The problem
The broker was running its Windows Server lifecycle through a mix of manually-built VMware templates and ad-hoc PowerShell. Templates drifted between environments. Patching was opportunistic. A new base image took weeks of coordination because the people who knew the build steps had moved on.
The approach
I rebuilt the image pipeline around Packer and Nutanix AHV with Jenkins driving the builds. Templates became code. PowerShell provisioners applied hardened defaults: strong cryptography, modern authentication, and NIST and CIS Level 1 baselines at build time, so no machine left the pipeline unhardened.
Application teams got a separate hardened base image on the same Nutanix cluster, so provisioning started from a repeatable, secured template instead of a manually maintained server build.
Integration scripts wrapped Active Directory and phpIPAM through their REST APIs so machine names, IPs, and DNS records came from the same source of truth as the build. A custom wrapper around Nutanix MOVE handled inbound VM migrations from the legacy estate.
Patching and vulnerability remediation moved onto WSUS, Tenable.io, and PowerShell, all driven from the same pipeline.
Late in the engagement I migrated the Jenkins pipelines to GitHub Actions to consolidate CI on the platform the engineering teams already used.
The outcome
Image refresh cycles dropped from weeks of coordination to a PR. Hardening became a build-time guarantee instead of a future ticket. The IPAM and AD integration killed the most common provisioning failure: duplicate names and address conflicts.