From 91fdb51f588a737a9ec7e45f0a95860b87e1461f Mon Sep 17 00:00:00 2001 From: Keith Casko Date: Tue, 6 Oct 2026 08:02:35 -0400 Subject: [PATCH] Tighten homelab security claims and documentation --- docs/homelab-audit.md | 6 +++--- docs/windows-server-homelab.md | 8 +++++--- homelab.html | 22 +++++++++++++++------- index.html | 20 ++++++++------------ 4 files changed, 31 insertions(+), 25 deletions(-) diff --git a/docs/homelab-audit.md b/docs/homelab-audit.md index aa0baf6..a796090 100644 --- a/docs/homelab-audit.md +++ b/docs/homelab-audit.md @@ -138,8 +138,8 @@ bglab\administrator | # | Problem | Fix | Status | |---|---|---|---| | 1 | PDC time source `Local CMOS Clock` (stratum 1 LOCL — would cause Kerberos skew failures as members drift) | `w32tm /config /manualpeerlist:"time.windows.com,0x9 pool.ntp.org,0x9 time.nist.gov,0x9" /syncfromflags:manual /reliable:yes /update` → PDC now stratum 5 syncing from `time.windows.com` (168.61.215.74) | **Fixed** | -| 2 | Stale `dcdiag` SystemLog failure from an unexpected shutdown on 2026-08-07 | `wevtutil cl System`; re-ran `dcdiag /q` — silent | **Fixed** | -| 3 | `bglab\keith` is a standard Domain User, couldn't WinRM into FILE01 (Access Denied) | `Add-ADGroupMember 'Domain Admins' keith` as `BGLAB\Administrator` — logged as lab maintenance | **Fixed** | +| 2 | Stale `dcdiag` SystemLog failure from an unexpected shutdown on 2026-08-07 | Confirmed the stale shutdown event was the cause, cleared the lab System log, and re-ran `dcdiag /q` — silent. Production-safe procedure would export first with `wevtutil epl System .evtx` before clearing. | **Fixed / procedure improved** | +| 3 | `bglab\keith` is a standard Domain User, couldn't WinRM into FILE01 (Access Denied) | Temporarily added `keith` to `Domain Admins` for the lab audit. This restored WinRM access but is documented as a hardening gap; target state is a separate named admin account. | **Functional / hardening pending** | | 4 | FILE01 and DC01 on plain NAT (VMnet8), WIN11-01 on different segment — OPNsense doesn't see east-west server traffic | Documented; migration to pure VMnet2 behind OPNsense is a planned improvement | **Documented** | | 5 | WIN11-01 NIC bridged to physical LAN, no route to DC01 | Snapshots removed, TPM removed, vmx decrypted, adapter switched to NAT, DNS pointed at DC01, `Test-ComputerSecureChannel -Repair` — verified `True` | **Fixed** | | 6 | WIN11-01 vmx encrypted — blocked `vmrun` and automation | Removed via VMware GUI after snapshot/TPM removal | **Fixed** | @@ -149,4 +149,4 @@ bglab\administrator - No passwords, DSRM, krbtgt, SIDs, or recovery credentials captured in transcripts or portfolio artifacts. - Lab is behind VMware NAT; no inbound exposure to the host network or the internet. - Transcripts live under `D:\Repos\ad-lab\transcripts\` on the host, not on the DC. -- `keith` was elevated to `Domain Admins` **in the lab only**; this account has no production use. +- `keith` was elevated to `Domain Admins` **in the lab only** for this audit. That is not the target operating model; the hardening plan is a separate named admin account plus a non-privileged daily account. diff --git a/docs/windows-server-homelab.md b/docs/windows-server-homelab.md index ad1d434..be846e6 100644 --- a/docs/windows-server-homelab.md +++ b/docs/windows-server-homelab.md @@ -118,8 +118,8 @@ Run from DC01 as `BGLAB\Administrator`, output captured to transcripts on the ho ## Fixes performed - Set external NTP on the PDC: `w32tm /config /manualpeerlist:"time.windows.com,0x9 pool.ntp.org,0x9 time.nist.gov,0x9" /syncfromflags:manual /reliable:yes /update`, `Restart-Service W32Time`, `w32tm /resync /rediscover`. Verified: `w32tm /query /source` now returns `time.windows.com,0x9`, stratum 5. -- Cleared the stale System event log (`wevtutil cl System`); re-ran `dcdiag /q` — clean. -- Added `keith` to `Domain Admins` as a documented lab-maintenance action so future audits run as my daily account instead of needing an Administrator sign-in each time. Lab-only elevation; this account has no production use. +- Confirmed the stale unexpected-shutdown event was the source, cleared the lab System log, and re-ran `dcdiag /q` — clean. For production, preserve evidence first with `wevtutil epl System .evtx` before clearing. +- Added `keith` to `Domain Admins` as a lab-maintenance shortcut during this audit. That is intentionally documented as a hardening gap, not a best practice. The target state is a separate named administrative account and a non-privileged daily workstation account. Client restoration (completed 2026-10-03, VMware GUI + guest PowerShell): @@ -136,10 +136,12 @@ Client restoration (completed 2026-10-03, VMware GUI + guest PowerShell): ## Skills demonstrated -Windows Server 2022 administration · Active Directory Domain Services · DNS · OU and group design · users and groups · SMB file services · NTFS and share permissions · PowerShell (`Get-AD*`, `Invoke-Command`, `w32tm`, `Get-SmbShareAccess`, `Get-Acl`) · VMware Workstation Pro 17 · network segmentation with OPNsense · WinRM remoting · structured troubleshooting · writing honest audit documentation. +Windows Server 2022 administration · Active Directory Domain Services · DNS · OU and group design · users and groups · SMB file services · NTFS and share permissions · PowerShell (`Get-AD*`, `Invoke-Command`, `w32tm`, `Get-SmbShareAccess`, `Get-Acl`) · VMware Workstation Pro 17 · OPNsense routing and segmentation lab design · WinRM remoting · structured troubleshooting · writing honest audit documentation. ## Future improvements +- Create a separate named administrative account, remove daily-user Domain Admin membership, and use least-privilege workstation sign-in. +- Disable inherited `BUILTIN\Users` access on the IT folder and apply explicit NTFS ACLs for administrators and the intended department group. - Move DC01 and FILE01 behind OPNsense (VMnet2) so firewall rules actually see server-side traffic — foundation for the Net+/Sec+ firewall drills in my `opnsense-lab-networking` skill. - Publish HR and Sales shares with the same RBAC pattern already proven on the IT share. - Add a first GPO (desktop wallpaper or password policy) linked to `OU=Users,OU=ByteGeist`. diff --git a/homelab.html b/homelab.html index a1e228a..cf571e8 100644 --- a/homelab.html +++ b/homelab.html @@ -4,7 +4,7 @@ ByteGeist Windows Server / AD Homelab — Keith Casko - + @@ -50,8 +50,8 @@ kind of break/fix that shows up in interview questions.

- Everything on this page was captured from the live lab on - 2026-10-03. No fabricated screenshots, no stock art. + The topology, command output, and configuration details on this page + reflect the lab state verified on 2026-10-03.

Windows Server 2022 @@ -87,7 +87,7 @@ DC01Windows Server 2022 StandardDomain Controller192.168.31.10AD DS, DNS, PDC Emulator, Schema & Domain Naming Master, Global Catalog FILE01Windows Server 2022 StandardMember server192.168.31.20SMB file services; IT departmental share WIN11-01Windows 11 EducationDomain client192.168.31.x (NAT)Domain-joined workstation - OPNSENSEOPNsense (FreeBSD)Firewall / routerVMnet8 ↔ VMnet2Segmenting server (VMnet8) and client (VMnet2) networks + OPNSENSEOPNsense (FreeBSD)Firewall / routerVMnet8 ↔ VMnet2Segmentation lab; VMnet2 client placement is planned, while current systems remain on VMnet8
@@ -172,6 +172,7 @@ CREATOR OWNERFull on child objectsYes +

Hardening note: the inherited BUILTIN\Users entry is broader than the intended IT-only access model. The next ACL change is to disable inheritance and retain only the required administrative and IT group permissions.

How it was verified

@@ -216,9 +217,13 @@ w32tm /resync /rediscover

Problem: stale dcdiag SystemLog failure

A past unexpected shutdown left an entry that dcdiag flagged on - every run. Cleared the System log and re-ran dcdiag /q. + every run. I confirmed the stale shutdown event was the source, cleared the + lab System log, and re-ran dcdiag /q. In a production workflow, + I would export the log before clearing it to preserve evidence.

-
wevtutil cl System
+
# Production-safe sequence:
+wevtutil epl System C:\Temp\System-before-clear.evtx
+wevtutil cl System
 dcdiag /q

             
Verified: dcdiag /q now silent (clean).

             
Client domain restoration (completed)

@@ -238,6 +243,9 @@ The command completed successfully
 PS> whoami
 bglab\administrator

Verified: secure channel healthy, DC01 reachable as PDC / GC / KDC / DNS.

+

Security note: this repair transcript was captured from a built-in + Administrator maintenance session. A separate named administrative account and + non-privileged daily workstation sign-in are the preferred next hardening step.

@@ -253,7 +261,7 @@ bglab\administrator
  • Windows Server 2022 — installed, promoted to a DC, operate day-to-day.
  • Active Directory — domain / forest design, OUs, users and groups, FSMO awareness, Global Catalog.
  • DNS — AD-integrated primary zones, reverse zones, understanding why the client's DNS must point at the DC.
    • -
  • SMB & NTFS — share creation, share-level vs. NTFS permissions, role-based access through groups.
    • +
  • SMB & NTFS — share creation, share-level vs. NTFS permissions, and role-based access through groups. The current IT folder still inherits BUILTIN\Users permissions; disabling inheritance and applying explicit ACLs is a documented hardening task.
  • PowerShell — Get-AD*, Invoke-Command, Get-SmbShareAccess, Get-Acl, w32tm, Test-ComputerSecureChannel.
  • Troubleshooting — recognizing Local CMOS Clock as a future Kerberos failure; diagnosing a broken secure channel as a bridged-NIC / wrong-DNS fault and restoring it with Test-ComputerSecureChannel -Repair.
  • Virtualization & networking — VMware Workstation Pro, VMnet subnetting, OPNsense placement, bridged vs. NAT NIC implications.
    • diff --git a/index.html b/index.html index cb7e44b..ad43b1c 100644 --- a/index.html +++ b/index.html @@ -96,10 +96,10 @@

    Windows Server 2022 Active Directory lab in VMware: domain controller with AD DS and DNS, member file server with - role-based SMB shares, Windows 11 domain client, and an - OPNsense firewall segmenting the networks. Audited and fixed - real problems (PDC time source, stale event log) via - PowerShell and WinRM. + role-based SMB share access, a Windows 11 domain client, and + an OPNsense firewall/router used for segmentation practice. + The current client and servers remain on VMnet8 while the + VMnet2 segmented client layout is the next networking exercise.

    View Lab Details @@ -311,15 +311,11 @@

    Western Governors University

    Bachelor of Science, Software Engineering · In Progress
    -

    Relevant Study

    +

    Recent Coursework

      -
    • Cloud Computing
      • -
    • Networking
      • -
    • IT Operations
      • -
    • Software Development
      • -
    • Java
      • -
    • Web Development
      • -
    • Security Fundamentals
      • +
    • Cloud Foundations — completed
      • +
    • Java Frameworks — completed project work
      • +
    • Hardware & Operating Systems Essentials — current study