I recently became the first internal IT manager for a municipality of roughly 150 employees. Until now, everything was handled by an MSP, which ended the relationship abruptly after deciding the environment had become too large and unprofitable to support. I received a password list but essentially no documentation, and I'm currently working alone until two technicians join.
The environment spans about 20 buildings connected by private fiber, with a single internet connection at the main site. The network is almost entirely Fortinet, including FortiGate, FortiSwitch, and FortiAP equipment. Much of the hardware is older D-series gear approaching end of life. Remote users connect through FortiClient SSL VPN with FortiToken MFA.
The server environment uses VMware vSphere, Veeam, a SAN at the main site, and additional hosts, storage, backups, and VM replicas at a secondary site about a kilometer away. There are also five completely separate Active Directory domains and forests, each with its own domain controller and file server. Some domains serve fewer than 15 users, and the file servers are still running Windows Server 2008. All domains synchronize to the same Microsoft Entra tenant.
The previous administrator's long-term ideas were to move from VMware to Proxmox and replace the Fortinet network with UniFi. I'm not convinced those should be the immediate priorities. My initial thoughts are to validate backups, document the environment, address the unsupported Windows servers, review security and hardware lifecycles, and investigate whether the AD forests can eventually be consolidated.
If you inherited this environment, what would you prioritize during the first three to six months, and which larger migrations would you deliberately postpone?
4 Answers
Spend the first 90 days on discovery and stabilization: inventory every device, VM, service, license, contract, renewal date, administrator account, VLAN, firewall rule, VPN, and dependency. Put the credentials in a proper password manager and rotate them, especially anything the old provider may still know. Build network and service diagrams, enable monitoring, establish ticketing, and review endpoint protection, MFA, patching, exposed services, privileged access, and former employee accounts. Do not make major architectural changes until you understand why the current design exists and have a rollback plan.
Start with backups, but verify them through actual restores rather than trusting successful job reports. Create at least one known-good full recovery point for every critical server, keep an immutable or otherwise protected copy, and test restoring important files, a server, and ideally a department’s core services. Also confirm that network configurations, certificates, cloud data, and anything managed under the former MSP’s accounts are included. At the same time, identify the systems and data each department considers essential and document recovery objectives.
Five separate forests for 150 users is unusual, but I would not merge them on assumption alone. Interview department and public-safety leaders, review legal, regulatory, operational, and data-separation requirements, and map trusts, applications, GPOs, file permissions, and synchronization. If there is no valid reason to keep them separate, plan a gradual migration into a simpler identity structure rather than attempting a rushed consolidation. VMware and Fortinet should remain in place for now if they are stable and supported; check VMware renewal costs and Fortinet firmware and support status, then choose replacements based on requirements, staffing, support, and total cost—not platform preference.
The Server 2008 systems are a serious security and supportability problem, so I’d assess and replace them early—but first check what depends on them. Some old file servers are probably hosting legacy applications, custom scripts, or unusual permissions. Build supported replacement servers or a suitable managed file platform, migrate data and permissions carefully, and decommission the old machines only after testing. Also address single points of failure such as one internet circuit and isolated domain controllers when the budget allows.
Because this is a municipality, get leadership and the budget office involved immediately. Turn the findings into a risk-ranked, multi-year plan with estimated costs, renewals, staffing needs, and compliance implications. Otherwise every upgrade will become an emergency funding request.