The project's client is a large international manufacturing company specializing in the production of medical devices and consumables for healthcare institutions.The organization's Russian division provides supplies and service support throughout the country, including to medical centers, clinics, and pharmacy chains.
In 2022, due to geopolitical changes, the company decided to spin off its Russian division into a separate legal entity. This required the creation of a completely independent IT infrastructure, unconnected to the parent organization's global services.A critical challenge was that, until this point, the Russian office had been fully relying on the global division's IT services: mailboxes were hosted in the Microsoft M365 cloud, the server infrastructure was deployed on VMware and maintained by the global IT service, and network management and system access were handled by international colleagues.
Any delay in creating its own infrastructure risked disrupting business processes for 300 users in Russia.
Key Challenges
- Create an independent core IT infrastructure for the Russian division from scratch, including:
- Deploy a new MS Exchange-based email system and migrate mailboxes from the Microsoft cloud
- Migrate file servers and application servers from the on-premises VMware infrastructure to the Russian cloud
- Replace the VMware virtualization system with a Russian solution
- Create a new Windows 11 image for user devices and organize the migration of workstations to the new domain
- Implement Russian information security tools
- Provide support for user services
- Configure a monitoring system and backup
Implemented our solution
- The project began in April–May 2025 and took approximately 8–9 months. The ICL Services team included up to 50 specialists covering 20 technology areas, each with its own architect and two engineers.
Stage 1. Architecture Design and Approval
The work began with a concept presentation to the client's Russian IT department. After winning the tender, a more complex stage followed—a presentation of the solution to the global office in English.
The challenge lay in the fact that the client was accustomed to foreign products and did not want to change the user experience. The ICL Services team managed to convince the global office of the optimality of the proposed architecture, which included a hybrid approach: retaining foreign solutions where they were critical for users, and replacing them with Russian equivalents in other cases.
Stage 2. Requirements Gathering and Design
After agreeing on the architecture, each of the 20 streams began detailed information gathering: teams worked with the client, submitted and completed questionnaires, and compiled requirements for technical documentation. Based on the collected data, designs and project documentation were developed for each area.
Stage 3. Creating the Core Cloud Infrastructure
The primary task was to create the "core" of the new infrastructure, completely independent of global services. The Russian cloud platform Cloud4U was selected for the core infrastructure based on price and quality criteria.
The following were deployed in the cloud:
- Microsoft Windows-based Active Directory, DNS, DHCP, Certification, PKI, and Radius
- MS Exchange email system for 300 users
- Windows-based file servers
- VPN services for remote employees
Stage 4. Mailbox Migration
The most challenging task was migrating approximately 300 mailboxes from the Microsoft M365 cloud to an on-premises Exchange server. Standard automation tools, available until 2022, stopped working in Russia. Using EDB Mails, an automated migration was configured, and all mailboxes were transferred to the new Exchange server.
Stage 5. Server Migration to the Cloud and Replacing VMware with Zvirt
The next step was migrating the on-premises servers running VMware: file servers and application servers. Using VMware tools, the team migrated them to the Cloud4U cloud.
After the migration was complete, the hypervisor was replaced with Zvirt from Orion Soft. The migration was completed in stages on the two physical hosts that previously ran VMware.
Stage 6. Creating a Local Site in the Moscow Region
The customer had an additional requirement: ensuring the availability of critical services even in the event of a cloud outage. To this end, local servers were deployed at the production site, redundant for core services and several critical business applications.
This ensured that even if the cloud was unavailable, the most critical production services would continue to operate locally.
Stage 7. Implementing the Workstation Management System
In parallel with the infrastructure work, the team prepared the user interface. The customer had laptops running a Windows 10 image managed by "globals." The task was complicated by the fact that the customer wanted to not only migrate devices to a new domain, but also upgrade to a new OS version – Windows 11.
The ICL Services team analyzed the current device and application configuration, created a new Windows 11 image completely independent of the global office, prepared approximately 40 application packages and driver packs for all customer device models, and used our proprietary Kolibri-ARM tool to create automated installation scripts that standardized the deployment process.
After migrating to the new domain, the Kolibri-ARM agent was installed on all devices for centralized application management and update installation.
Stage 8. Information Security
Infrastructure security was built on three key solutions:
- IDECO firewalls were deployed in three locations, and the customer later initiated the implementation of network microsegmentation using this solution across all locations.
- Kaspersky-based antivirus protection (KES for workstations and servers, KSMG for email services)
- Multifactor authentication (MFA) — since most users work remotely, a solution based on Microsoft ADFS, integrated with a Russian cloud MFA service, was implemented.
Stage 9. Backup and Monitoring
To ensure fault tolerance, the following were implemented:
- Cloud backup of virtual machines using the integrated Cloud4U cloud service.
- CyberBackup for backup of virtual machines on-premises in Domodedovo.
- Zabbix monitoring system for monitoring the status of the entire infrastructure.
Stage 10. ITSM system implementation
For incident reception and processing, the Russian ITSM system from Elma was implemented instead of the global ServiceNow system. User ticket processing processes were integrated into it.
Stage 11. Workstation Migration
The final stage was the migration of 270 workstations to the new domain and installation of a Windows 11 image. The process took place in waves from August to November 2025, with 10-15 computers migrated per day.
ICL Services engineers visited the customer's site to assist with the migration and reinstallation of the system. This phased approach allowed us to avoid disruption to business processes and promptly resolve any issues that arose.
Stage 12. Complete Separation from the Global Network
On the appointed day, the company completely disconnected the Russian office infrastructure from its networks, and the ICL Services team assumed control of all network devices: switches, routers, Wi-Fi access points, and controllers. From that moment on, the Russian division became completely independent from the global IT infrastructure.
Products and technologies
- Cloud4U Cloud Infrastructure
- Microsoft Windows Server, Windows 11
- Virtualization on Zvirt
- Microsoft Exchange Mail Server
- Yandex 360 Collaboration Services
- Network Security on IDECO NGFW
- Antivirus Protection: Kaspersky Endpoint Security, Kaspersky Secure Mail Gateway
- Device Management via Kolibri-ARM, Safe Mobile (MDM)
- Backup via CyberBackup, Cloud4U's Built-in Backup
- Monitoring on Zabbix
- ITSM System: Elma365
- Mail Migration via EDB Mails
- Multifactor Authentication: Microsoft ADFS + Russian Cloud MFA Solution
Results
- All services were deployed in parallel with the existing global infrastructure, eliminating any disruption to business processes.
- Maintaining the familiar user experience—employees continue to work with familiar interfaces and services; critical changes were implemented seamlessly.
- Migration of 270 workstations to a new domain with Windows 11 installation.
- Migration of up to 300 mailboxes from M365 to our own Exchange.
- Migration of 150 mobile devices managed by Safe Mobile.
- Deployment of approximately 40 servers in cloud and on-premises infrastructure.
- Ensuring information security for the entire infrastructure using Russian solutions.
- Fault tolerance for critical services—duplication of the core infrastructure in the MO guarantees production availability even if the cloud is unavailable.
- All services are supported by ICL Services.