Five criteria, written down before anyone touches a Domain Controller.
One site or twenty-five endpoints, fourteen days, and a result you can hold us to because the wording was agreed on day one.
If it fails, you walk and you keep the evidence.
What counts as a pass.
Five statements, marked pass or fail in front of you at the end. Nothing is graded on a curve.
Domain logon from home, with no VPN client
A laptop at somebody's house, on their own broadband, signs in against your Domain Controller. Not a cached credential: an actual authentication before the desktop loads.
Group Policy applies to that machine
gpresult on the remote machine shows your policies applied, from the same objects head office machines get. This is the one that usually breaks on VPN-based setups, because policy needs the Domain Controller reachable before the user signs in.
File shares resolve and open
The mapped drives your users actually use, reachable at the same UNC path they use in the office, with the same permissions deciding who gets in.
RDP with no public port and no port forward
A technician reaches a nominated server over RDP. We then verify from outside that nothing new is listening on your public IP. The port count before and after should be identical.
MFA enforced on the same identity
A time-based one-time code in front of the pilot applications, against the same directory identity, so you are not running a second parallel user database to make the pilot look good.
How the fortnight runs.
Scope and sign-off
Days 1 to 2
We agree the site or endpoint list, name the machines and shares that will be tested, and write the five criteria in the exact wording both sides will judge against. Nothing is installed until this is signed.
Control plane and first nodes
Days 3 to 5
The control plane is stood up on infrastructure you nominate, and the first endpoints join the overlay outbound. No inbound firewall rules are requested. If somebody asks you to open a port, the pilot has gone wrong.
Directory reachability
Days 6 to 9
Domain Controller reachability across the overlay, then domain logon, Group Policy and file share testing from a genuinely remote machine, not one sitting in your office on the corporate LAN.
Identity and access
Days 10 to 12
Single sign-on for the nominated applications, time-based code enforcement, and technician RDP paths. The external port scan is repeated and compared against the day one baseline.
Result
Days 13 to 14
We walk the five criteria in order and mark each one pass or fail in front of you. You get the evidence either way: screenshots, gpresult output, and the before and after port scan.
Who brings what.
What you provide.
- One site, or up to twenty-five endpoints, that you are willing to test on.
- A remote machine on a genuinely external connection.
- Somewhere to run the control plane: your virtual machine, your hypervisor, your call.
- An Active Directory administrator for roughly two hours across the fortnight.
- A nominated server for the RDP test, and two or three file shares.
- The names of the applications you want behind single sign-on.
What we provide.
- The five criteria written down and agreed before we start.
- Deployment and configuration of the control plane and the endpoint agents.
- Overlay design across your sites and subnets.
- External port scan evidence, taken before and after.
- A walkthrough of each criterion with pass or fail marked in front of you.
- Removal of everything we installed, if you decide not to continue.
Before you commit endpoints.
01What happens if the pilot fails
You walk, and you keep the evidence. That is the entire reason the criteria are written down first: it removes our ability to redefine success at the end. Commercial terms are confirmed in writing before the pilot starts, so nothing about the exit depends on goodwill.
02Do you need inbound firewall rules
No. Endpoints establish outbound connections only. We take an external port scan before we start and repeat it at the end specifically so you can prove the exposed surface did not grow. If any part of the design needed an inbound rule, it would not be the design we are selling.
03Do we have to touch the Domain Controllers
We do not modify the Active Directory schema, and we do not require a new forest, domain or trust. The pilot makes your existing Domain Controllers reachable across the overlay. Your policies, organisational units and group structure stay exactly as they are.
04Can we pilot on production endpoints
Most customers do, because a pilot on machines nobody uses proves nothing. Pick a department that will tell you honestly when something is slow. We would rather find a problem in week one on twenty-five real endpoints than in month six on two thousand.
Put it on real endpoints.
Name the site, the machines and the shares. We will write the five criteria with you before anything is installed.