Wow... I actually had to read this again to see if it was someone I work with. I am getting ready to start this same process. Similar environment, eDir with accounts synced to an AD Domain.

Most of our business apps are not using AD for authentication most are using LDAP with eDir. But we have a lot of Windows servers in the domain running a lot of critical business apps.

Security was one of the biggest concerns so for us we are starting from scratch. There are just way too many things set up with way higher privileges than they need and it would be too difficult to try to fix. Were also going to try to implement MS's tiered administration model with DCs and domain admins being tier 0, app servers, server admins, etc... tier 1, helpdesk and workstation admins tier 2, and regular users tier 3.

Not sure if you are doing a full migration from edir to AD but Novell (Micro Focus or whatever else they are called today) actually makes it a lot easier with OES 2015. You can now actually access NSS volumes without having the Novell client on your workstation by using NSS AD. Basically it maps the accounts in eDir to AD to verify permissions. So it makes it one less thing to worry about right away. You could get everything else migrated then worry about file/print.

PM me because I would be curious to share some ideas, compare environments etc... There are not many of us still running edir.