CyberCQR Case study · Identity and Zero Trust
The directory nobody dared touch
How a UK financial services firm of about 600 people found that years of deferred change had left its Active Directory beyond repair. Rebuilding it from scratch cleared the way to Microsoft 365, and gave it a clean directory to show its auditors.
About this case study. Neil Brady, CyberCQR's founder, led the security of this migration in 2019. Product names are today's: in 2019, Microsoft Entra ID was called Azure Active Directory. The firm is not named, and details that could identify it have been left out.
Summary
The point for boards. Every change this firm put off looked safe at the time. Added together over years, they left a directory that could not be fixed and a business that could not move forward. Not changing is also a decision, and the board owns its risk just as much as the risk of acting.
The value
| Value | What it meant here |
|---|---|
| Certification back on track | The firm could show its auditors a working, cleaner directory, rather than a list of known gaps. |
| Microsoft 365 unblocked | With a supported directory behind it, the firm moved into SharePoint Online, Exchange Online and the rest of Microsoft 365. |
| Weak passwords gone | Shared, guessable and day-one passwords were replaced, every PC got its own administrator password, and every account gained multi-factor authentication (MFA). |
| Fewer calls for help | Staff could reset their own passwords, so the service desk no longer handed out default ones. |
| Control over access | Permissions were built fresh for each role, so the firm knew who could reach what, and could remove accounts when people left. |
Table 1. The value of the work.
The starting point
The firm was under pressure. It was regulated by the Financial Conduct Authority (FCA) and the Prudential Regulation Authority (PRA), and handled card payments under the Payment Card Industry Data Security Standard (PCI DSS). It wanted ISO/IEC 27001 certification, the international standard for information security management, and needed to avoid penalties and damage to its reputation. Moving to Microsoft 365 was part of the plan. Neil was brought in to secure that move.
The plan assumed the firm's Active Directory (AD), the system that controls who can sign in to what, could simply be connected to the cloud. One look at it showed that was not going to work. For years, the firm had treated change as risk. The more important the service, the less likely anyone was to touch it. The result:
- Accounts that could not be removed. Permissions inherited through layers of nested groups meant some accounts could not be deleted without breaking something nobody could identify.
- A decade out of date. The directory, the servers, email, SharePoint and the Office software on every desk all dated from around 2003 to 2010. Some had already lost security updates, and the rest were close to the end of their support.
- No way back. Backups had been failing, so there was nothing reliable to recover to.
- One key to every PC. Every computer shared one built-in administrator account, with a password unchanged in ten years. The firm had never set up Microsoft's Local Administrator Password Solution (LAPS), which gives each machine its own password and changes it automatically [4].
Two sign-in systems, and only one could keep up
During the move, the firm ran a hybrid setup. Mailboxes moved to Exchange Online in batches, while the rest stayed on the firm's own Exchange servers until their turn came.
In 2019, Microsoft had set a date to switch off basic authentication, the old username-and-password method, for Exchange Online: 13 October 2020 [9]. The firm was working to a deadline about a year away. Covid-19 later pushed the date back, and the switch-off finally began in October 2022 [7], but nobody planning in 2019 could count on that. The old method also cannot use MFA, which the firm wanted on every account. So everything connecting to the cloud had to use the replacement method, and that reached every desk: Office 2010, which the firm ran, does not support modern authentication at all [10]. Before an inbox could move, its users required a newer release of Office.
The on-premises side could not close the gap. Hybrid Modern Authentication lets mailboxes still on a firm's own servers use the same cloud sign-in and MFA, but only from Exchange 2013 onwards, with recent updates [8]. The firm's email servers were a generation older, and the directory was in no state to connect to Microsoft 365. The old setup was not just risky. It was running out of time.
The hidden cost of old systems
Old software did not only carry risk. It limited the firm's defences and added cost. In 2019, Microsoft's endpoint protection did not support Windows Server 2003 or Server 2008, and only reached Server 2008 R2 that autumn, three months before Microsoft stopped updating it [11].
So the firm bought a separate endpoint protection product, chosen because it still supported the legacy estate. That meant another licence, another agent on every machine, another console for someone to watch, and another supplier to manage. It was a product selected for the systems the firm was trying to retire. Every year an old system stays, it narrows your choices and adds complexity.
The password check
To measure the risk, we checked the protected form of each password in the directory, its hash, against a database of known weak passwords. We added the passwords the service desk used for joiners, movers and leavers, and for password resets, taken from its own system.
The results settled the argument. Most passwords were weak, and the worst were on the accounts that mattered most. Administrator and service accounts, the ones systems use to talk to each other, shared the same well-known passwords and had no MFA. Many staff had never changed the password they were given on their first day.
The service desk's default password was, in effect, a master key. Anyone who knew it could sign in as a large share of the firm.
This is the pattern the National Cyber Security Centre (NCSC) warns about. It advises against default passwords and asks organisations to protect administrator accounts in particular [1].
Why not just fix the old directory?
Because you cannot clean up permissions you can't see. Untangling nested groups one at a time, on servers past their support date, with no backup to fall back on, carried more risk than starting again.
Connecting the old directory to the cloud was not the answer either. Microsoft Entra Connect, the tool that synchronises a directory with Microsoft 365, sets only a low minimum for the directory itself [2]. Meeting that minimum is not the same as being ready. Synchronising this directory would have copied every weak password and tangled permission into the cloud, and left the firm depending on servers that no longer received security updates.
Past a certain point, an old directory can't be repaired. Rebuilding it is the lower-risk option, and staying put is the risky choice.
What changed
A new directory on supported servers
We built new domain controllers, the servers that run the directory, on current supported versions of Windows Server, with a new directory to match. Nothing was copied across wholesale.
Department by department
Accounts were exported and rebuilt by hand, one department at a time. In each department, a handful of people went first. We built their new accounts with the permissions their role needed, then tested that everything they used still worked. Only then did the rest of the department follow.
It was slow at first. Each department taught us something, and the process got faster with experience. The whole rebuild took several months.
One password per PC, and backups that work
Microsoft's Local Administrator Password Solution was set up across the estate. Every PC got its own administrator password, changed automatically, so the ten-year-old shared password stopped working everywhere at once [4]. The failing backups were fixed, so the firm once again had something to recover to.
Connected to Microsoft 365, with the protection switched on
Once the new directory was in place, Microsoft Entra Connect linked it to Microsoft Entra ID, the identity service behind Microsoft 365. Alongside it:
- Password hash synchronisation, so cloud sign-in did not depend on servers in the office.
- Self-service password reset with writeback. Staff could set their own, and each new one was copied to the directory straight away [3], so the service desk stopped issuing them.
- Identity Protection in Microsoft Entra ID, to detect and block risky sign-ins.
- MFA for every account, administrators included. The NCSC recommends MFA for all corporate online services [6].
What resistance looked like, and what helped
Very little friction, in the end. The pilot users made the difference. Having gone first, they were strongly supportive, and they helped colleagues in their own departments when questions came up. Change that comes from someone at the next desk lands differently from change announced by IT.
The outcome
The firm went back to its auditors with evidence of a fully working, much cleaner directory, rather than a promise to fix one. With a supported directory behind it, it moved into SharePoint Online, Exchange Online and the rest of Microsoft 365.
The design principles
- Start again when you can't see in. If nobody can say who has access to what, a clean build is safer than a repair.
- Create every account for a reason. Accounts and permissions are built for each role, never copied from the old system.
- Test with real users first. A few people in each department go ahead of the rest, then help their colleagues.
- Keep passwords with their owners. Staff reset their own, and the service desk never issues one.
- Run only supported software. Anything without security updates is a risk the board has chosen to carry.
- Prove you can recover. Fix the backups and test a restore before changing anything else.
If we did it today
- There is no old method left to fall back on. Basic authentication is now disabled in every Exchange Online tenant [7]. A firm in this position today would find its email simply stops working in the cloud.
- Windows LAPS, not a separate tool. In 2019, LAPS was an extra download. It is now built into supported versions of Windows, and can store each machine's password in Active Directory or Microsoft Entra ID [4].
- Prove the backups first. Before you change anything, restore something. The NCSC advises keeping at least one backup offline at any time, so one incident cannot reach them all [5].
- Passwordless sign-in where possible, as in our case study Simpler and stronger: fixing sign-in from the boardroom down.
Lessons learned
- Ask how old your directory is. Which versions run it, and do they still get security updates?
- Ask who can't be deleted. If your IT team won't remove an account for fear of breaking something, you don't fully control it.
- Find the default password. Most service desks have one. Ask how many accounts still use it.
- Count what old systems really cost. Extra security products, licences and support contracts kept alive only for machines you meant to replace are part of the price of not changing.
- Test a restore. A backup you've never restored is a hope, not a plan.
- Treat "if it ain't broke, don't fix it" as a risk decision. Our short piece The most dangerous update is the one you never apply explains why.
- Accountability stays with the board. An adviser or IT provider can design and do the work. The decision to act, and the accountability for the risk until it is done, belong to the firm's directors.
Glossary
| Term | Meaning |
|---|---|
| Active Directory (AD) | Microsoft's system for managing user accounts, computers and access inside an organisation's network. |
| Basic authentication | An old sign-in method that sends a username and password with every request and cannot use MFA. |
| Domain controller | A server that runs Active Directory and checks sign-ins. |
| Endpoint protection | Security software on each computer and server that detects and stops malicious activity. |
| Financial Conduct Authority (FCA) | The UK regulator for how financial firms treat customers and run their business. |
| Hash | A one-way, protected form of a password. Systems store the hash, not the password itself. |
| Hybrid Modern Authentication | A Microsoft feature that lets mailboxes on a firm's own Exchange servers use cloud sign-in and MFA. |
| Identity Protection | A Microsoft Entra ID feature that spots risky sign-ins, such as leaked passwords or unusual locations, and can block them or ask for MFA. Called Azure AD Identity Protection until 2023. |
| ISO/IEC 27001 | The international standard for an information security management system. Firms can be certified against it. |
| Joiners, movers and leavers | The process for creating, changing and removing accounts as people join, change role or leave. |
| Local Administrator Password Solution (LAPS) | A Microsoft feature that gives each computer its own administrator password and changes it automatically. In 2019 it was a separate download, now called legacy Microsoft LAPS. Windows LAPS, built into Windows, replaced it in 2023. |
| Microsoft Entra Connect | Microsoft's tool for synchronising an internal directory with Microsoft Entra ID. Called Azure AD Connect until 2023. |
| Microsoft Entra ID | Microsoft's cloud identity service, used to sign in to Microsoft 365. Called Azure Active Directory (Azure AD) until 2023. |
| Modern authentication | The sign-in method Microsoft 365 uses, which supports MFA and stronger controls. |
| Multi-factor authentication (MFA) | Signing in with something beyond a password, such as an app prompt or a security key. |
| Nested group | A group placed inside another group, so its members inherit the outer group's access. |
| Password hash synchronisation | A Microsoft Entra feature that copies password hashes from the internal directory to the cloud, so cloud sign-in still works if office servers are down. |
| Password writeback | Writing a password changed in the cloud back to the internal directory straight away. |
| Payment Card Industry Data Security Standard (PCI DSS) | The security standard for any organisation that stores, processes or transmits card payment data. |
| Prudential Regulation Authority (PRA) | The part of the Bank of England that regulates banks, building societies and insurers for financial soundness. |
| Self-service password reset | Letting people reset their own password using methods they registered in advance, without calling the service desk. |
| Service account | An account used by a system or application, not a person. |
Table 2. Terms used on this page (alphabetical).
Further reading
From CyberCQR
- Simpler and stronger: fixing sign-in from the boardroom down
- Secure mobilisation at scale: from the office network to cloud identity
- Identity and Access Management: Top 10 Must-Do Actions
- Document library: every paper and tool
References
- [1]National Cyber Security Centre, Password policy: updating your approach.
https://www.ncsc.gov.uk/collection/passwords/updating-your-approach - [2]Microsoft, Prerequisites for Microsoft Entra Connect, viewed 11 November 2026.
https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-install-prerequisites - [3]Microsoft, How does self-service password reset writeback work in Microsoft Entra ID?, viewed 11 November 2026.
https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sspr-writeback - [4]Microsoft, What is Windows LAPS?, viewed 11 November 2026.
https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-overview - [5]National Cyber Security Centre, Offline backups in an online world.
https://www.ncsc.gov.uk/blog-post/offline-backups-in-an-online-world - [6]National Cyber Security Centre, Multi-factor authentication for your corporate online services: recommended types of MFA, reviewed 26 September 2024.
https://www.ncsc.gov.uk/collection/mfa-for-your-corporate-online-services/recommended-types-of-mfa - [7]Microsoft, Deprecation of Basic authentication in Exchange Online, viewed 11 November 2026.
https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/deprecation-of-basic-authentication-exchange-online - [8]Microsoft Exchange Team, Announcing Hybrid Modern Authentication for Exchange On-Premises, 6 December 2017.
https://techcommunity.microsoft.com/blog/exchange/announcing-hybrid-modern-authentication-for-exchange-on-premises/607476 - [9]Redmond Magazine, Basic Authentication extended to 2H 2021 for Exchange Online users, 3 April 2020.
https://redmondmag.com/articles/2020/04/03/basic-authentication-exchange-online.aspx - [10]Microsoft, How modern authentication works for Office 2016 and Office 2019 client apps, viewed 11 November 2026.
https://support.office.com/en-us/article/e4c45989-4b1a-462e-a81b-2a13191cf517 - [11]MCPmag, Windows Server 2008 R2 SP1 gets Microsoft Defender ATP support, 2 October 2019.
https://mcpmag.com/Articles/2019/10/02/Windows-Server-2008-R2-SP1-Microsoft-Defender-ATP.aspx
Security is the outcome, not a solution.
CyberCQR is a UK cyber security advisory practice. We help firms find out what their directory really looks like, decide whether to repair or rebuild, and move to Microsoft 365 on a clean footing, without vendor commissions or product resale.