ByteGeist Windows Server / AD Homelab

Forest & Domain

• Forest / Domainad.bytegeist.lab
• NetBIOSBGLAB
• Forest modeWindows2016Forest
• Domain modeWindows2016Domain
• FSMO rolesall held by DC01
• Global CatalogDC01
• DNS zonesad.bytegeist.lab, _msdcs.ad.bytegeist.lab, 3 reverse
• PDC time sourcetime.windows.com (fixed from Local CMOS)

Organizational Units

ad.bytegeist.lab/
├── ByteGeist/
│   ├── Groups
│   ├── Servers
│   ├── Workstations
│   └── Users/
│       ├── HR
│       ├── IT
│       └── Sales
└── Domain Controllers

Lab-created groups

Accounting · Help Desk · HR Employees · IT Employees · Management · Sales Employees · VPN Users

Share IT at C:\Shares\IT

Share-level ACL

NTFS ACL

Hardening note: the inherited BUILTIN\Users entry is broader than the intended IT-only access model. The next ACL change is to disable inheritance and retain only the required administrative and IT group permissions.

How it was verified

PS> Invoke-Command FILE01 {
      Get-SmbShare |
        Where-Object Name -NotIn 'ADMIN$','C$','IPC$' |
        Get-SmbShareAccess
      (Get-Acl C:\Shares\IT).Access
    }

Run from DC01 as a Domain Admin via WinRM, output captured to a transcript on the host (not inside the VM) so no sensitive data lives on a shared share.

Problem: PDC was using the local CMOS clock

The PDC Emulator is the authoritative time source for a Windows forest. If it drifts, Kerberos tickets outside the 5-minute skew window fail — a classic "I can't log in" root cause. w32tm /query /source returned Local CMOS Clock.

w32tm /config /manualpeerlist:"time.windows.com,0x9 pool.ntp.org,0x9 time.nist.gov,0x9" `
      /syncfromflags:manual /reliable:yes /update
Restart-Service W32Time
w32tm /resync /rediscover

Verified: Source: time.windows.com,0x9, Stratum 5.

Problem: stale dcdiag SystemLog failure

A past unexpected shutdown left an entry that dcdiag flagged on every run. I confirmed the stale shutdown event was the source, cleared the lab System log, and re-ran dcdiag /q. In a production workflow, I would export the log before clearing it to preserve evidence.

# Production-safe sequence:
wevtutil epl System C:\Temp\System-before-clear.evtx
wevtutil cl System
dcdiag /q

Verified: dcdiag /q now silent (clean).

Client domain restoration (completed)

WIN11-01's NIC was moved from a bridged physical-LAN adapter to the lab NAT network, DNS was pointed at DC01, and the machine account trust was repaired. Verified domain authentication and DC discovery:

PS> Test-ComputerSecureChannel -Verbose
VERBOSE: The secure channel between the local computer and the domain ad.bytegeist.lab is in good condition.
True
PS> nltest /dsgetdc:ad.bytegeist.lab
DC: \\DC01.ad.bytegeist.lab
Address: \\192.168.31.10
Flags: PDC GC DS LDAP KDC TIMESERV ... DNS_DC DNS_DOMAIN DNS_FOREST
The command completed successfully
PS> whoami
bglab\administrator

Verified: secure channel healthy, DC01 reachable as PDC / GC / KDC / DNS.

Security note: this repair transcript was captured from a built-in Administrator maintenance session. A separate named administrative account and non-privileged daily workstation sign-in are the preferred next hardening step.