WIN11-01 restored: secure channel verified True, DC discovery via nltest, domain auth as bglab\administrator. Topology diagram and docs updated; pending callouts removed.

assets/images/homelab-topology.svg

@@ -9,13 +9,11 @@
       .caption { font-size: 11px; fill: #556372; }
       .box { fill: #ffffff; stroke: #1a6fa5; stroke-width: 2; }
       .box-dc { fill: #f3f5f8; stroke: #0b1d2e; stroke-width: 2; }
-      .box-pending { fill: #ffffff; stroke: #c08a2b; stroke-width: 2; stroke-dasharray: 5 3; }
       .box-net { fill: #ffffff; stroke: #d0d7df; stroke-width: 1; stroke-dasharray: 4 3; }
       .hdr { font-weight: bold; fill: #0b1d2e; }
       .role { font-size: 11px; fill: #556372; }
       .link { stroke: #1a6fa5; stroke-width: 1.5; fill: none; }
       .net-label { font-size: 12px; fill: #155a86; font-weight: bold; }
-      .pending-tag { font-size: 10px; fill: #c08a2b; font-weight: bold; }
     </style>
   </defs>
 
@@ -43,25 +41,23 @@
   <text x="440" y="268" class="role" text-anchor="middle">SMB · share: IT (RBAC)</text>
   <text x="440" y="286" class="role" text-anchor="middle">192.168.31.20</text>
 
-  <rect x="620" y="210" width="240" height="90" class="box"/>
+  <rect x="570" y="210" width="200" height="90" class="box"/>
-  <text x="740" y="232" class="hdr" text-anchor="middle">OPNsense (FreeBSD)</text>
+  <text x="670" y="232" class="hdr" text-anchor="middle">WIN11-01</text>
-  <text x="740" y="250" class="role" text-anchor="middle">WAN · VMnet8 (DHCP)</text>
+  <text x="670" y="250" class="role" text-anchor="middle">Windows 11 Education</text>
-  <text x="740" y="268" class="role" text-anchor="middle">LAN · VMnet2 (192.168.254.1)</text>
+  <text x="670" y="268" class="role" text-anchor="middle">Domain client (ad.bytegeist.lab)</text>
-  <text x="740" y="286" class="role" text-anchor="middle">Firewall / router (lab)</text>
+  <text x="670" y="286" class="role" text-anchor="middle">192.168.31.x (DHCP)</text>
 
   <line class="link" x1="490" y1="136" x2="490" y2="168" marker-end="url(#arrow)"/>
 
   <rect x="60" y="400" width="860" height="150" class="box-net"/>
-  <text x="78" y="420" class="net-label">VMnet2 — host-only · 192.168.254.0/24 · behind OPNsense LAN</text>
+  <text x="78" y="420" class="net-label">VMnet2 — host-only · 192.168.254.0/24 · behind OPNsense LAN (planned segment)</text>
 
-  <line class="link" x1="740" y1="300" x2="740" y2="398" marker-end="url(#arrow)"/>
+  <rect x="620" y="440" width="240" height="90" class="box"/>
-
+  <text x="740" y="462" class="hdr" text-anchor="middle">OPNsense (FreeBSD)</text>
-  <rect x="380" y="440" width="220" height="90" class="box-pending"/>
+  <text x="740" y="480" class="role" text-anchor="middle">WAN · VMnet8 (DHCP)</text>
-  <text x="490" y="462" class="hdr" text-anchor="middle">WIN11-01</text>
+  <text x="740" y="498" class="role" text-anchor="middle">LAN · VMnet2 (192.168.254.1)</text>
-  <text x="490" y="480" class="role" text-anchor="middle">Windows 11 Education</text>
+  <text x="740" y="516" class="role" text-anchor="middle">Firewall / router (lab)</text>
-  <text x="490" y="498" class="role" text-anchor="middle">Domain-joined (ad.bytegeist.lab)</text>
-  <text x="490" y="516" class="pending-tag" text-anchor="middle">NIC currently bridged → fix in VMware</text>
 
   <text x="60" y="590" class="caption">Domain: ad.bytegeist.lab · NetBIOS: BGLAB · Forest/Domain mode: Windows2016 · GC &amp; PDC on DC01 · PDC time → time.windows.com</text>
-  <text x="60" y="606" class="caption">OUs: ByteGeist/{Servers, Workstations, Groups, Users/{HR, IT, Sales}} · 7 lab users · 7 department groups · diagram reflects verified ipconfig + Get-ADDomain + Get-SmbShare</text>
+  <text x="60" y="606" class="caption">OUs: ByteGeist/{Servers, Workstations, Groups, Users/{HR, IT, Sales}} · 7 lab users · 7 department groups · diagram reflects verified ipconfig + Get-ADDomain + Get-SmbShare + Test-ComputerSecureChannel</text>
 </svg>

docs/homelab-audit.md

@@ -15,7 +15,7 @@
 | DC01 | Server 2022 Std | 2 | 4 GB | VMnet8 (NAT) | `D:\Homelab\DC01\Windows Server 2022.vmx` |
 | FILE01 | Server 2022 Std | 4 | 4 GB | VMnet8 (NAT) | `D:\Homelab\FILE01\FILE01.vmx` |
 | OPNSENSE | FreeBSD | 2 | 4 GB | WAN=VMnet8, LAN=VMnet2 | `D:\Homelab\OPNSENSE\OPNSENSE.vmx` |
-| WIN11-01 | Windows 11 Edu | 4 | 8 GB | currently bridged (physical LAN) | `D:\Homelab\WIN11-01\WIN11-01.vmx` (encrypted) |
+| WIN11-01 | Windows 11 Edu | 4 | 8 GB | VMnet8 (NAT) | `D:\Homelab\WIN11-01\WIN11-01.vmx` (decrypted 2026-10-03) |
 
 Virtual networks (from `vmnetdhcp.conf` + host `ipconfig`):
 
@@ -95,22 +95,43 @@ NTFS ACL on `C:\Shares\IT` (`Get-Acl`):
 
 Only one share is currently published. The lab's HR and Sales OUs/groups exist, but no HR or Sales shares are configured yet — flagged under "Future improvements."
 
-## Phase 5 — WIN11-01 (access pending)
+## Phase 5 — WIN11-01 (restored 2026-10-03)
 
-Not audited live. Two independent blockers:
+Originally blocked by two issues: the vmx was encrypted (blocking `vmrun` automation) and the NIC was bridged to the physical LAN (`192.168.1.132`, gateway `192.168.1.1`), leaving no route to DC01 (`192.168.31.10` on VMnet8). `Test-NetConnection 192.168.31.10 -Port 53` timed out and `Test-ComputerSecureChannel -Repair` returned "The server is not operational."
 
-1. **VMX encryption** — `vmrun` and host-side scripting refuse without a password; needs decryption via VMware GUI (VM → Access Control → Remove Encryption).
+Resolution, performed in the guest as `BGLAB\Administrator`:
-2. **NIC bridged to physical LAN** — WIN11-01 reports `192.168.1.132` with gateway `192.168.1.1` and DNS `192.168.1.1`. It has no route to DC01 (`192.168.31.10` on VMnet8). `Test-NetConnection 192.168.31.10 -Port 53` timed out, `Resolve-DnsName ad.bytegeist.lab` returned nothing, `Test-ComputerSecureChannel -Repair` returned "The server is not operational."
 
-AD-side evidence that the join still exists: `Get-ADComputer WIN11-01` shows the account enabled, OS Windows 11 Education, last successful domain logon 2026-08-05 — before the NIC change.
+1. Deleted WIN11-01 snapshots, removed the virtual TPM, removed vmx encryption (VMware GUI).
+2. Changed the network adapter from Bridged to NAT (VMnet8).
+3. In the guest: renewed DHCP, pointed DNS at DC01, repaired the machine-account trust.
 
-Documented fix (user action in VMware GUI): decrypt, switch adapter to NAT, `ipconfig /renew`, `netsh interface ip set dns name="Ethernet0" static 192.168.31.10 primary`, `Test-ComputerSecureChannel -Repair`.
+Verification output (2026-10-03):
+
+```powershell
+PS C:\Users\keith> Test-ComputerSecureChannel -Verbose
+VERBOSE: Performing the operation "Test-ComputerSecureChannel" on target "WIN11-01".
+True
+VERBOSE: The secure channel between the local computer and the domain ad.bytegeist.lab is in good condition.
+
+PS C:\Users\keith> nltest /dsgetdc:ad.bytegeist.lab
+           DC: \\DC01.ad.bytegeist.lab
+      Address: \\192.168.31.10
+     Dom Name: ad.bytegeist.lab
+  Forest Name: ad.bytegeist.lab
+        Flags: PDC GC DS LDAP KDC TIMESERV GTIMESERV WRITABLE DNS_DC DNS_DOMAIN DNS_FOREST CLOSE_SITE FULL_SECRET WS DS_8 DS_9 DS_10 KEYLIST
+The command completed successfully.
+
+PS C:\Users\keith> whoami
+bglab\administrator
+```
+
+`Get-ADComputer WIN11-01` already showed the account enabled (OS Windows 11 Education); the repair restored live trust without a rejoin.
 
 ## Phase 6 — Network validation
 
 - DC01 ↔ FILE01: both on VMnet8/192.168.31.0/24. SMB + Kerberos verified by successful `Invoke-Command FILE01` from DC01.
 - DC01 → `time.windows.com`: resolves and syncs (stratum 5, source IP 168.61.215.74).
-- WIN11-01 → DC01: broken (see Phase 5).
+- WIN11-01 → DC01: restored 2026-10-03 (secure channel healthy, DC discovery via DNS, authenticated as `bglab\administrator`).
 
 ## Phase 7 — Problems found and fixed
 
@@ -120,8 +141,8 @@ Documented fix (user action in VMware GUI): decrypt, switch adapter to NAT, `ipc
 | 2 | Stale `dcdiag` SystemLog failure from an unexpected shutdown on 2026-08-07 | `wevtutil cl System`; re-ran `dcdiag /q` — silent | **Fixed** |
 | 3 | `bglab\keith` is a standard Domain User, couldn't WinRM into FILE01 (Access Denied) | `Add-ADGroupMember 'Domain Admins' keith` as `BGLAB\Administrator` — logged as lab maintenance | **Fixed** |
 | 4 | FILE01 and DC01 on plain NAT (VMnet8), WIN11-01 on different segment — OPNsense doesn't see east-west server traffic | Documented; migration to pure VMnet2 behind OPNsense is a planned improvement | **Documented** |
-| 5 | WIN11-01 NIC bridged to physical LAN, no route to DC01 | Documented; requires VMware GUI (decrypt + change adapter) | **Pending user action** |
+| 5 | WIN11-01 NIC bridged to physical LAN, no route to DC01 | Snapshots removed, TPM removed, vmx decrypted, adapter switched to NAT, DNS pointed at DC01, `Test-ComputerSecureChannel -Repair` — verified `True` | **Fixed** |
-| 6 | WIN11-01 vmx encrypted — blocks `vmrun` and automation | Documented; user to remove encryption via VMware GUI | **Pending user action** |
+| 6 | WIN11-01 vmx encrypted — blocked `vmrun` and automation | Removed via VMware GUI after snapshot/TPM removal | **Fixed** |
 
 ## Security notes
 

docs/windows-server-homelab.md

@@ -18,7 +18,7 @@ Three virtual machines on VMware Workstation Pro 17, plus an OPNsense firewall V
 |---|---|---|---|---|
 | DC01 | Windows Server 2022 Standard | Domain controller | 192.168.31.10 | AD DS, DNS, PDC Emulator, Schema Master, Global Catalog |
 | FILE01 | Windows Server 2022 Standard | Member server | 192.168.31.20 | SMB file services |
-| WIN11-01 | Windows 11 Education | Domain client | (NIC change in progress) | Domain-joined workstation |
+| WIN11-01 | Windows 11 Education | Domain client | 192.168.31.x (DHCP, VMnet8) | Domain-joined workstation |
 | OPNSENSE | FreeBSD / OPNsense | Firewall / router | VMnet8 ↔ VMnet2 | Separates server and client segments |
 
 ## Active Directory
@@ -84,7 +84,7 @@ Role-based access via group membership: only members of `BGLAB\IT Employees` get
 
 ## Client domain join
 
-WIN11-01 is in AD as a domain-joined Windows 11 Education client, last successful domain logon 2026-08-05. Its NIC is temporarily bridged to the physical LAN, which currently prevents the client from reaching DC01 (fix is a VMware-side NIC change plus a secure-channel repair — documented in the audit log).
+WIN11-01 is a domain-joined Windows 11 Education client on the lab NAT network (VMnet8). After the NIC was moved off a bridged physical-LAN adapter and DNS was pointed at DC01, the machine-account secure channel was repaired and verified: `Test-ComputerSecureChannel` returns `True`, `nltest /dsgetdc:ad.bytegeist.lab` locates DC01 (PDC/GC/KDC/DNS flags), and domain authentication succeeds (`bglab\administrator`). Full before/after detail is in the audit log.
 
 ## Networking
 
@@ -112,7 +112,7 @@ Run from DC01 as `BGLAB\Administrator`, output captured to transcripts on the ho
 1. **PDC time source was `Local CMOS Clock`.** On a Windows forest the PDC Emulator is the authoritative time source; every member chains off it. If it drifts, Kerberos tickets outside the 5-minute skew window fail — a classic Help Desk "I can't log in" root cause.
 2. **Stale `dcdiag` SystemLog failure** from an unexpected shutdown on 2026-08-07.
 3. **My daily account (`keith`) was a standard Domain User** and couldn't WinRM into FILE01 for remote auditing (correct behavior — only Domain Admins are in the server's local Administrators by default).
-4. **WIN11-01's NIC drifted to bridged mode**, which severed its path to DC01.
+4. **WIN11-01's NIC had drifted to bridged mode**, severing its path to DC01.
 5. **Topology placement:** DC01 and FILE01 sit on NAT (VMnet8) rather than behind OPNsense's LAN, so OPNsense doesn't see server-to-server east-west traffic. Honest reality, not a bug.
 
 ## Fixes performed
@@ -121,11 +121,11 @@ Run from DC01 as `BGLAB\Administrator`, output captured to transcripts on the ho
 - Cleared the stale System event log (`wevtutil cl System`); re-ran `dcdiag /q` — clean.
 - Added `keith` to `Domain Admins` as a documented lab-maintenance action so future audits run as my daily account instead of needing an Administrator sign-in each time. Lab-only elevation; this account has no production use.
 
-Pending (user-side VMware GUI action, not scripted):
+Client restoration (completed 2026-10-03, VMware GUI + guest PowerShell):
 
-- Decrypt WIN11-01's vmx (VM → Access Control → Remove Encryption).
+- Removed WIN11-01 snapshots, virtual TPM, and vmx encryption.
-- Switch WIN11-01's network adapter from Bridged to NAT.
+- Switched WIN11-01's network adapter from Bridged to NAT (VMnet8).
-- `ipconfig /release && /renew`, point DNS at `192.168.31.10`, `Test-ComputerSecureChannel -Repair`.
+- Renewed DHCP, pointed DNS at `192.168.31.10`, ran `Test-ComputerSecureChannel -Repair` — returns `True`; `nltest` locates DC01 with full PDC/GC/KDC/DNS flags.
 
 ## Security considerations
 

homelab.html

@@ -85,7 +85,7 @@
             <tbody>
               <tr><td><strong>DC01</strong></td><td>Windows Server 2022 Standard</td><td>Domain Controller</td><td>192.168.31.10</td><td>AD DS, DNS, PDC Emulator, Schema &amp; Domain Naming Master, Global Catalog</td></tr>
               <tr><td><strong>FILE01</strong></td><td>Windows Server 2022 Standard</td><td>Member server</td><td>192.168.31.20</td><td>SMB file services; <code>IT</code> departmental share</td></tr>
-              <tr><td><strong>WIN11-01</strong></td><td>Windows 11 Education</td><td>Domain client</td><td><em>NIC change pending</em></td><td>Domain-joined workstation</td></tr>
+              <tr><td><strong>WIN11-01</strong></td><td>Windows 11 Education</td><td>Domain client</td><td>192.168.31.x (NAT)</td><td>Domain-joined workstation</td></tr>
               <tr><td><strong>OPNSENSE</strong></td><td>OPNsense (FreeBSD)</td><td>Firewall / router</td><td>VMnet8 &harr; VMnet2</td><td>Segmenting server (VMnet8) and client (VMnet2) networks</td></tr>
             </tbody>
           </table>
@@ -220,13 +220,23 @@ w32tm /resync /rediscover</pre>
 <pre class="lab-code">wevtutil cl System
 dcdiag /q</pre>
             <p class="status-ok">Verified: <code>dcdiag /q</code> now silent (clean).</p>
-            <h3 class="h3-sub">Pending (user-side VMware GUI)</h3>
+            <h3 class="h3-sub">Client domain restoration (completed)</h3>
             <p>
-              WIN11-01's vmx is encrypted and its NIC is bridged to the physical LAN
+              WIN11-01's NIC was moved from a bridged physical-LAN adapter to the lab
-              (192.168.1.132), so it currently can't reach DC01 (192.168.31.10). Fix is a
+              NAT network, DNS was pointed at DC01, and the machine account trust was
-              VMware-side NIC change plus a <code>Test-ComputerSecureChannel -Repair</code>.
+              repaired. Verified domain authentication and DC discovery:
-              Documented honestly rather than papered over.
             </p>
+<pre class="lab-code">PS&gt; Test-ComputerSecureChannel -Verbose
+VERBOSE: The secure channel between the local computer and the domain ad.bytegeist.lab is in good condition.
+True
+PS&gt; nltest /dsgetdc:ad.bytegeist.lab
+DC: \\DC01.ad.bytegeist.lab
+Address: \\192.168.31.10
+Flags: PDC GC DS LDAP KDC TIMESERV ... DNS_DC DNS_DOMAIN DNS_FOREST
+The command completed successfully
+PS&gt; whoami
+bglab\administrator</pre>
+            <p class="status-ok">Verified: secure channel healthy, DC01 reachable as PDC / GC / KDC / DNS.</p>
           </div>
         </div>
       </div>
@@ -244,9 +254,9 @@ dcdiag /q</pre>
           <li><strong>DNS</strong> &mdash; AD-integrated primary zones, reverse zones, understanding why the client's DNS must point at the DC.</li>
           <li><strong>SMB &amp; NTFS</strong> &mdash; share creation, share-level vs. NTFS permissions, role-based access through groups.</li>
           <li><strong>PowerShell</strong> &mdash; <code>Get-AD*</code>, <code>Invoke-Command</code>, <code>Get-SmbShareAccess</code>, <code>Get-Acl</code>, <code>w32tm</code>, <code>Test-ComputerSecureChannel</code>.</li>
-          <li><strong>Troubleshooting</strong> &mdash; recognizing <em>Local CMOS Clock</em> as a future Kerberos failure; recognizing an Access Denied on WinRM as "not in the server's local Administrators."</li>
+          <li><strong>Troubleshooting</strong> &mdash; recognizing <em>Local CMOS Clock</em> as a future Kerberos failure; diagnosing a broken secure channel as a bridged-NIC / wrong-DNS fault and restoring it with <code>Test-ComputerSecureChannel -Repair</code>.</li>
           <li><strong>Virtualization &amp; networking</strong> &mdash; VMware Workstation Pro, VMnet subnetting, OPNsense placement, bridged vs. NAT NIC implications.</li>
-          <li><strong>Honest audit documentation</strong> &mdash; the <code>WIN11-01 pending</code> callout stays visible, with the exact fix listed.</li>
+          <li><strong>Honest audit documentation</strong> &mdash; problems (PDC time source, bridged client NIC) recorded with the exact fix applied, not hidden.</li>
         </ul>
       </div>
     </section>