keith/keith-portfolio
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Tighten homelab security claims and documentation
ci/woodpecker/push/woodpecker Pipeline was successful
Details

Browse Source
This commit is contained in:
Keith Casko
2026-10-06 08:02:35 -04:00
parent 824d6a9ec4
commit 91fdb51f58
4 changed files with 31 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/homelab-audit.md
+3 -3
View File
@@ -138,8 +138,8 @@ bglab\administrator
| # | Problem | Fix | Status |
|---|---|---|---|
| 1 | PDC time source `Local CMOS Clock` (stratum 1 LOCL — would cause Kerberos skew failures as members drift) | `w32tm /config /manualpeerlist:"time.windows.com,0x9 pool.ntp.org,0x9 time.nist.gov,0x9" /syncfromflags:manual /reliable:yes /update` → PDC now stratum 5 syncing from `time.windows.com` (168.61.215.74) | **Fixed** |
| 2 | Stale `dcdiag` SystemLog failure from an unexpected shutdown on 2026-08-07 | `wevtutil cl System`; re-ran `dcdiag /q` — silent | **Fixed** |
| 3 | `bglab\keith` is a standard Domain User, couldn't WinRM into FILE01 (Access Denied) | `Add-ADGroupMember 'Domain Admins' keith` as `BGLAB\Administrator` — logged as lab maintenance | **Fixed** |
| 2 | Stale `dcdiag` SystemLog failure from an unexpected shutdown on 2026-08-07 | Confirmed the stale shutdown event was the cause, cleared the lab System log, and re-ran `dcdiag /q` — silent. Production-safe procedure would export first with `wevtutil epl System <path>.evtx` before clearing. | **Fixed / procedure improved** |
| 3 | `bglab\keith` is a standard Domain User, couldn't WinRM into FILE01 (Access Denied) | Temporarily added `keith` to `Domain Admins` for the lab audit. This restored WinRM access but is documented as a hardening gap; target state is a separate named admin account. | **Functional / hardening pending** |
| 4 | FILE01 and DC01 on plain NAT (VMnet8), WIN11-01 on different segment — OPNsense doesn't see east-west server traffic | Documented; migration to pure VMnet2 behind OPNsense is a planned improvement | **Documented** |
| 5 | WIN11-01 NIC bridged to physical LAN, no route to DC01 | Snapshots removed, TPM removed, vmx decrypted, adapter switched to NAT, DNS pointed at DC01, `Test-ComputerSecureChannel -Repair` — verified `True` | **Fixed** |
| 6 | WIN11-01 vmx encrypted — blocked `vmrun` and automation | Removed via VMware GUI after snapshot/TPM removal | **Fixed** |
@@ -149,4 +149,4 @@ bglab\administrator
- No passwords, DSRM, krbtgt, SIDs, or recovery credentials captured in transcripts or portfolio artifacts.
- Lab is behind VMware NAT; no inbound exposure to the host network or the internet.
- Transcripts live under `D:\Repos\ad-lab\transcripts\` on the host, not on the DC.
- `keith` was elevated to `Domain Admins` **in the lab only**; this account has no production use.
- `keith` was elevated to `Domain Admins` **in the lab only** for this audit. That is not the target operating model; the hardening plan is a separate named admin account plus a non-privileged daily account.