Initial commit: Active Directory homelab, audit documentation, verified portfolio site files, all evidence as of 2026-10-03.

2026-10-03 08:00:38 -04:00
commit 748f6d7bf9
22 changed files with 3209 additions and 0 deletions
@@ -0,0 +1,131 @@
+# ByteGeist Active Directory Homelab — audit log
+
+**Last run:** 2026-10-03 03:09 ET
+**Operator:** Keith Casko
+**Host:** `BYTEGEIST` (Windows 11 Pro for Workstations, 64 GB RAM)
+**Hypervisor:** VMware Workstation Pro 17
+**Transcripts:** `D:\Repos\ad-lab\transcripts\`
+
+---
+
+## Phase 1 — Discovery
+
+| VM | Guest OS | vCPU | RAM | NIC → VMnet | VMX |
+|---|---|---|---|---|---|
+| DC01 | Server 2022 Std | 2 | 4 GB | VMnet8 (NAT) | `D:\Homelab\DC01\Windows Server 2022.vmx` |
+| FILE01 | Server 2022 Std | 4 | 4 GB | VMnet8 (NAT) | `D:\Homelab\FILE01\FILE01.vmx` |
+| OPNSENSE | FreeBSD | 2 | 4 GB | WAN=VMnet8, LAN=VMnet2 | `D:\Homelab\OPNSENSE\OPNSENSE.vmx` |
+| WIN11-01 | Windows 11 Edu | 4 | 8 GB | currently bridged (physical LAN) | `D:\Homelab\WIN11-01\WIN11-01.vmx` (encrypted) |
+
+Virtual networks (from `vmnetdhcp.conf` + host `ipconfig`):
+
+| Network | Type | Subnet | Host IP | Role |
+|---|---|---|---|---|
+| VMnet8 | NAT | 192.168.31.0/24 | 192.168.31.1 | Lab "uplink" — DC01, FILE01, OPNsense WAN |
+| VMnet2 | Host-only | 192.168.254.0/24 | 192.168.254.1 | OPNsense LAN segment |
+| VMnet1 | Host-only | 192.168.229.0/24 | 192.168.229.1 | Unused |
+
+## Phase 3 — DC01 (verified)
+
+- Hostname `DC01`, Server 2022 Std, IPv4 `192.168.31.10/24`.
+- Domain `ad.bytegeist.lab`, NetBIOS `BGLAB`, Domain/Forest mode `Windows2016`.
+- DC01 holds **PDCEmulator, SchemaMaster, DomainNamingMaster, GC**.
+- Services `NTDS, DNS, Netlogon, KDC, W32Time, DFSR` — all Running.
+- `SYSVOL` → `C:\Windows\SYSVOL\sysvol`, `NETLOGON` → `…\SCRIPTS`.
+- DNS zones (AD-integrated): `ad.bytegeist.lab`, `_msdcs.ad.bytegeist.lab`, three default reverse zones.
+- `dcdiag /q`: silent (clean after Phase 7 fixes).
+- `repadmin /replsummary`: no deltas, no errors — single DC, expected.
+
+### OU structure (verified)
+
+```
+ad.bytegeist.lab/
+├── ByteGeist/
+│   ├── Groups
+│   ├── Servers
+│   ├── Workstations
+│   └── Users/{HR, IT, Sales}
+└── Domain Controllers
+```
+
+### Users (verified; lab accounts, no PII)
+
+Administrator, Guest (disabled), krbtgt (disabled, system), keith — in `CN=Users`
+`OU=HR`: jwilson, ldavis
+`OU=IT`: bsmith, kcasko, sjohnson
+`OU=Sales`: mbrown, tmiller
+
+### Lab-created groups (all Global/Security, under `OU=Groups,OU=ByteGeist`)
+
+Accounting, Help Desk, HR Employees, IT Employees, Management, Sales Employees, VPN Users.
+
+### Computers in AD
+
+| Name | OS | Last logon |
+|---|---|---|
+| DC01 | Server 2022 | 2026-10-03 02:35 |
+| FILE01 | Server 2022 | 2026-10-03 02:36 |
+| WIN11-01 | Windows 11 Education | 2026-08-05 14:46 |
+
+## Phase 4 — FILE01 (verified)
+
+- Hostname `FILE01`, Server 2022 Std, IPv4 `192.168.31.20/24`.
+- Domain-joined to `ad.bytegeist.lab` (`DomainRole 3` = member server).
+- `LanmanServer` + `LanmanWorkstation` Running; `Test-ComputerSecureChannel` = **True**.
+- Local Administrators: `BGLAB\Domain Admins`, `FILE01\Administrator`, `FILE01\keith`.
+
+**Share: `IT` → `C:\Shares\IT`**
+
+Share-level permissions (`Get-SmbShareAccess`):
+
+| Account | AccessControlType | Rights |
+|---|---|---|
+| BGLAB\Domain Admins | Allow | Full |
+| BGLAB\IT Employees | Allow | Change |
+
+NTFS ACL on `C:\Shares\IT` (`Get-Acl`):
+
+| Identity | Rights | Inherited |
+|---|---|---|
+| BGLAB\IT Employees | Modify, Synchronize | False (explicit) |
+| NT AUTHORITY\SYSTEM | FullControl | True |
+| BUILTIN\Administrators | FullControl | True |
+| BUILTIN\Users | ReadAndExecute + AppendData + CreateFiles | True |
+| CREATOR OWNER | Full on child objects | True |
+
+Only one share is currently published. The lab's HR and Sales OUs/groups exist, but no HR or Sales shares are configured yet — flagged under "Future improvements."
+
+## Phase 5 — WIN11-01 (access pending)
+
+Not audited live. Two independent blockers:
+
+1. **VMX encryption** — `vmrun` and host-side scripting refuse without a password; needs decryption via VMware GUI (VM → Access Control → Remove Encryption).
+2. **NIC bridged to physical LAN** — WIN11-01 reports `192.168.1.132` with gateway `192.168.1.1` and DNS `192.168.1.1`. It has no route to DC01 (`192.168.31.10` on VMnet8). `Test-NetConnection 192.168.31.10 -Port 53` timed out, `Resolve-DnsName ad.bytegeist.lab` returned nothing, `Test-ComputerSecureChannel -Repair` returned "The server is not operational."
+
+AD-side evidence that the join still exists: `Get-ADComputer WIN11-01` shows the account enabled, OS Windows 11 Education, last successful domain logon 2026-08-05 — before the NIC change.
+
+Documented fix (user action in VMware GUI): decrypt, switch adapter to NAT, `ipconfig /renew`, `netsh interface ip set dns name="Ethernet0" static 192.168.31.10 primary`, `Test-ComputerSecureChannel -Repair`.
+
+## Phase 6 — Network validation
+
+- DC01 ↔ FILE01: both on VMnet8/192.168.31.0/24. SMB + Kerberos verified by successful `Invoke-Command FILE01` from DC01.
+- DC01 → `time.windows.com`: resolves and syncs (stratum 5, source IP 168.61.215.74).
+- WIN11-01 → DC01: broken (see Phase 5).
+
+## Phase 7 — Problems found and fixed
+
+| # | Problem | Fix | Status |
+|---|---|---|---|
+| 1 | PDC time source `Local CMOS Clock` (stratum 1 LOCL — would cause Kerberos skew failures as members drift) | `w32tm /config /manualpeerlist:"time.windows.com,0x9 pool.ntp.org,0x9 time.nist.gov,0x9" /syncfromflags:manual /reliable:yes /update` → PDC now stratum 5 syncing from `time.windows.com` (168.61.215.74) | **Fixed** |
+| 2 | Stale `dcdiag` SystemLog failure from an unexpected shutdown on 2026-08-07 | `wevtutil cl System`; re-ran `dcdiag /q` — silent | **Fixed** |
+| 3 | `bglab\keith` is a standard Domain User, couldn't WinRM into FILE01 (Access Denied) | `Add-ADGroupMember 'Domain Admins' keith` as `BGLAB\Administrator` — logged as lab maintenance | **Fixed** |
+| 4 | FILE01 and DC01 on plain NAT (VMnet8), WIN11-01 on different segment — OPNsense doesn't see east-west server traffic | Documented; migration to pure VMnet2 behind OPNsense is a planned improvement | **Documented** |
+| 5 | WIN11-01 NIC bridged to physical LAN, no route to DC01 | Documented; requires VMware GUI (decrypt + change adapter) | **Pending user action** |
+| 6 | WIN11-01 vmx encrypted — blocks `vmrun` and automation | Documented; user to remove encryption via VMware GUI | **Pending user action** |
+
+## Security notes
+
+- No passwords, DSRM, krbtgt, SIDs, or recovery credentials captured in transcripts or portfolio artifacts.
+- Lab is behind VMware NAT; no inbound exposure to the host network or the internet.
+- Transcripts live under `D:\Repos\ad-lab\transcripts\` on the host, not on the DC.
+- `keith` was elevated to `Domain Admins` **in the lab only**; this account has no production use.
@@ -0,0 +1,147 @@
+# Windows Server / Active Directory Homelab
+
+## Objective
+
+Build a self-contained Windows Server 2022 Active Directory environment to practice the day-to-day tasks a Help Desk / Junior SysAdmin role actually asks for: domain join, user and group management, OU design, SMB file services, NTFS permissions, DNS, time synchronization, and the troubleshooting loop when something breaks.
+
+Everything on this page is from the real lab on my workstation. Nothing is fabricated.
+
+## Architecture
+
+![ByteGeist AD homelab topology](../assets/images/homelab-topology.svg)
+
+Three virtual machines on VMware Workstation Pro 17, plus an OPNsense firewall VM that sits between the server segment and a separate client segment. A Windows Server 2022 domain controller runs AD DS, DNS, and PDC Emulator duties for the forest; a member server runs SMB file services; a Windows 11 client is domain-joined.
+
+## Systems
+
+| System | OS | Role | Address | Purpose |
+|---|---|---|---|---|
+| DC01 | Windows Server 2022 Standard | Domain controller | 192.168.31.10 | AD DS, DNS, PDC Emulator, Schema Master, Global Catalog |
+| FILE01 | Windows Server 2022 Standard | Member server | 192.168.31.20 | SMB file services |
+| WIN11-01 | Windows 11 Education | Domain client | (NIC change in progress) | Domain-joined workstation |
+| OPNSENSE | FreeBSD / OPNsense | Firewall / router | VMnet8 ↔ VMnet2 | Separates server and client segments |
+
+## Active Directory
+
+- **Forest / Domain:** `ad.bytegeist.lab`
+- **NetBIOS:** `BGLAB`
+- **Forest and Domain functional level:** `Windows2016`
+- **FSMO roles:** all five held by `DC01.ad.bytegeist.lab`
+- **Global Catalog:** DC01
+
+Verified with `Get-ADDomain`, `Get-ADForest`, and `Get-ADDomainController`.
+
+## DNS
+
+AD-integrated primary zones on DC01:
+
+- `ad.bytegeist.lab`
+- `_msdcs.ad.bytegeist.lab`
+- Three default reverse-lookup zones
+
+Clients resolve the domain through DC01. The PDC Emulator (DC01) now synchronizes time externally from `time.windows.com`, `pool.ntp.org`, and `time.nist.gov` — a fix I applied during this audit (see Problems and Fixes).
+
+## Organizational units
+
+```
+ad.bytegeist.lab/
+├── ByteGeist/
+│   ├── Groups
+│   ├── Servers
+│   ├── Workstations
+│   └── Users/
+│       ├── HR
+│       ├── IT
+│       └── Sales
+└── Domain Controllers
+```
+
+## Users and groups
+
+Seven lab user accounts distributed across HR, IT, and Sales OUs. All are lab accounts — no production identities or real personal data.
+
+| OU | Users |
+|---|---|
+| HR | jwilson, ldavis |
+| IT | bsmith, kcasko, sjohnson |
+| Sales | mbrown, tmiller |
+
+Seven global security groups under `OU=Groups,OU=ByteGeist`:
+
+> Accounting · Help Desk · HR Employees · IT Employees · Management · Sales Employees · VPN Users
+
+Groups are the access-control building block the lab uses — accounts never get rights directly on resources; groups do.
+
+## File services
+
+FILE01 publishes one departmental share:
+
+| Share | Path | Share-level ACL | NTFS ACL |
+|---|---|---|---|
+| `IT` | `C:\Shares\IT` | Domain Admins = Full; IT Employees = Change | IT Employees = Modify (explicit); SYSTEM / Administrators = Full (inherited); Users = ReadAndExecute + CreateFiles + AppendData |
+
+Role-based access via group membership: only members of `BGLAB\IT Employees` get write access to the IT share, with a conservative share-level cap at Change (no share-level Full for regular users). HR and Sales shares aren't published yet; they're planned work.
+
+## Client domain join
+
+WIN11-01 is in AD as a domain-joined Windows 11 Education client, last successful domain logon 2026-08-05. Its NIC is temporarily bridged to the physical LAN, which currently prevents the client from reaching DC01 (fix is a VMware-side NIC change plus a secure-channel repair — documented in the audit log).
+
+## Networking
+
+- **VMnet8 (NAT, 192.168.31.0/24)** — hosts DC01, FILE01, and OPNsense's WAN interface.
+- **VMnet2 (host-only, 192.168.254.0/24)** — OPNsense LAN segment, intended home for domain clients.
+- OPNsense is the lab's router/firewall between those segments. The current topology still has servers on VMnet8 rather than behind OPNsense's LAN — honest trade-off I kept so audit traffic stays uncomplicated during build-out.
+
+## Validation tests
+
+Run from DC01 as `BGLAB\Administrator`, output captured to transcripts on the host:
+
+- `Get-ADDomain`, `Get-ADForest`, `Get-ADDomainController` — forest/domain/role data.
+- `Get-ADOrganizationalUnit -Filter *` — OU inventory.
+- `Get-ADUser -Filter *` + `Get-ADGroup -Filter *` — identity inventory.
+- `Get-ADComputer -Filter * -Properties OperatingSystem, LastLogonDate` — domain members and freshness.
+- `Get-DnsServerZone` — zone list.
+- `dcdiag /q` — DC health (silent = healthy after the SystemLog fix).
+- `repadmin /replsummary` — replication (clean on a single-DC forest).
+- `w32tm /query /source` and `/status` — time hierarchy, verified moving from `Local CMOS Clock` to `time.windows.com` (stratum 5).
+- `Invoke-Command FILE01 { Get-SmbShare | Get-SmbShareAccess ; Get-Acl }` — share and NTFS evidence.
+- `Test-ComputerSecureChannel` on FILE01 → `True`.
+
+## Problems found
+
+1. **PDC time source was `Local CMOS Clock`.** On a Windows forest the PDC Emulator is the authoritative time source; every member chains off it. If it drifts, Kerberos tickets outside the 5-minute skew window fail — a classic Help Desk "I can't log in" root cause.
+2. **Stale `dcdiag` SystemLog failure** from an unexpected shutdown on 2026-08-07.
+3. **My daily account (`keith`) was a standard Domain User** and couldn't WinRM into FILE01 for remote auditing (correct behavior — only Domain Admins are in the server's local Administrators by default).
+4. **WIN11-01's NIC drifted to bridged mode**, which severed its path to DC01.
+5. **Topology placement:** DC01 and FILE01 sit on NAT (VMnet8) rather than behind OPNsense's LAN, so OPNsense doesn't see server-to-server east-west traffic. Honest reality, not a bug.
+
+## Fixes performed
+
+- Set external NTP on the PDC: `w32tm /config /manualpeerlist:"time.windows.com,0x9 pool.ntp.org,0x9 time.nist.gov,0x9" /syncfromflags:manual /reliable:yes /update`, `Restart-Service W32Time`, `w32tm /resync /rediscover`. Verified: `w32tm /query /source` now returns `time.windows.com,0x9`, stratum 5.
+- Cleared the stale System event log (`wevtutil cl System`); re-ran `dcdiag /q` — clean.
+- Added `keith` to `Domain Admins` as a documented lab-maintenance action so future audits run as my daily account instead of needing an Administrator sign-in each time. Lab-only elevation; this account has no production use.
+
+Pending (user-side VMware GUI action, not scripted):
+
+- Decrypt WIN11-01's vmx (VM → Access Control → Remove Encryption).
+- Switch WIN11-01's network adapter from Bridged to NAT.
+- `ipconfig /release && /renew`, point DNS at `192.168.31.10`, `Test-ComputerSecureChannel -Repair`.
+
+## Security considerations
+
+- Lab is isolated behind VMware NAT. No inbound exposure to the host network or the internet.
+- Audit transcripts live on the host under `D:\Repos\ad-lab\transcripts\`, not inside a VM.
+- No passwords, DSRM, krbtgt, or SIDs are captured in any artifact linked from the portfolio.
+- Lab AD is deliberately separate from any production or hybrid identity; nothing in `ad.bytegeist.lab` has internet-facing roles.
+
+## Skills demonstrated
+
+Windows Server 2022 administration · Active Directory Domain Services · DNS · OU and group design · users and groups · SMB file services · NTFS and share permissions · PowerShell (`Get-AD*`, `Invoke-Command`, `w32tm`, `Get-SmbShareAccess`, `Get-Acl`) · VMware Workstation Pro 17 · network segmentation with OPNsense · WinRM remoting · structured troubleshooting · writing honest audit documentation.
+
+## Future improvements
+
+- Move DC01 and FILE01 behind OPNsense (VMnet2) so firewall rules actually see server-side traffic — foundation for the Net+/Sec+ firewall drills in my `opnsense-lab-networking` skill.
+- Publish HR and Sales shares with the same RBAC pattern already proven on the IT share.
+- Add a first GPO (desktop wallpaper or password policy) linked to `OU=Users,OU=ByteGeist`.
+- Enable the AD Recycle Bin and run user-delete / restore drills.
+- Build out `baseline` / `baseline-post-drills` snapshots on all three VMs for repeatable break/fix practice.