Initial commit: Active Directory homelab, audit documentation, verified portfolio site files, all evidence as of 2026-10-03.
This commit is contained in:
Keith Casko
@@ -0,0 +1,147 @@
|
||||
# Windows Server / Active Directory Homelab
|
||||
|
||||
## Objective
|
||||
|
||||
Build a self-contained Windows Server 2022 Active Directory environment to practice the day-to-day tasks a Help Desk / Junior SysAdmin role actually asks for: domain join, user and group management, OU design, SMB file services, NTFS permissions, DNS, time synchronization, and the troubleshooting loop when something breaks.
|
||||
|
||||
Everything on this page is from the real lab on my workstation. Nothing is fabricated.
|
||||
|
||||
## Architecture
|
||||
|
||||
|
||||
|
||||
Three virtual machines on VMware Workstation Pro 17, plus an OPNsense firewall VM that sits between the server segment and a separate client segment. A Windows Server 2022 domain controller runs AD DS, DNS, and PDC Emulator duties for the forest; a member server runs SMB file services; a Windows 11 client is domain-joined.
|
||||
|
||||
## Systems
|
||||
|
||||
| System | OS | Role | Address | Purpose |
|
||||
|---|---|---|---|---|
|
||||
| DC01 | Windows Server 2022 Standard | Domain controller | 192.168.31.10 | AD DS, DNS, PDC Emulator, Schema Master, Global Catalog |
|
||||
| FILE01 | Windows Server 2022 Standard | Member server | 192.168.31.20 | SMB file services |
|
||||
| WIN11-01 | Windows 11 Education | Domain client | (NIC change in progress) | Domain-joined workstation |
|
||||
| OPNSENSE | FreeBSD / OPNsense | Firewall / router | VMnet8 ↔ VMnet2 | Separates server and client segments |
|
||||
|
||||
## Active Directory
|
||||
|
||||
- **Forest / Domain:** `ad.bytegeist.lab`
|
||||
- **NetBIOS:** `BGLAB`
|
||||
- **Forest and Domain functional level:** `Windows2016`
|
||||
- **FSMO roles:** all five held by `DC01.ad.bytegeist.lab`
|
||||
- **Global Catalog:** DC01
|
||||
|
||||
Verified with `Get-ADDomain`, `Get-ADForest`, and `Get-ADDomainController`.
|
||||
|
||||
## DNS
|
||||
|
||||
AD-integrated primary zones on DC01:
|
||||
|
||||
- `ad.bytegeist.lab`
|
||||
- `_msdcs.ad.bytegeist.lab`
|
||||
- Three default reverse-lookup zones
|
||||
|
||||
Clients resolve the domain through DC01. The PDC Emulator (DC01) now synchronizes time externally from `time.windows.com`, `pool.ntp.org`, and `time.nist.gov` — a fix I applied during this audit (see Problems and Fixes).
|
||||
|
||||
## Organizational units
|
||||
|
||||
```
|
||||
ad.bytegeist.lab/
|
||||
├── ByteGeist/
|
||||
│ ├── Groups
|
||||
│ ├── Servers
|
||||
│ ├── Workstations
|
||||
│ └── Users/
|
||||
│ ├── HR
|
||||
│ ├── IT
|
||||
│ └── Sales
|
||||
└── Domain Controllers
|
||||
```
|
||||
|
||||
## Users and groups
|
||||
|
||||
Seven lab user accounts distributed across HR, IT, and Sales OUs. All are lab accounts — no production identities or real personal data.
|
||||
|
||||
| OU | Users |
|
||||
|---|---|
|
||||
| HR | jwilson, ldavis |
|
||||
| IT | bsmith, kcasko, sjohnson |
|
||||
| Sales | mbrown, tmiller |
|
||||
|
||||
Seven global security groups under `OU=Groups,OU=ByteGeist`:
|
||||
|
||||
> Accounting · Help Desk · HR Employees · IT Employees · Management · Sales Employees · VPN Users
|
||||
|
||||
Groups are the access-control building block the lab uses — accounts never get rights directly on resources; groups do.
|
||||
|
||||
## File services
|
||||
|
||||
FILE01 publishes one departmental share:
|
||||
|
||||
| Share | Path | Share-level ACL | NTFS ACL |
|
||||
|---|---|---|---|
|
||||
| `IT` | `C:\Shares\IT` | Domain Admins = Full; IT Employees = Change | IT Employees = Modify (explicit); SYSTEM / Administrators = Full (inherited); Users = ReadAndExecute + CreateFiles + AppendData |
|
||||
|
||||
Role-based access via group membership: only members of `BGLAB\IT Employees` get write access to the IT share, with a conservative share-level cap at Change (no share-level Full for regular users). HR and Sales shares aren't published yet; they're planned work.
|
||||
|
||||
## Client domain join
|
||||
|
||||
WIN11-01 is in AD as a domain-joined Windows 11 Education client, last successful domain logon 2026-08-05. Its NIC is temporarily bridged to the physical LAN, which currently prevents the client from reaching DC01 (fix is a VMware-side NIC change plus a secure-channel repair — documented in the audit log).
|
||||
|
||||
## Networking
|
||||
|
||||
- **VMnet8 (NAT, 192.168.31.0/24)** — hosts DC01, FILE01, and OPNsense's WAN interface.
|
||||
- **VMnet2 (host-only, 192.168.254.0/24)** — OPNsense LAN segment, intended home for domain clients.
|
||||
- OPNsense is the lab's router/firewall between those segments. The current topology still has servers on VMnet8 rather than behind OPNsense's LAN — honest trade-off I kept so audit traffic stays uncomplicated during build-out.
|
||||
|
||||
## Validation tests
|
||||
|
||||
Run from DC01 as `BGLAB\Administrator`, output captured to transcripts on the host:
|
||||
|
||||
- `Get-ADDomain`, `Get-ADForest`, `Get-ADDomainController` — forest/domain/role data.
|
||||
- `Get-ADOrganizationalUnit -Filter *` — OU inventory.
|
||||
- `Get-ADUser -Filter *` + `Get-ADGroup -Filter *` — identity inventory.
|
||||
- `Get-ADComputer -Filter * -Properties OperatingSystem, LastLogonDate` — domain members and freshness.
|
||||
- `Get-DnsServerZone` — zone list.
|
||||
- `dcdiag /q` — DC health (silent = healthy after the SystemLog fix).
|
||||
- `repadmin /replsummary` — replication (clean on a single-DC forest).
|
||||
- `w32tm /query /source` and `/status` — time hierarchy, verified moving from `Local CMOS Clock` to `time.windows.com` (stratum 5).
|
||||
- `Invoke-Command FILE01 { Get-SmbShare | Get-SmbShareAccess ; Get-Acl }` — share and NTFS evidence.
|
||||
- `Test-ComputerSecureChannel` on FILE01 → `True`.
|
||||
|
||||
## Problems found
|
||||
|
||||
1. **PDC time source was `Local CMOS Clock`.** On a Windows forest the PDC Emulator is the authoritative time source; every member chains off it. If it drifts, Kerberos tickets outside the 5-minute skew window fail — a classic Help Desk "I can't log in" root cause.
|
||||
2. **Stale `dcdiag` SystemLog failure** from an unexpected shutdown on 2026-08-07.
|
||||
3. **My daily account (`keith`) was a standard Domain User** and couldn't WinRM into FILE01 for remote auditing (correct behavior — only Domain Admins are in the server's local Administrators by default).
|
||||
4. **WIN11-01's NIC drifted to bridged mode**, which severed its path to DC01.
|
||||
5. **Topology placement:** DC01 and FILE01 sit on NAT (VMnet8) rather than behind OPNsense's LAN, so OPNsense doesn't see server-to-server east-west traffic. Honest reality, not a bug.
|
||||
|
||||
## Fixes performed
|
||||
|
||||
- Set external NTP on the PDC: `w32tm /config /manualpeerlist:"time.windows.com,0x9 pool.ntp.org,0x9 time.nist.gov,0x9" /syncfromflags:manual /reliable:yes /update`, `Restart-Service W32Time`, `w32tm /resync /rediscover`. Verified: `w32tm /query /source` now returns `time.windows.com,0x9`, stratum 5.
|
||||
- Cleared the stale System event log (`wevtutil cl System`); re-ran `dcdiag /q` — clean.
|
||||
- Added `keith` to `Domain Admins` as a documented lab-maintenance action so future audits run as my daily account instead of needing an Administrator sign-in each time. Lab-only elevation; this account has no production use.
|
||||
|
||||
Pending (user-side VMware GUI action, not scripted):
|
||||
|
||||
- Decrypt WIN11-01's vmx (VM → Access Control → Remove Encryption).
|
||||
- Switch WIN11-01's network adapter from Bridged to NAT.
|
||||
- `ipconfig /release && /renew`, point DNS at `192.168.31.10`, `Test-ComputerSecureChannel -Repair`.
|
||||
|
||||
## Security considerations
|
||||
|
||||
- Lab is isolated behind VMware NAT. No inbound exposure to the host network or the internet.
|
||||
- Audit transcripts live on the host under `D:\Repos\ad-lab\transcripts\`, not inside a VM.
|
||||
- No passwords, DSRM, krbtgt, or SIDs are captured in any artifact linked from the portfolio.
|
||||
- Lab AD is deliberately separate from any production or hybrid identity; nothing in `ad.bytegeist.lab` has internet-facing roles.
|
||||
|
||||
## Skills demonstrated
|
||||
|
||||
Windows Server 2022 administration · Active Directory Domain Services · DNS · OU and group design · users and groups · SMB file services · NTFS and share permissions · PowerShell (`Get-AD*`, `Invoke-Command`, `w32tm`, `Get-SmbShareAccess`, `Get-Acl`) · VMware Workstation Pro 17 · network segmentation with OPNsense · WinRM remoting · structured troubleshooting · writing honest audit documentation.
|
||||
|
||||
## Future improvements
|
||||
|
||||
- Move DC01 and FILE01 behind OPNsense (VMnet2) so firewall rules actually see server-side traffic — foundation for the Net+/Sec+ firewall drills in my `opnsense-lab-networking` skill.
|
||||
- Publish HR and Sales shares with the same RBAC pattern already proven on the IT share.
|
||||
- Add a first GPO (desktop wallpaper or password policy) linked to `OU=Users,OU=ByteGeist`.
|
||||
- Enable the AD Recycle Bin and run user-delete / restore drills.
|
||||
- Build out `baseline` / `baseline-post-drills` snapshots on all three VMs for repeatable break/fix practice.
|
||||
Reference in New Issue
Block a user