Travel agency network: cloud infrastructure with RDS, Zero Trust and SIEM

A travel agency network with five branches — four in Moldova and one in Romania — moved its server infrastructure into our cloud and handed its operation to our team. Travel is seasonal: the load peaks in high-demand windows when managers are simultaneously working in the booking system, in messaging, on the file shares and on the phone with clients. Infrastructure downtime in those windows means direct revenue loss and broken reservations.

Before the migration, the infrastructure was scattered: some on-site, some at local providers, with no unified SLA, no shared identity across branches and no centralised picture of security. For staff in Romania and for those frequently working remotely, connectivity was both inconvenient and unsafe.

The job — build a single corporate IT environment in the cloud, support all ~60 staff working concurrently, deliver convenient and secure access from inside the offices and from anywhere outside, and meet audit and security requirements through centralised event collection.

Migrate servers into our cloud and design a unified access and security architecture for 5 branches from scratch:

• Cloud server hosting in our infrastructure, with our own SLA, backups and monitoring — no dependency on hardware in the offices.
• Unified identity via Active Directory for all ~60 employees, common policies and Group Policy for session configuration.
• Terminal services farm — three RDS servers behind a Connection Broker, load balancing and resilience to a single-node outage.
• File server with role-based access by branch and department, snapshots and regular backups.
• 1C server next to the RDS farm — minimal client-database latency, ongoing maintenance, restore drills.
• Hybrid access for staff: from offices — via a secured channel; remotely — via Zero Trust VPN or a web portal with two-factor authentication, no VPN client required.
• SIEM across every server — centralised security event collection, alerting and audit.

Cloud platform

All client servers are hosted in our cloud. That delivers a predictable SLA, transparent resources (CPU/RAM/disks), snapshots and network isolation. The links between servers and offices run on redundant fibre — important during peak season.

Active Directory

A dedicated corporate domain was rolled out. AD is the single source of truth for accounts: one login gives an employee access to terminal sessions, file shares, 1C and the web portal. GPOs distribute standard session settings, password policies, and restrictions on launching unapproved software.

RDS farm with Connection Broker

Three terminal servers are joined into a single farm with an RDS Connection Broker in front. On login, the Broker routes the user to the least-loaded node; if any of the three servers goes down, sessions redistribute across the remaining ones without taking the farm out of service. Current capacity is around 60 concurrent users; scaling out means adding a node, with no client-side change.

File server and 1C

The file server holds shared folders with branch- and department-level permissions, regular snapshots and an independent copy in our centralised backup repository. The 1C server is sized for load; scheduled maintenance (integrity tests, reindexing, temp-table cleanup) runs on a schedule, and database backups are verified by restore.

Access from offices and outside

Staff connect in three ways depending on context:

• From the offices — directly to the farm over a secured channel between office and cloud.
• From outside via Zero Trust VPN — a client that verifies device posture and connection context; access is granted per application, without exposing the entire internal network.
• Via a web portal with 2FA — browser portal with two-factor authentication. Convenient for short connections from a borrowed device or a tablet, without installing a VPN client.

SIEM and audit

Domain controllers, RDS nodes, the file server, the 1C server and edge access services all feed into a central SIEM. Security events are collected — logins, group changes, file access attempts, anomalous sessions. Critical events alert the on-duty rotation. This produces a real — not paper — picture of security and meets audit requirements for handling client personal data.

Outcome

• 60 concurrent users across five branches in Moldova and Romania work on a single infrastructure under one SLA.
• Noticeable speed-up compared to the previous fragmented setup: a terminal session with 1C on the same platform removes client-server latencies over WAN.
• Secure hybrid access — office, remote, web with 2FA — without exposing more than necessary outside.
• Full audit via SIEM across every server and every entry point, ready for inspections and incident response.
• Painless scaling: the farm grows by adding a node, the file and 1C servers grow by upping VM resources, with no client-side changes.