – operational again in five weeks.
Project lead and architect in one person. Many years of experience leading complex infrastructure projects – with the technical depth to judge every decision himself.
Cleared for confidential work. Specialised in confidentiality-bound environments and VS-NfD; secure collaboration via DRACOON.
PingCastle contributor. Uses PingCastle in every project and has contributed practical input to the tool’s development.
Vendor-independent. No licence or hardware commissions. Recommendations are based solely on your environment.
„We help you now, so that you won’t need us later.“
Active Directory Migration
Merger, carve-out, forest consolidation or the way out of an environment that has grown wild, been compromised or simply become unmanageable: AD migrations are open-heart surgery. Every user, every application, every service depends on it. Andy Wendel has planned and executed migrations from a few hundred to tens of thousands of objects – during live operations, without the business units noticing.
Greenfield: designing and building a new Active Directory
You build a new Active Directory once – and then live with it for ten to twenty years. Decisions on forest structure, OU design, tiering and the permission model can only be corrected later at enormous cost. That is why it pays to have the design done by someone who knows the consequences of those decisions from hundreds of customer environments.
Was you get
- A reliable inventory: Which applications really depend on AD, which dependencies are undocumented, where are the risks?
- A migration concept with sequencing, coexistence phase, rollback strategy and clear acceptance criteria per wave.
- Execution with the right tooling (ADMT, PowerShell, third-party tools) – based on experience, not on the textbook.
- A documented, cleaned-up target environment that does not carry the mistakes of the old one.
Scope of services
- Requirements workshop with IT, security, business units and – where needed – works council and data protection.
- Architecture document (forest/domain design, sites, replication, DNS, tiering, delegation, PKI, monitoring, backup/recovery).
- Build of the environment including hardened domain controllers, administration tier, Group Policy baseline and PKI.
- Stress tests and attack simulation against the new environment before the first production user is migrated.
- Handover with operations manual and enablement of your team – as an individual training course on request.
Typical scenarios
Forest and domain consolidation: Merging multiple forests or domains after acquisitions, restructurings or historically grown sprawl.
Cross-forest (inter-forest) migration: Users, groups, computers, service accounts and resources including SID history, trust design, Kerberos delegation and application dependencies.
Carve-out / separation: Extracting a business unit into its own clean forest – including the interfaces that must keep running during the transition period.
Rip-and-replace after compromise: When an existing AD can no longer be trusted, a controlled rebuild with selective takeover is often the only reliable path.
Modernisation: Replacing outdated domain controllers and functional levels, removing legacy risks (SMBv1, NTLMv1, insecure delegations), preparing for hybrid scenarios with Microsoft Entra ID.
Failover clusters, Hyper-V and datacenter services: Migrating infrastructure services across domain boundaries – where standard tools stop.
Design principles
Security by design: Enterprise Access Model (Tier 0/1/2), hardened administration environment, Privileged Access Workstations, least-privilege delegation – from day one, not as a later hardening project.
Operability: An OU and group structure your team understands, a GPO design without sprawl, naming conventions and processes that will still be followed in five years.
Integrated PKI: Certificate infrastructure (offline root, issuing CAs, auto-enrolment, certificate-based authentication) as an integral part of the design – not an afterthought.
Hybrid-ready: Clean integration with Microsoft Entra ID, Conditional Access and modern authentication, without undermining on-premises security.
Compliance-ready: Traceable permissions, auditability and documentation that stand up to auditors, BSI IT-Grundschutz, ISO 27001 or NIS 2 requirements.
Geheimschutz und VS-NfD-Umgebungen
Public authorities, defence and security industry, operators of critical infrastructure: in many environments, not only the result but the way to it requires protection. Andy Wendel specialises in projects in confidentiality-bound environments and works routinely under the requirements of the German classification level VS-NfD (Verschlusssache – Nur für den Dienstgebrauch, “restricted”).
Processes: Confidential project communication and document exchange via approved, German-operated platforms such as DRACOON – no project material in US clouds or as e-mail attachments.
Architecture: AD and PKI designs that take network segregation, zone concepts, hardened administration paths and the evidence obligations of classified environments into account from the outset.
People: Delivered personally by Andy Wendel [and a small, long-established circle of partners] – no rotating teams, no offshore resources. [Security clearance: add level/status here if available.]
Sovereignty: Anyone serious about digital sovereignty needs a directory that works without external access. That is exactly the architecture we build.
Project leadership for identity and infrastructure projects
Most AD projects fail not because of the technology but because of governance: unclear responsibilities, underestimated application dependencies, business units that only learn after the move that something has changed. On request, Andy Wendel takes on overall project leadership – from requirements gathering through vendor management and steering committee to acceptance. With the advantage that the project lead can judge every technical detail himself and does not have to rely on third-party assessments.
Review, redesign and hardening of existing environments
Not every AD needs to be rebuilt. Often an honest look from the outside is enough: Where are the paths to domain admin that nobody knows about? Which service accounts have had the same password since 2011? Which delegations did the predecessor’s predecessor set up? The AD security review delivers a prioritised list of measures – and, on request, the implementation as well. In addition, we run penetration tests that specifically target identity and directory services.
PingCastle – not just used, but shaped
Every review starts with PingCastle, the de-facto standard for assessing Active Directory security. Andy Wendel has used the tool in every customer environment for years and has contributed ideas to its ongoing development – some of the checks and evaluations that are standard today go back to observations from his project practice. The difference from a bare report: you get not just the score, but the assessment of which findings are real attack paths in your environment, which apparent risks may remain, and in what order your score improves sustainably.
What matters in a crisis
Prioritisation over perfection: First what makes operations possible again – identities, authentication, core applications. Everything else follows in orderly waves.
Clean rebuild: No restoring of compromised domain controllers. A new forest with tiering and controlled takeover of what is demonstrably trustworthy.
Steering all parties: Forensic investigators, insurers, authorities, service providers, rectorate or board, internal and external communication – one project lead who keeps the overview.
The way back to normal: Operations manual, monitoring and processes so that the new environment is not back where the old one was in two years.
Incident response and rebuild after ransomware
When Active Directory is compromised, every day counts. What is needed then is not a consultant who writes concepts, but a project lead who steers forensics, rebuild, service providers, business units and executive management at the same time – and who knows which sequence actually works.
Case study: University of Duisburg-Essen: After the ransomware attack on the University of Duisburg-Essen (November 2022), Andy Wendel took over project leadership for rebuilding the identity and directory infrastructure. The result: a university with around 40,000 students and several thousand staff was operational again within five weeks – on a clean, hardened foundation instead of a hastily patched legacy environment.
How we work
1 · Assessment. We analyse your existing environment technically and organisationally – with tools, interviews and a trained eye for what is in no documentation.
2 · Design. You receive an architecture or migration concept that justifies decisions instead of merely listing them. Decision-makers understand it, administrators can work from it.
3 · Proof. Critical steps are rehearsed in a test environment. Rollback paths are not described but tried out.
4 · Execution. Migration or build in clearly delimited waves, with defined acceptance criteria and no surprises for the business units.
5 · Handover and enablement. Documentation, operations manual and knowledge transfer to your team. The goal is independence – not the next follow-up contract.
At eye level, with respect for what your team has already built – and with the clarity you are entitled to expect from an external expert.
Let’s talk about your Active Directory
In a no-obligation 30-minute initial consultation, we’ll assess the current state of your platform, explore the available options – VMware replacement, a complete rebuild, moving away from the cloud or hardening – and determine whether we’re a good fit. No sales pitch – just a technical discussion.
This post is also available in:
