Infrastructure Transformation: Windows Server RDS, Zero Trust & Automation

Overview

For years, the Maryana Group — 10+ retail and distribution branches across two countries — ran on decentralized, unsynchronized desktop databases, expensive hardware VPNs (Sophos, Cyberoam) that dropped connections regularly, and a fragmented security model with no centralized identity management. Every new branch opening meant shipping hardware and manual configuration.

I led a multi-year modernization initiative: centralized all core financial ERPs onto a hardened Windows Server 2019 Remote Desktop Services (RDS) deployment, replaced the hardware VPNs with a Zero Trust mesh network (Tailscale), and added full observability with Prometheus and Grafana.

The results were measurable:

• Cost Reduction: Eliminated roughly $2,500 in annual proprietary hardware support and licensing fees.
• Operational Speed: Cross-branch financial reconciliation time dropped by 30% with synchronized data.
• Reliability: Near 100% uptime for the central Tally Prime ERP, governed by Active Directory RBAC.

---

Timeline of Transformation

The architectural evolution from legacy systems to a monitored Zero Trust network.

---

Phase 1: Identity & Centralization (2019–2020)

The Move to Windows Server Architecture The first priority was establishing a single source of truth for identity and data, replacing the sprawling peer-to-peer workgroups.

• Active Directory Domain Services: Deployed a primary Domain Controller to centralize user authentication across headquarters.
• Security Foundation: Enforced Group Policies (GPOs) covering password complexity, automatic screen lock timeouts, and restrictions on unauthorized USB mass storage devices to prevent data exfiltration.
• File Services: Replaced isolated desktop shares with a centralized DFS (Distributed File System) with NTFS permissions governed by AD security groups.

---

Phase 2: The ERP Migration (2021-2022)

Moving from Onyx to Tally Prime Centralization The highest-risk phase was migrating the core financial engine. The old architecture relied on syncing separate local databases via unreliable batch scripts.

• Architecture: Deployed a Windows Server 2019 host dedicated to Remote Desktop Services (RDS). Using RemoteApp, we streamed Tally Prime to remote branch desktops, making it feel like a local application.
• Storage & Redundancy: Configured bare-metal hardware RAID 1 (mirroring) arrays with enterprise-grade SSDs for IOPS and instant failover on drive failure.
• License Optimization: Set up custom RDS connection brokers and session timeout policies to manage “Tally Virtual User” (TVU) concurrent licenses, preventing licensing bottlenecks during peak retail hours.

Live active Tally Prime streaming sessions managed via the RDS Server Manager console.

---

Phase 3: The Zero Trust Pivot & Visibility (2023)

Replacing Hardware VPNs with Software-Defined Networking Managing site-to-site IPsec tunnels via physical Cyberoam and Sophos edge routers was a logistical challenge. Every new store required shipping hardware and configuring static IPs.

• Tailscale Mesh: I led the migration to a software-defined mesh network using Tailscale. The security perimeter shifted from the network edge to the device itself.
• Granular Access Control: Implemented Tailscale Access Control Lists (ACLs). An inventory scanner at Branch A could only talk to the specific port required by the inventory server, rather than being blindly trusted on the HQ network.
• Eliminated Hardware Costs: Using Tailscale on commodity hardware eliminated the need for expensive annual firewall licensing.

Branch Network Topology

Radial network topology: 10+ branch offices connected via encrypted Tailscale mesh tunnels to the central Muscat HQ, monitored by Prometheus/Grafana.

Deep Observability: Prometheus & Grafana

A distributed infrastructure needs visibility to catch issues before they affect retail checkout lines. I deployed a Linux-based open-source monitoring stack across the Windows and Linux fleet.

• Prometheus: Configured to scrape latency, CPU pressure, and RDS concurrent connection metrics from all nodes via WMI exporters.
• Grafana: Built real-time visual dashboards that trigger webhook alerts when packet loss or tunnel latency exceeds thresholds.

The custom Grafana dashboard tracking sub-millisecond latency and UDP packet health across the international branch network.

---

Engineering Deep Dive: PowerShell Automation

A centralized server generates centralized backups. To prevent “backup bloat” from consuming the RAID SSD array, I wrote PowerShell automation scripts that run via Windows Task Scheduler.

These scripts enforce data retention policies and manage disk space without third-party GUI software.

# Core Logic Snippet: Automated 14-Day Rolling Backup Deletion
$TargetFolder = "D:\Encrypted_Backups\TallyPrime_Daily_Dumps"
$RetentionDays = 14

# Calculate threshold from current system time
$ThresholdDate = (Get-Date).AddDays(-$RetentionDays)

# Isolate files older than exactly 14 days
$OldFiles = Get-ChildItem $TargetFolder -Recurse | 
            Where-Object { $_.LastWriteTime -lt $ThresholdDate }

# Log each deletion and clean up
foreach ($File in $OldFiles) {
    Try {
        $LogEntry = "$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss') | DELETED: $($File.FullName) | Size: $($File.Length / 1MB) MB"
        Write-Output $LogEntry | Out-File "C:\Admin_Logs\BackupCleanup.log" -Append
        Remove-Item $File.FullName -Force -ErrorAction Stop
    } Catch {
        Write-Error "Failed to delete $($File.Name): $_" | Out-File "C:\Admin_Logs\Backup_Errors.log" -Append
    }
}

---

Final Outcome

This transformation shifted the IT department from a reactive cost center into a predictable, strategic business asset.

By modernizing via Tailscale and Windows Server RDS, we ended up with an architecture that is both locked-down (Zero Trust) and fault-tolerant. The centralized ERP lets the executive team pull real-time, cross-border financial reports instantly — something that was impossible under the old decentralized model.