Tighten homelab security claims and documentation
ci/woodpecker/push/woodpecker Pipeline was successful
ci/woodpecker/push/woodpecker Pipeline was successful
This commit is contained in:
Keith Casko
+15
-7
@@ -4,7 +4,7 @@
|
||||
<meta charset="UTF-8" />
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
|
||||
<title>ByteGeist Windows Server / AD Homelab — Keith Casko</title>
|
||||
<meta name="description" content="A verified Windows Server 2022 Active Directory homelab: DC01 with AD DS and DNS, FILE01 with role-based SMB shares, a Windows 11 domain client, and OPNsense firewall segmentation. Audited with PowerShell and WinRM." />
|
||||
<meta name="description" content="A verified Windows Server 2022 Active Directory homelab: DC01 with AD DS and DNS, FILE01 with role-based SMB share access, a Windows 11 domain client, and an OPNsense routing/segmentation lab. Audited with PowerShell and WinRM." />
|
||||
<link rel="stylesheet" href="css/styles.css" />
|
||||
</head>
|
||||
<body class="homelab-page">
|
||||
@@ -50,8 +50,8 @@
|
||||
kind of break/fix that shows up in interview questions.
|
||||
</p>
|
||||
<p>
|
||||
Everything on this page was captured from the live lab on
|
||||
<strong>2026-10-03</strong>. No fabricated screenshots, no stock art.
|
||||
The topology, command output, and configuration details on this page
|
||||
reflect the lab state verified on <strong>2026-10-03</strong>.
|
||||
</p>
|
||||
<div class="lab-tags">
|
||||
<span>Windows Server 2022</span>
|
||||
@@ -87,7 +87,7 @@
|
||||
<tr><td><strong>DC01</strong></td><td>Windows Server 2022 Standard</td><td>Domain Controller</td><td>192.168.31.10</td><td>AD DS, DNS, PDC Emulator, Schema & Domain Naming Master, Global Catalog</td></tr>
|
||||
<tr><td><strong>FILE01</strong></td><td>Windows Server 2022 Standard</td><td>Member server</td><td>192.168.31.20</td><td>SMB file services; <code>IT</code> departmental share</td></tr>
|
||||
<tr><td><strong>WIN11-01</strong></td><td>Windows 11 Education</td><td>Domain client</td><td>192.168.31.x (NAT)</td><td>Domain-joined workstation</td></tr>
|
||||
<tr><td><strong>OPNSENSE</strong></td><td>OPNsense (FreeBSD)</td><td>Firewall / router</td><td>VMnet8 ↔ VMnet2</td><td>Segmenting server (VMnet8) and client (VMnet2) networks</td></tr>
|
||||
<tr><td><strong>OPNSENSE</strong></td><td>OPNsense (FreeBSD)</td><td>Firewall / router</td><td>VMnet8 ↔ VMnet2</td><td>Segmentation lab; VMnet2 client placement is planned, while current systems remain on VMnet8</td></tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
@@ -172,6 +172,7 @@
|
||||
<tr><td><code>CREATOR OWNER</code></td><td>Full on child objects</td><td>Yes</td></tr>
|
||||
</tbody>
|
||||
</table>
|
||||
<p><strong>Hardening note:</strong> the inherited <code>BUILTIN\Users</code> entry is broader than the intended IT-only access model. The next ACL change is to disable inheritance and retain only the required administrative and IT group permissions.</p>
|
||||
</div>
|
||||
<div class="lab-panel">
|
||||
<h3>How it was verified</h3>
|
||||
@@ -216,9 +217,13 @@ w32tm /resync /rediscover</pre>
|
||||
<h3>Problem: stale <code>dcdiag</code> SystemLog failure</h3>
|
||||
<p>
|
||||
A past unexpected shutdown left an entry that <code>dcdiag</code> flagged on
|
||||
every run. Cleared the System log and re-ran <code>dcdiag /q</code>.
|
||||
every run. I confirmed the stale shutdown event was the source, cleared the
|
||||
lab System log, and re-ran <code>dcdiag /q</code>. In a production workflow,
|
||||
I would export the log before clearing it to preserve evidence.
|
||||
</p>
|
||||
<pre class="lab-code">wevtutil cl System
|
||||
<pre class="lab-code"># Production-safe sequence:
|
||||
wevtutil epl System C:\Temp\System-before-clear.evtx
|
||||
wevtutil cl System
|
||||
dcdiag /q</pre>
|
||||
<p class="status-ok">Verified: <code>dcdiag /q</code> now silent (clean).</p>
|
||||
<h3 class="h3-sub">Client domain restoration (completed)</h3>
|
||||
@@ -238,6 +243,9 @@ The command completed successfully
|
||||
PS> whoami
|
||||
bglab\administrator</pre>
|
||||
<p class="status-ok">Verified: secure channel healthy, DC01 reachable as PDC / GC / KDC / DNS.</p>
|
||||
<p><strong>Security note:</strong> this repair transcript was captured from a built-in
|
||||
Administrator maintenance session. A separate named administrative account and
|
||||
non-privileged daily workstation sign-in are the preferred next hardening step.</p>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
@@ -253,7 +261,7 @@ bglab\administrator</pre>
|
||||
<li><strong>Windows Server 2022</strong> — installed, promoted to a DC, operate day-to-day.</li>
|
||||
<li><strong>Active Directory</strong> — domain / forest design, OUs, users and groups, FSMO awareness, Global Catalog.</li>
|
||||
<li><strong>DNS</strong> — AD-integrated primary zones, reverse zones, understanding why the client's DNS must point at the DC.</li>
|
||||
<li><strong>SMB & NTFS</strong> — share creation, share-level vs. NTFS permissions, role-based access through groups.</li>
|
||||
<li><strong>SMB & NTFS</strong> — share creation, share-level vs. NTFS permissions, and role-based access through groups. The current IT folder still inherits <code>BUILTIN\Users</code> permissions; disabling inheritance and applying explicit ACLs is a documented hardening task.</li>
|
||||
<li><strong>PowerShell</strong> — <code>Get-AD*</code>, <code>Invoke-Command</code>, <code>Get-SmbShareAccess</code>, <code>Get-Acl</code>, <code>w32tm</code>, <code>Test-ComputerSecureChannel</code>.</li>
|
||||
<li><strong>Troubleshooting</strong> — recognizing <em>Local CMOS Clock</em> as a future Kerberos failure; diagnosing a broken secure channel as a bridged-NIC / wrong-DNS fault and restoring it with <code>Test-ComputerSecureChannel -Repair</code>.</li>
|
||||
<li><strong>Virtualization & networking</strong> — VMware Workstation Pro, VMnet subnetting, OPNsense placement, bridged vs. NAT NIC implications.</li>
|
||||
|
||||
Reference in New Issue
Block a user