Job Description:
Wintel Active Directory (AD) Engineer - Job Description
Role Summary
The ITO Wintel Active Directory (AD) Engineer provides Level 3 operational support for Windows Server and Microsoft Active Directory across DXC-managed customer environments. The engineer maintains the health, security and compliance of directory services, including domain controllers, Group Policy, DNS/DHCP, certificate services and replication topology. Working within ITIL 4 frameworks, they implement approved changes, enforce secure baselines and support identity lifecycle workflows, keeping services stable, auditable and aligned with contractual SLAs. They escal
Due to the nature of the work and the customers we support, the successful candidate must be eligible to meet UK Government and contractual personnel security requirements, including the applicable residency requirements for the role, and have the right to work in the United Kingdom. Some roles may also be subject to nationality requirements where these are necessary to meet UK Government or contractual security obligations.
Please note attendance on-site 5 days a week is required.
Key Responsibilities
- Plan AD capacity, domain controller placement, FSMO distribution and site topology.
- Maintain accurate Wintel and AD CMDB records, relationships and dependencies.
- Support OS lifecycle, patching and security roadmaps and infrastructure forecasting across managed environments.
- Investigate recurring directory incidents through Problem Management and propose permanent fixes.
- Update AD and Windows runbooks, procedures and knowledge articles with current configurations and lessons learned.
- Contribute to post-incident reviews and service improvements that enhance stability and efficiency.
- Keep customers informed of planned changes, maintenance windows and service impacts.
- Coordinate GPO, DNS and trust dependencies with Security, Identity and Network teams.
- Update incident managers and stakeholders on major-incident progress and resolution timelines.
- Implement security and operational GPOs with testing and peer review before production deployment.
- Support approved AD design and transition changes to OUs, trusts, sites and subnets.
- Verify tested, documented system state backups and authoritative restores before directory services go live.
- Maintain current, accessible AD topology diagrams and documentation using tools such as Visio.
- Build and configure physical and virtual Windows AD servers to CIS or equivalent security baselines.
- Patch domain controllers through approved changes, coordinating with Change Management to minimise disruption.
- Automate provisioning, health checks, replication monitoring and bulk reporting with PowerShell.
- Configure DNS zones, DHCP scopes and certificate dependencies to integrate with AD infrastructure.
- Resolve L3 Windows Server and AD incidents involving authentication, replication, GPOs and DNS.
- Process JML account provisioning, changes and de-provisioning through approved requests and identity lifecycle policies.
- Remove stale objects, review privileged groups and manage dormant accounts for directory security and compliance.
- Monitor domain controller health, replication latency and SYSVOL consistency to prevent service degradation.
- Secure baselines are enforced, and audit and compliance evidence is gathered and maintained to support internal and external reviews.
- Complex trust, identity federation, or multi-domain replication issues are escalated to senior staff with clear diagnostic information and recommended next steps.
Required Skills & Experience
Essential
- Windows Server Operations: 4-7 years' hands-on enterprise managed-services experience administering Windows Server 2016, 2019, 2022 and 2025, with deep installation, configuration, patching and hardening knowledge across physical and virtual platforms.
- Active Directory: Strong on-premises expertise in domain controllers, FSMO roles, intra/inter-site replication, sites and services, OU design and trusts, plus comprehensive AD architecture and infrastructure dependency knowledge.
- Group Policy: Advanced GPO design, implementation, linking, troubleshooting and security enforcement across complex OUs and multiple sites.
- DNS & DHCP: Solid AD-integrated DNS, forward/reverse lookup zone, conditional forwarder and DHCP scope knowledge to resolve authentication and availability issues caused by name resolution.
- Security Hardening: Experience enforcing CIS or equivalent Windows Server baselines, with practical privileged access, stale object cleanup, group hygiene and security assessment knowledge.
- Identity Lifecycle: Practical JML provisioning, role-change and de-provisioning experience through approved changes, with AD least-privilege and role-based access knowledge.
- Virtualisation: Working VMware vSphere and/or Hyper-V deployment, management and troubleshooting knowledge, supporting confident operations a
Wintel AD Engineer - Secure - On-site Hampshire employer: DXC Technology Company
At DXC Technology, we pride ourselves on being an excellent employer that fosters a collaborative and innovative work culture. Our commitment to employee growth is evident through mentorship opportunities and the chance to lead impactful projects in a flexible remote and on-site environment. Join us to be part of a team that values your expertise and encourages you to make a meaningful difference for our clients and their users.
