Automation

A Windows image pipeline rebuilt on Packer, hardened at build time

Rebuilt Windows Server image delivery so hardening, directory, network, and CI changes happened through one repeatable build path.

The problem

An enterprise ran its Windows Server lifecycle through a mix of manually built templates and ad hoc PowerShell. Templates drifted between environments, patching depended on manual coordination, and the people who knew the build steps had moved on.

How we worked

  1. Assess. We mapped the existing template build, patching, hardening, directory, network, and CI dependencies. This exposed where manual templates and ad hoc scripts allowed environments to drift.

  2. Codify. We rebuilt the image definitions around Packer and Nutanix AHV. PowerShell provisioners applied hardened defaults, strong cryptography, modern authentication, and NIST and CIS Level 1 baselines during the build.

  3. Operationalize. Active Directory and phpIPAM integrations used their REST APIs so machine names, IP addresses, and DNS records came from the same delivery path as the image build. Patching and vulnerability remediation ran through WSUS, Tenable.io, and PowerShell, while CI moved from Jenkins to GitHub Actions.

  4. Enable. The engineering team received a pull-request workflow on the CI platform it already used. Image definitions, hardening changes, and supporting integrations could be reviewed together instead of relying on the engineers who remembered the manual build.

The outcome

Image refreshes became pull-request changes instead of manual coordination. Hardening moved into the build, while the Active Directory and IPAM integrations reduced the risk of duplicate names and address conflicts during provisioning.