The situation
This was never going to be one tidy upgrade. The estate combined ageing on-premises infrastructure, hybrid identity, business applications that still depended on the local domain and a growing need to provision and support devices remotely. Improving one layer without understanding the others would simply move the problem.
What I found
The infrastructure needed resilience and housekeeping as much as replacement: storage paths and Hyper-V stability needed attention, backup configuration had accumulated legacy entries, AD/DNS contained stale or incomplete configuration, and endpoint management still relied heavily on traditional domain-joined processes. At the same time, key staff worked remotely and an overseas branch made cloud-led provisioning increasingly useful.
What I changed
I introduced resilient SAN storage with redundant 10Gb iSCSI paths and MPIO, aligned and stabilised Hyper-V hosts, consolidated Veeam, cleaned AD/DNS and added a staged Entra ID / Intune / Autopilot path. Windows Hello for Business with Cloud Kerberos Trust preserved access to on-premises resources; Windows LAPS, automatic OneDrive sign-in and user-folder backup, MFA migration, Apple Business Manager, macOS Platform SSO and Managed Google Play extended the model further. LibreNMS, documentation and hands-on training made the changes supportable rather than merely deployed.
What happened
The environment ended up with a stronger infrastructure base and a clearer endpoint-management direction. Cloud provisioning and policy delivery were introduced without forcing an abrupt break from local services, while storage, virtualisation, backup, monitoring and operational knowledge were left in a more supportable state.
What I’d carry forward
Modernisation is mostly sequencing. Understand the live dependencies first, separate stale configuration from genuine requirements, test risky changes in isolation, and leave the people who inherit the environment able to explain how it works.