//Eddie Brinton-Quinn ghostwire

Every application installer the department used lived on an ageing file share, and that file share was being decommissioned to a date set by somebody else. The deadline was not negotiable and the fallback did not exist: when the share went, routine software delivery went with it.

What was actually being replaced

The obvious response was to move the installers somewhere else. That would have met the deadline and preserved everything wrong with the arrangement.

What the file share really provided was not storage but a workflow: a user raised a ticket, an engineer attended, an engineer ran an installer. The storage was incidental. Manual installation for routine software generated ticket volume that existed only because the mechanism required a human, and because each site had arrived at its own habits, the same request was handled differently depending on where it was raised - which made support harder to standardise and made drift between sites invisible until somebody went looking.

So the migration was scoped as a change of model rather than a change of location. Applications were catalogued, packaged, and published to scoped groups in the endpoint management platform, delivered to users on demand through the self-service portal. A second cloud location held authorised binaries for the cases that genuinely needed a file rather than a package. One site had already been working this way; that model was adapted and applied across the department rather than reinvented.

The trade

Removing the engineer from the install path removes the informal check that engineer represented. Nobody had written that check down, but it was real: a person who would notice a request that looked wrong.

Replacing it with scoped assignment converts a frequent small cost into a rare large one. A mis-scoped group does not inconvenience one user, it delivers the wrong software to everyone in it, and a badly packaged application published widely is an incident rather than a ticket. That is a worse failure mode in blast radius and a better one in frequency, and the exchange is only worth making if scoping and packaging are treated as the control they have now become.

Agreement was the work

The technical migration was the smaller half. The endpoint management estate was owned by another team, the distribution paths needed security approval, and the decommissioning date belonged to a third group - so the work was mostly securing alignment between teams that did not routinely coordinate, on a change none of them owned end to end.

That is also where the residual risk sat. A delivery model split across team boundaries fails at the boundary, not in the middle, and the failure shows up in both estates at once. Getting the packaging standard and the group scoping agreed explicitly, rather than assumed, was the part that made the rest safe to switch on.

Outcome

The legacy dependency was retired before its deadline rather than at it. Routine software delivery became self-service across every site on one model, manual intervention for standard installs stopped being the default path, and software distribution moved onto the same cloud-first direction the wider organisation was already committed to.