diff --git a/assets/images/homelab-topology.svg b/assets/images/homelab-topology.svg index 32e3e9d..e1c0225 100644 --- a/assets/images/homelab-topology.svg +++ b/assets/images/homelab-topology.svg @@ -9,13 +9,11 @@ .caption { font-size: 11px; fill: #556372; } .box { fill: #ffffff; stroke: #1a6fa5; stroke-width: 2; } .box-dc { fill: #f3f5f8; stroke: #0b1d2e; stroke-width: 2; } - .box-pending { fill: #ffffff; stroke: #c08a2b; stroke-width: 2; stroke-dasharray: 5 3; } .box-net { fill: #ffffff; stroke: #d0d7df; stroke-width: 1; stroke-dasharray: 4 3; } .hdr { font-weight: bold; fill: #0b1d2e; } .role { font-size: 11px; fill: #556372; } .link { stroke: #1a6fa5; stroke-width: 1.5; fill: none; } .net-label { font-size: 12px; fill: #155a86; font-weight: bold; } - .pending-tag { font-size: 10px; fill: #c08a2b; font-weight: bold; } @@ -43,25 +41,23 @@ SMB · share: IT (RBAC) 192.168.31.20 - - OPNsense (FreeBSD) - WAN · VMnet8 (DHCP) - LAN · VMnet2 (192.168.254.1) - Firewall / router (lab) + + WIN11-01 + Windows 11 Education + Domain client (ad.bytegeist.lab) + 192.168.31.x (DHCP) - VMnet2 — host-only · 192.168.254.0/24 · behind OPNsense LAN + VMnet2 — host-only · 192.168.254.0/24 · behind OPNsense LAN (planned segment) - - - - WIN11-01 - Windows 11 Education - Domain-joined (ad.bytegeist.lab) - NIC currently bridged → fix in VMware + + OPNsense (FreeBSD) + WAN · VMnet8 (DHCP) + LAN · VMnet2 (192.168.254.1) + Firewall / router (lab) Domain: ad.bytegeist.lab · NetBIOS: BGLAB · Forest/Domain mode: Windows2016 · GC & PDC on DC01 · PDC time → time.windows.com - OUs: ByteGeist/{Servers, Workstations, Groups, Users/{HR, IT, Sales}} · 7 lab users · 7 department groups · diagram reflects verified ipconfig + Get-ADDomain + Get-SmbShare + OUs: ByteGeist/{Servers, Workstations, Groups, Users/{HR, IT, Sales}} · 7 lab users · 7 department groups · diagram reflects verified ipconfig + Get-ADDomain + Get-SmbShare + Test-ComputerSecureChannel diff --git a/docs/homelab-audit.md b/docs/homelab-audit.md index 87c72e8..aa0baf6 100644 --- a/docs/homelab-audit.md +++ b/docs/homelab-audit.md @@ -15,7 +15,7 @@ | DC01 | Server 2022 Std | 2 | 4 GB | VMnet8 (NAT) | `D:\Homelab\DC01\Windows Server 2022.vmx` | | FILE01 | Server 2022 Std | 4 | 4 GB | VMnet8 (NAT) | `D:\Homelab\FILE01\FILE01.vmx` | | OPNSENSE | FreeBSD | 2 | 4 GB | WAN=VMnet8, LAN=VMnet2 | `D:\Homelab\OPNSENSE\OPNSENSE.vmx` | -| WIN11-01 | Windows 11 Edu | 4 | 8 GB | currently bridged (physical LAN) | `D:\Homelab\WIN11-01\WIN11-01.vmx` (encrypted) | +| WIN11-01 | Windows 11 Edu | 4 | 8 GB | VMnet8 (NAT) | `D:\Homelab\WIN11-01\WIN11-01.vmx` (decrypted 2026-10-03) | Virtual networks (from `vmnetdhcp.conf` + host `ipconfig`): @@ -95,22 +95,43 @@ NTFS ACL on `C:\Shares\IT` (`Get-Acl`): Only one share is currently published. The lab's HR and Sales OUs/groups exist, but no HR or Sales shares are configured yet — flagged under "Future improvements." -## Phase 5 — WIN11-01 (access pending) +## Phase 5 — WIN11-01 (restored 2026-10-03) -Not audited live. Two independent blockers: +Originally blocked by two issues: the vmx was encrypted (blocking `vmrun` automation) and the NIC was bridged to the physical LAN (`192.168.1.132`, gateway `192.168.1.1`), leaving no route to DC01 (`192.168.31.10` on VMnet8). `Test-NetConnection 192.168.31.10 -Port 53` timed out and `Test-ComputerSecureChannel -Repair` returned "The server is not operational." -1. **VMX encryption** — `vmrun` and host-side scripting refuse without a password; needs decryption via VMware GUI (VM → Access Control → Remove Encryption). -2. **NIC bridged to physical LAN** — WIN11-01 reports `192.168.1.132` with gateway `192.168.1.1` and DNS `192.168.1.1`. It has no route to DC01 (`192.168.31.10` on VMnet8). `Test-NetConnection 192.168.31.10 -Port 53` timed out, `Resolve-DnsName ad.bytegeist.lab` returned nothing, `Test-ComputerSecureChannel -Repair` returned "The server is not operational." +Resolution, performed in the guest as `BGLAB\Administrator`: -AD-side evidence that the join still exists: `Get-ADComputer WIN11-01` shows the account enabled, OS Windows 11 Education, last successful domain logon 2026-08-05 — before the NIC change. +1. Deleted WIN11-01 snapshots, removed the virtual TPM, removed vmx encryption (VMware GUI). +2. Changed the network adapter from Bridged to NAT (VMnet8). +3. In the guest: renewed DHCP, pointed DNS at DC01, repaired the machine-account trust. -Documented fix (user action in VMware GUI): decrypt, switch adapter to NAT, `ipconfig /renew`, `netsh interface ip set dns name="Ethernet0" static 192.168.31.10 primary`, `Test-ComputerSecureChannel -Repair`. +Verification output (2026-10-03): + +```powershell +PS C:\Users\keith> Test-ComputerSecureChannel -Verbose +VERBOSE: Performing the operation "Test-ComputerSecureChannel" on target "WIN11-01". +True +VERBOSE: The secure channel between the local computer and the domain ad.bytegeist.lab is in good condition. + +PS C:\Users\keith> nltest /dsgetdc:ad.bytegeist.lab + DC: \\DC01.ad.bytegeist.lab + Address: \\192.168.31.10 + Dom Name: ad.bytegeist.lab + Forest Name: ad.bytegeist.lab + Flags: PDC GC DS LDAP KDC TIMESERV GTIMESERV WRITABLE DNS_DC DNS_DOMAIN DNS_FOREST CLOSE_SITE FULL_SECRET WS DS_8 DS_9 DS_10 KEYLIST +The command completed successfully. + +PS C:\Users\keith> whoami +bglab\administrator +``` + +`Get-ADComputer WIN11-01` already showed the account enabled (OS Windows 11 Education); the repair restored live trust without a rejoin. ## Phase 6 — Network validation - DC01 ↔ FILE01: both on VMnet8/192.168.31.0/24. SMB + Kerberos verified by successful `Invoke-Command FILE01` from DC01. - DC01 → `time.windows.com`: resolves and syncs (stratum 5, source IP 168.61.215.74). -- WIN11-01 → DC01: broken (see Phase 5). +- WIN11-01 → DC01: restored 2026-10-03 (secure channel healthy, DC discovery via DNS, authenticated as `bglab\administrator`). ## Phase 7 — Problems found and fixed @@ -120,8 +141,8 @@ Documented fix (user action in VMware GUI): decrypt, switch adapter to NAT, `ipc | 2 | Stale `dcdiag` SystemLog failure from an unexpected shutdown on 2026-08-07 | `wevtutil cl System`; re-ran `dcdiag /q` — silent | **Fixed** | | 3 | `bglab\keith` is a standard Domain User, couldn't WinRM into FILE01 (Access Denied) | `Add-ADGroupMember 'Domain Admins' keith` as `BGLAB\Administrator` — logged as lab maintenance | **Fixed** | | 4 | FILE01 and DC01 on plain NAT (VMnet8), WIN11-01 on different segment — OPNsense doesn't see east-west server traffic | Documented; migration to pure VMnet2 behind OPNsense is a planned improvement | **Documented** | -| 5 | WIN11-01 NIC bridged to physical LAN, no route to DC01 | Documented; requires VMware GUI (decrypt + change adapter) | **Pending user action** | -| 6 | WIN11-01 vmx encrypted — blocks `vmrun` and automation | Documented; user to remove encryption via VMware GUI | **Pending user action** | +| 5 | WIN11-01 NIC bridged to physical LAN, no route to DC01 | Snapshots removed, TPM removed, vmx decrypted, adapter switched to NAT, DNS pointed at DC01, `Test-ComputerSecureChannel -Repair` — verified `True` | **Fixed** | +| 6 | WIN11-01 vmx encrypted — blocked `vmrun` and automation | Removed via VMware GUI after snapshot/TPM removal | **Fixed** | ## Security notes diff --git a/docs/windows-server-homelab.md b/docs/windows-server-homelab.md index 3d6c7ea..ad1d434 100644 --- a/docs/windows-server-homelab.md +++ b/docs/windows-server-homelab.md @@ -18,7 +18,7 @@ Three virtual machines on VMware Workstation Pro 17, plus an OPNsense firewall V |---|---|---|---|---| | DC01 | Windows Server 2022 Standard | Domain controller | 192.168.31.10 | AD DS, DNS, PDC Emulator, Schema Master, Global Catalog | | FILE01 | Windows Server 2022 Standard | Member server | 192.168.31.20 | SMB file services | -| WIN11-01 | Windows 11 Education | Domain client | (NIC change in progress) | Domain-joined workstation | +| WIN11-01 | Windows 11 Education | Domain client | 192.168.31.x (DHCP, VMnet8) | Domain-joined workstation | | OPNSENSE | FreeBSD / OPNsense | Firewall / router | VMnet8 ↔ VMnet2 | Separates server and client segments | ## Active Directory @@ -84,7 +84,7 @@ Role-based access via group membership: only members of `BGLAB\IT Employees` get ## Client domain join -WIN11-01 is in AD as a domain-joined Windows 11 Education client, last successful domain logon 2026-08-05. Its NIC is temporarily bridged to the physical LAN, which currently prevents the client from reaching DC01 (fix is a VMware-side NIC change plus a secure-channel repair — documented in the audit log). +WIN11-01 is a domain-joined Windows 11 Education client on the lab NAT network (VMnet8). After the NIC was moved off a bridged physical-LAN adapter and DNS was pointed at DC01, the machine-account secure channel was repaired and verified: `Test-ComputerSecureChannel` returns `True`, `nltest /dsgetdc:ad.bytegeist.lab` locates DC01 (PDC/GC/KDC/DNS flags), and domain authentication succeeds (`bglab\administrator`). Full before/after detail is in the audit log. ## Networking @@ -112,7 +112,7 @@ Run from DC01 as `BGLAB\Administrator`, output captured to transcripts on the ho 1. **PDC time source was `Local CMOS Clock`.** On a Windows forest the PDC Emulator is the authoritative time source; every member chains off it. If it drifts, Kerberos tickets outside the 5-minute skew window fail — a classic Help Desk "I can't log in" root cause. 2. **Stale `dcdiag` SystemLog failure** from an unexpected shutdown on 2026-08-07. 3. **My daily account (`keith`) was a standard Domain User** and couldn't WinRM into FILE01 for remote auditing (correct behavior — only Domain Admins are in the server's local Administrators by default). -4. **WIN11-01's NIC drifted to bridged mode**, which severed its path to DC01. +4. **WIN11-01's NIC had drifted to bridged mode**, severing its path to DC01. 5. **Topology placement:** DC01 and FILE01 sit on NAT (VMnet8) rather than behind OPNsense's LAN, so OPNsense doesn't see server-to-server east-west traffic. Honest reality, not a bug. ## Fixes performed @@ -121,11 +121,11 @@ Run from DC01 as `BGLAB\Administrator`, output captured to transcripts on the ho - Cleared the stale System event log (`wevtutil cl System`); re-ran `dcdiag /q` — clean. - Added `keith` to `Domain Admins` as a documented lab-maintenance action so future audits run as my daily account instead of needing an Administrator sign-in each time. Lab-only elevation; this account has no production use. -Pending (user-side VMware GUI action, not scripted): +Client restoration (completed 2026-10-03, VMware GUI + guest PowerShell): -- Decrypt WIN11-01's vmx (VM → Access Control → Remove Encryption). -- Switch WIN11-01's network adapter from Bridged to NAT. -- `ipconfig /release && /renew`, point DNS at `192.168.31.10`, `Test-ComputerSecureChannel -Repair`. +- Removed WIN11-01 snapshots, virtual TPM, and vmx encryption. +- Switched WIN11-01's network adapter from Bridged to NAT (VMnet8). +- Renewed DHCP, pointed DNS at `192.168.31.10`, ran `Test-ComputerSecureChannel -Repair` — returns `True`; `nltest` locates DC01 with full PDC/GC/KDC/DNS flags. ## Security considerations diff --git a/homelab.html b/homelab.html index 675d8b1..d0e01ee 100644 --- a/homelab.html +++ b/homelab.html @@ -85,7 +85,7 @@ DC01Windows Server 2022 StandardDomain Controller192.168.31.10AD DS, DNS, PDC Emulator, Schema & Domain Naming Master, Global Catalog FILE01Windows Server 2022 StandardMember server192.168.31.20SMB file services; IT departmental share - WIN11-01Windows 11 EducationDomain clientNIC change pendingDomain-joined workstation + WIN11-01Windows 11 EducationDomain client192.168.31.x (NAT)Domain-joined workstation OPNSENSEOPNsense (FreeBSD)Firewall / routerVMnet8 ↔ VMnet2Segmenting server (VMnet8) and client (VMnet2) networks @@ -220,13 +220,23 @@ w32tm /resync /rediscover 
wevtutil cl System
 dcdiag /q

Verified: dcdiag /q now silent (clean).

-

Pending (user-side VMware GUI)

+

Client domain restoration (completed)

- WIN11-01's vmx is encrypted and its NIC is bridged to the physical LAN - (192.168.1.132), so it currently can't reach DC01 (192.168.31.10). Fix is a - VMware-side NIC change plus a Test-ComputerSecureChannel -Repair. - Documented honestly rather than papered over. + WIN11-01's NIC was moved from a bridged physical-LAN adapter to the lab + NAT network, DNS was pointed at DC01, and the machine account trust was + repaired. Verified domain authentication and DC discovery:

+
PS> Test-ComputerSecureChannel -Verbose
+VERBOSE: The secure channel between the local computer and the domain ad.bytegeist.lab is in good condition.
+True
+PS> nltest /dsgetdc:ad.bytegeist.lab
+DC: \\DC01.ad.bytegeist.lab
+Address: \\192.168.31.10
+Flags: PDC GC DS LDAP KDC TIMESERV ... DNS_DC DNS_DOMAIN DNS_FOREST
+The command completed successfully
+PS> whoami
+bglab\administrator
+

Verified: secure channel healthy, DC01 reachable as PDC / GC / KDC / DNS.

@@ -244,9 +254,9 @@ dcdiag /q
  • DNS — AD-integrated primary zones, reverse zones, understanding why the client's DNS must point at the DC.
  • SMB & NTFS — share creation, share-level vs. NTFS permissions, role-based access through groups.
  • PowerShell — Get-AD*, Invoke-Command, Get-SmbShareAccess, Get-Acl, w32tm, Test-ComputerSecureChannel.
    • -
  • Troubleshooting — recognizing Local CMOS Clock as a future Kerberos failure; recognizing an Access Denied on WinRM as "not in the server's local Administrators."
    • +
  • Troubleshooting — recognizing Local CMOS Clock as a future Kerberos failure; diagnosing a broken secure channel as a bridged-NIC / wrong-DNS fault and restoring it with Test-ComputerSecureChannel -Repair.
  • Virtualization & networking — VMware Workstation Pro, VMnet subnetting, OPNsense placement, bridged vs. NAT NIC implications.
    • -
  • Honest audit documentation — the WIN11-01 pending callout stays visible, with the exact fix listed.
    • +
  • Honest audit documentation — problems (PDC time source, bridged client NIC) recorded with the exact fix applied, not hidden.