Infrastructure & Endpoints

Multi-site network and WAN standardization

IT Director · National food brokerage

I standardized office networking across a business with offices in several regions in two stages: first the equipment inside each office, then the internet circuits connecting them.

The regional refresh

One region used a mix of SonicWall, Peplink, Ubiquiti, and Ruckus equipment, with no shared VPN, central monitoring, or remote access for troubleshooting. Troubleshooting usually required a site visit.

I designed a standard of Cisco Meraki MX firewalls sized per site with Aruba Instant On switching and Wi-Fi, had the equipment shipped to each office, and installed it myself on a two-week road trip: replacing the firewall in place, migrating endpoints to the new switches, mounting access points, and confirming the VPN tunnel, printer monitoring, and remote access before leaving each site.

What this enabled

• One dashboard and one policy across every office, with remote troubleshooting that replaced most site visits.
• A site-to-site VPN mesh that later carried the region's move to Teams Phone.
• Central printer monitoring with automatic supply ordering.
• A drop-ship path for the later Meraki firewall refresh.

Managed SD-WAN standardization

I then led a phased move from separate office internet contracts to CommandLink managed SD-WAN, for shared ordering, monitoring, and support while keeping each address's best local carrier. Initial sites were live when I left; the wider rollout was in progress.

• Overlap first. Each new circuit ran beside the old one on the dual-WAN Meraki until throughput, static IP, and voice and alarm lines were validated. Nothing was cancelled before its replacement was proven.
• Time cutovers around contracts. Cutovers followed contract end dates to avoid termination fees, worst connections first. I declined the vendor's two-week install plan in favor of a phased rollout with real validation windows.
• Update access rules. One static IP per site fed Conditional Access named locations, and each cutover carried that site's LAN re-addressing.
• Match capacity to demand. Where fiber wasn't available, measured upload peaks justified a cable product instead of costly dedicated fiber.
• Check cancellations and bills. Cost baselines came from invoices, not the asset system, and each cancellation's real terms were verified and the following bills checked.

The program ran from a Git repository holding the cutover plan, order and decommission trackers, and a risk log used for leadership updates.

Multi-site Remote Desktop Services platform

IT Director · National food brokerage

I designed and deployed Remote Desktop Services at two sites. The primary site separated general sessions from the accounting application, behind a gateway in the DMZ. A smaller regional deployment included browser access for contractors whose networks restricted the Remote Desktop client.

Architecture

• Primary site. Gateway, Connection Broker, Web Access, and Licensing roles split out, with the gateway in the DMZ and both session-host collections on the internal network.
• Regional site. Roles and session host co-located on one server, sized for the smaller user base.
• Client access. The native Remote Desktop client or the HTML5 web client.
• Engineering workstations. Two dedicated workstations tunnel through the primary gateway over RDP without consuming a session-host slot or an RDS CAL.

Security and certificates

• The gateway is isolated from the internal network, with only the required services exposed.
• Connection and resource authorization policies control who can reach the gateway and which internal resources they can then reach.
• Gateway and web-client TLS certificates auto-renew through Certify The Web, using Let's Encrypt with Cloudflare DNS-01 validation.

Operations

• Group Policy governs profile handling, printing, storage, and update behavior on the session hosts.
• Capacity planning is documented per session host, with headroom and scaling options.
• Documentation covers architecture, gateway and session-host configuration, client setup, user management, and troubleshooting for both sites.

Multi-region phone system consolidation on Teams Phone

IT Director · National food brokerage

I led the move from separate regional phone systems to Microsoft Teams Phone with Microsoft Calling Plans. Three regional migrations were complete, giving those teams shared calling, simpler administration, and fewer carrier contracts to manage.

The previous setup

Each part of the business had its own carrier and dial plan: a per-seat hosted PBX in one region, a carrier-hosted voice service in another, a third-party-managed FreePBX deployment in a third where every admin change went through the hosting vendor, and single-site legacy PBXs inherited through acquisition. That meant parallel per-seat contracts, a portal per region, and no cross-region transfer or shared directory.

The standard

Microsoft Calling Plans on the existing tenant rather than Direct Routing, for single-vendor billing and simpler administration. The Teams softphone by default, with desk phones only where the use case requires one. Numbers managed in Teams Admin Center, with a porting partner for cutover windows only. Native auto-attendants and queues, with voicemail groups and after-hours routing standardized per site.

The cutover playbook

1. Discovery: DIDs, fax and after-hours numbers, e911 addresses, fire-alarm and elevator lines, the account holder of record, and an extension-to-user map.
2. Licenses sized to the verified user list, not the inherited seat count.
3. Temporary numbers in the correct area code, with auto-attendants and voicemail tested against them before go-live.
4. Porting in waves: a single-number canary, then the bulk of the DIDs.
5. Wrap-up: fire-alarm cellular failover, elevator-line replacement, and other analog dependencies reprovisioned, then the legacy vendor decommissioned rather than left to auto-renew.

Acquisitions followed the same playbook: telephony mapped during pre-close discovery, a two to three week DID porting lead time in the integration timeline, and the legacy carrier contract cancelled rather than transferred.

Outcomes

• Lower recurring costs by retiring parallel hosted-PBX contracts and consolidating seats under Calling Plans.
• One admin console for numbers, auto-attendants, queues, licensing, and move-add-change work.
• Company-wide directory, extension dialing, presence, transfer, and one softphone client.
• Fewer vendors: fewer carrier relationships, renewals, and billing disputes.

Three-layer observability stack

IT Manager · Regional HVAC business

I built monitoring for servers, networks, storage, and business applications. PRTG handled alerts, while Windows agents and custom collectors sent historical data to InfluxDB for Grafana dashboards.

PRTG as the primary monitor

PRTG monitored network equipment, Hyper-V, domain controllers, SQL Server, storage, and VoIP handsets. Availability and performance alerts helped with troubleshooting, while historical trends informed capacity planning.

Per-role telemetry, not one template

I configured Windows monitoring by server role, so each system reported the measurements relevant to its job. This kept useful signals from getting lost in unrelated alerts.

Writing the collector when none exists

For the Synology NAS, I wrote a bash collector that sent SNMP readings to InfluxDB. It tracked capacity, drive temperature, and disk health for troubleshooting and growth planning. I also wrote collectors for network and HVAC equipment.

Infrastructure and business systems modernization

IT Manager · Regional HVAC business

I owned the technology environment for a regional HVAC business with up to 125 users at peak across three offices and brands, covering infrastructure engineering, business-software implementation, application development, and daily operations.

Two network and server-room builds

I designed and built the infrastructure at the original office, then a complete rebuild for an office relocation, owning the physical work as well as the configuration: Cat6 cabling, rack layout with power and cooling, switching, Wi-Fi, phones, server placement, and a cutover sequenced around dispatch and inbound service calls.

The network used Meraki MX firewalls, Ubiquiti EdgeSwitch switching and PoE, a voice VLAN, site-to-site VPNs linking three offices, and NanoStation point-to-point bridges between buildings instead of trenching. I migrated two sites from UniFi wireless to Aruba Instant On to simplify administration and improve performance, and documented topology, rack layouts, IP allocations, and configurations so a new device, office, or acquired business had a defined implementation path.

Virtualization, identity, and application delivery

I built and refreshed the Hyper-V platform, with redundant domain controllers across hosts plus a branch-office DC, and designed Active Directory, Group Policy, DNS, and DHCP, connected to Entra ID through Entra Connect and Seamless SSO. SQL Server, IIS, and line-of-business applications were delivered through RDS / RemoteApp with RD Gateway, NPS, and signed connection files. When I retired superseded server roles, PowerShell updated saved connections and removed obsolete VPN and printer settings across user profiles.

I migrated email to Exchange Online, administered the Microsoft 365 tenant, standardized business-grade endpoints through domain membership and Group Policy, and managed field and office mobile devices through Meraki Systems Manager.

File services and layered recovery

I built Synology departmental shares with Active Directory group permissions and folder redirection, then migrated user folders to OneDrive Known Folder Move and departmental files to SharePoint, remapping permissions and coordinating cutover and training.

The NAS became a local recovery tier: Veeam Backup & Replication backed up the virtual machines to Synology with an immutable local copy, and Hyper Backup sent encrypted off-site copies to Backblaze B2. A separate off-server copy of the service application's nightly backup used distinct directory groups for the writing and reading systems. I tested file-level recovery, verified off-site contents through the B2 API, alerted on application backup age, size, and readability through PRTG, and documented scope, retention, and recovery.

Monitoring for this environment is covered in the monitoring write-up.

Intune fleet management and proactive remediations

IT Director · National food brokerage

I used Intune and PowerShell to standardize Windows devices across 51 offices, automate setup, and fix recurring problems remotely.

Proactive remediations

Scheduled detection and remediation scripts removed unwanted software, disabled Fast Boot, set printer defaults, and reminded users to restart.

App packaging and provisioning

• Win32 packaging line-of-business apps and OEM utilities packaged as .intunewin for managed deployment, including BIOS password automation.
• Cleanup at scale batch removal of legacy antivirus and inherited agents during onboarding.
• Consistent naming per-division device rename scripts keyed off the hardware serial, so every machine lands on the naming standard automatically.
• Software settings per-division browser bookmark templates and winget/Chocolatey update orchestration to keep software current.