keith/keith-portfolio
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Tighten homelab security claims and documentation
ci/woodpecker/push/woodpecker Pipeline was successful
Details

Browse Source
This commit is contained in:
Keith Casko
2026-10-06 08:02:35 -04:00
parent 824d6a9ec4
commit 91fdb51f58
4 changed files with 31 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/windows-server-homelab.md
+5 -3
View File
@@ -118,8 +118,8 @@ Run from DC01 as `BGLAB\Administrator`, output captured to transcripts on the ho
## Fixes performed
- Set external NTP on the PDC: `w32tm /config /manualpeerlist:"time.windows.com,0x9 pool.ntp.org,0x9 time.nist.gov,0x9" /syncfromflags:manual /reliable:yes /update`, `Restart-Service W32Time`, `w32tm /resync /rediscover`. Verified: `w32tm /query /source` now returns `time.windows.com,0x9`, stratum 5.
- Cleared the stale System event log (`wevtutil cl System`); re-ran `dcdiag /q` — clean.
- Added `keith` to `Domain Admins` as a documented lab-maintenance action so future audits run as my daily account instead of needing an Administrator sign-in each time. Lab-only elevation; this account has no production use.
- Confirmed the stale unexpected-shutdown event was the source, cleared the lab System log, and re-ran `dcdiag /q` — clean. For production, preserve evidence first with `wevtutil epl System <path>.evtx` before clearing.
- Added `keith` to `Domain Admins` as a lab-maintenance shortcut during this audit. That is intentionally documented as a hardening gap, not a best practice. The target state is a separate named administrative account and a non-privileged daily workstation account.
Client restoration (completed 2026-10-03, VMware GUI + guest PowerShell):
@@ -136,10 +136,12 @@ Client restoration (completed 2026-10-03, VMware GUI + guest PowerShell):
## Skills demonstrated
Windows Server 2022 administration · Active Directory Domain Services · DNS · OU and group design · users and groups · SMB file services · NTFS and share permissions · PowerShell (`Get-AD*`, `Invoke-Command`, `w32tm`, `Get-SmbShareAccess`, `Get-Acl`) · VMware Workstation Pro 17 · network segmentation with OPNsense · WinRM remoting · structured troubleshooting · writing honest audit documentation.
Windows Server 2022 administration · Active Directory Domain Services · DNS · OU and group design · users and groups · SMB file services · NTFS and share permissions · PowerShell (`Get-AD*`, `Invoke-Command`, `w32tm`, `Get-SmbShareAccess`, `Get-Acl`) · VMware Workstation Pro 17 · OPNsense routing and segmentation lab design · WinRM remoting · structured troubleshooting · writing honest audit documentation.
## Future improvements
- Create a separate named administrative account, remove daily-user Domain Admin membership, and use least-privilege workstation sign-in.
- Disable inherited `BUILTIN\Users` access on the IT folder and apply explicit NTFS ACLs for administrators and the intended department group.
- Move DC01 and FILE01 behind OPNsense (VMnet2) so firewall rules actually see server-side traffic — foundation for the Net+/Sec+ firewall drills in my `opnsense-lab-networking` skill.
- Publish HR and Sales shares with the same RBAC pattern already proven on the IT share.
- Add a first GPO (desktop wallpaper or password policy) linked to `OU=Users,OU=ByteGeist`.