Tighten homelab security claims and documentation

docs/homelab-audit.md

@@ -138,8 +138,8 @@ bglab\administrator
 | # | Problem | Fix | Status |
 |---|---|---|---|
 | 1 | PDC time source `Local CMOS Clock` (stratum 1 LOCL — would cause Kerberos skew failures as members drift) | `w32tm /config /manualpeerlist:"time.windows.com,0x9 pool.ntp.org,0x9 time.nist.gov,0x9" /syncfromflags:manual /reliable:yes /update` → PDC now stratum 5 syncing from `time.windows.com` (168.61.215.74) | **Fixed** |
-| 2 | Stale `dcdiag` SystemLog failure from an unexpected shutdown on 2026-08-07 | `wevtutil cl System`; re-ran `dcdiag /q` — silent | **Fixed** |
+| 2 | Stale `dcdiag` SystemLog failure from an unexpected shutdown on 2026-08-07 | Confirmed the stale shutdown event was the cause, cleared the lab System log, and re-ran `dcdiag /q` — silent. Production-safe procedure would export first with `wevtutil epl System <path>.evtx` before clearing. | **Fixed / procedure improved** |
-| 3 | `bglab\keith` is a standard Domain User, couldn't WinRM into FILE01 (Access Denied) | `Add-ADGroupMember 'Domain Admins' keith` as `BGLAB\Administrator` — logged as lab maintenance | **Fixed** |
+| 3 | `bglab\keith` is a standard Domain User, couldn't WinRM into FILE01 (Access Denied) | Temporarily added `keith` to `Domain Admins` for the lab audit. This restored WinRM access but is documented as a hardening gap; target state is a separate named admin account. | **Functional / hardening pending** |
 | 4 | FILE01 and DC01 on plain NAT (VMnet8), WIN11-01 on different segment — OPNsense doesn't see east-west server traffic | Documented; migration to pure VMnet2 behind OPNsense is a planned improvement | **Documented** |
 | 5 | WIN11-01 NIC bridged to physical LAN, no route to DC01 | Snapshots removed, TPM removed, vmx decrypted, adapter switched to NAT, DNS pointed at DC01, `Test-ComputerSecureChannel -Repair` — verified `True` | **Fixed** |
 | 6 | WIN11-01 vmx encrypted — blocked `vmrun` and automation | Removed via VMware GUI after snapshot/TPM removal | **Fixed** |
@@ -149,4 +149,4 @@ bglab\administrator
 - No passwords, DSRM, krbtgt, SIDs, or recovery credentials captured in transcripts or portfolio artifacts.
 - Lab is behind VMware NAT; no inbound exposure to the host network or the internet.
 - Transcripts live under `D:\Repos\ad-lab\transcripts\` on the host, not on the DC.
-- `keith` was elevated to `Domain Admins` **in the lab only**; this account has no production use.
+- `keith` was elevated to `Domain Admins` **in the lab only** for this audit. That is not the target operating model; the hardening plan is a separate named admin account plus a non-privileged daily account.

docs/windows-server-homelab.md

@@ -118,8 +118,8 @@ Run from DC01 as `BGLAB\Administrator`, output captured to transcripts on the ho
 ## Fixes performed
 
 - Set external NTP on the PDC: `w32tm /config /manualpeerlist:"time.windows.com,0x9 pool.ntp.org,0x9 time.nist.gov,0x9" /syncfromflags:manual /reliable:yes /update`, `Restart-Service W32Time`, `w32tm /resync /rediscover`. Verified: `w32tm /query /source` now returns `time.windows.com,0x9`, stratum 5.
-- Cleared the stale System event log (`wevtutil cl System`); re-ran `dcdiag /q` — clean.
+- Confirmed the stale unexpected-shutdown event was the source, cleared the lab System log, and re-ran `dcdiag /q` — clean. For production, preserve evidence first with `wevtutil epl System <path>.evtx` before clearing.
-- Added `keith` to `Domain Admins` as a documented lab-maintenance action so future audits run as my daily account instead of needing an Administrator sign-in each time. Lab-only elevation; this account has no production use.
+- Added `keith` to `Domain Admins` as a lab-maintenance shortcut during this audit. That is intentionally documented as a hardening gap, not a best practice. The target state is a separate named administrative account and a non-privileged daily workstation account.
 
 Client restoration (completed 2026-10-03, VMware GUI + guest PowerShell):
 
@@ -136,10 +136,12 @@ Client restoration (completed 2026-10-03, VMware GUI + guest PowerShell):
 
 ## Skills demonstrated
 
-Windows Server 2022 administration · Active Directory Domain Services · DNS · OU and group design · users and groups · SMB file services · NTFS and share permissions · PowerShell (`Get-AD*`, `Invoke-Command`, `w32tm`, `Get-SmbShareAccess`, `Get-Acl`) · VMware Workstation Pro 17 · network segmentation with OPNsense · WinRM remoting · structured troubleshooting · writing honest audit documentation.
+Windows Server 2022 administration · Active Directory Domain Services · DNS · OU and group design · users and groups · SMB file services · NTFS and share permissions · PowerShell (`Get-AD*`, `Invoke-Command`, `w32tm`, `Get-SmbShareAccess`, `Get-Acl`) · VMware Workstation Pro 17 · OPNsense routing and segmentation lab design · WinRM remoting · structured troubleshooting · writing honest audit documentation.
 
 ## Future improvements
 
+- Create a separate named administrative account, remove daily-user Domain Admin membership, and use least-privilege workstation sign-in.
+- Disable inherited `BUILTIN\Users` access on the IT folder and apply explicit NTFS ACLs for administrators and the intended department group.
 - Move DC01 and FILE01 behind OPNsense (VMnet2) so firewall rules actually see server-side traffic — foundation for the Net+/Sec+ firewall drills in my `opnsense-lab-networking` skill.
 - Publish HR and Sales shares with the same RBAC pattern already proven on the IT share.
 - Add a first GPO (desktop wallpaper or password policy) linked to `OU=Users,OU=ByteGeist`.

homelab.html

@@ -4,7 +4,7 @@
   <meta charset="UTF-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1.0" />
   <title>ByteGeist Windows Server / AD Homelab &mdash; Keith Casko</title>
-  <meta name="description" content="A verified Windows Server 2022 Active Directory homelab: DC01 with AD DS and DNS, FILE01 with role-based SMB shares, a Windows 11 domain client, and OPNsense firewall segmentation. Audited with PowerShell and WinRM." />
+  <meta name="description" content="A verified Windows Server 2022 Active Directory homelab: DC01 with AD DS and DNS, FILE01 with role-based SMB share access, a Windows 11 domain client, and an OPNsense routing/segmentation lab. Audited with PowerShell and WinRM." />
   <link rel="stylesheet" href="css/styles.css" />
 </head>
 <body class="homelab-page">
@@ -50,8 +50,8 @@
               kind of break/fix that shows up in interview questions.
             </p>
             <p>
-              Everything on this page was captured from the live lab on
+              The topology, command output, and configuration details on this page
-              <strong>2026-10-03</strong>. No fabricated screenshots, no stock art.
+              reflect the lab state verified on <strong>2026-10-03</strong>.
             </p>
             <div class="lab-tags">
               <span>Windows Server 2022</span>
@@ -87,7 +87,7 @@
               <tr><td><strong>DC01</strong></td><td>Windows Server 2022 Standard</td><td>Domain Controller</td><td>192.168.31.10</td><td>AD DS, DNS, PDC Emulator, Schema &amp; Domain Naming Master, Global Catalog</td></tr>
               <tr><td><strong>FILE01</strong></td><td>Windows Server 2022 Standard</td><td>Member server</td><td>192.168.31.20</td><td>SMB file services; <code>IT</code> departmental share</td></tr>
               <tr><td><strong>WIN11-01</strong></td><td>Windows 11 Education</td><td>Domain client</td><td>192.168.31.x (NAT)</td><td>Domain-joined workstation</td></tr>
-              <tr><td><strong>OPNSENSE</strong></td><td>OPNsense (FreeBSD)</td><td>Firewall / router</td><td>VMnet8 &harr; VMnet2</td><td>Segmenting server (VMnet8) and client (VMnet2) networks</td></tr>
+              <tr><td><strong>OPNSENSE</strong></td><td>OPNsense (FreeBSD)</td><td>Firewall / router</td><td>VMnet8 &harr; VMnet2</td><td>Segmentation lab; VMnet2 client placement is planned, while current systems remain on VMnet8</td></tr>
             </tbody>
           </table>
         </div>
@@ -172,6 +172,7 @@
                 <tr><td><code>CREATOR OWNER</code></td><td>Full on child objects</td><td>Yes</td></tr>
               </tbody>
             </table>
+            <p><strong>Hardening note:</strong> the inherited <code>BUILTIN\Users</code> entry is broader than the intended IT-only access model. The next ACL change is to disable inheritance and retain only the required administrative and IT group permissions.</p>
           </div>
           <div class="lab-panel">
             <h3>How it was verified</h3>
@@ -216,9 +217,13 @@ w32tm /resync /rediscover</pre>
             <h3>Problem: stale <code>dcdiag</code> SystemLog failure</h3>
             <p>
               A past unexpected shutdown left an entry that <code>dcdiag</code> flagged on
-              every run. Cleared the System log and re-ran <code>dcdiag /q</code>.
+              every run. I confirmed the stale shutdown event was the source, cleared the
+              lab System log, and re-ran <code>dcdiag /q</code>. In a production workflow,
+              I would export the log before clearing it to preserve evidence.
             </p>
-<pre class="lab-code">wevtutil cl System
+<pre class="lab-code"># Production-safe sequence:
+wevtutil epl System C:\Temp\System-before-clear.evtx
+wevtutil cl System
 dcdiag /q</pre>
             <p class="status-ok">Verified: <code>dcdiag /q</code> now silent (clean).</p>
             <h3 class="h3-sub">Client domain restoration (completed)</h3>
@@ -238,6 +243,9 @@ The command completed successfully
 PS&gt; whoami
 bglab\administrator</pre>
             <p class="status-ok">Verified: secure channel healthy, DC01 reachable as PDC / GC / KDC / DNS.</p>
+            <p><strong>Security note:</strong> this repair transcript was captured from a built-in
+              Administrator maintenance session. A separate named administrative account and
+              non-privileged daily workstation sign-in are the preferred next hardening step.</p>
           </div>
         </div>
       </div>
@@ -253,7 +261,7 @@ bglab\administrator</pre>
           <li><strong>Windows Server 2022</strong> &mdash; installed, promoted to a DC, operate day-to-day.</li>
           <li><strong>Active Directory</strong> &mdash; domain / forest design, OUs, users and groups, FSMO awareness, Global Catalog.</li>
           <li><strong>DNS</strong> &mdash; AD-integrated primary zones, reverse zones, understanding why the client's DNS must point at the DC.</li>
-          <li><strong>SMB &amp; NTFS</strong> &mdash; share creation, share-level vs. NTFS permissions, role-based access through groups.</li>
+          <li><strong>SMB &amp; NTFS</strong> &mdash; share creation, share-level vs. NTFS permissions, and role-based access through groups. The current IT folder still inherits <code>BUILTIN\Users</code> permissions; disabling inheritance and applying explicit ACLs is a documented hardening task.</li>
           <li><strong>PowerShell</strong> &mdash; <code>Get-AD*</code>, <code>Invoke-Command</code>, <code>Get-SmbShareAccess</code>, <code>Get-Acl</code>, <code>w32tm</code>, <code>Test-ComputerSecureChannel</code>.</li>
           <li><strong>Troubleshooting</strong> &mdash; recognizing <em>Local CMOS Clock</em> as a future Kerberos failure; diagnosing a broken secure channel as a bridged-NIC / wrong-DNS fault and restoring it with <code>Test-ComputerSecureChannel -Repair</code>.</li>
           <li><strong>Virtualization &amp; networking</strong> &mdash; VMware Workstation Pro, VMnet subnetting, OPNsense placement, bridged vs. NAT NIC implications.</li>

index.html

@@ -96,10 +96,10 @@
               <p>
                 Windows Server 2022 Active Directory lab in VMware: domain
                 controller with AD DS and DNS, member file server with
-                role-based SMB shares, Windows 11 domain client, and an
+                role-based SMB share access, a Windows 11 domain client, and
-                OPNsense firewall segmenting the networks. Audited and fixed
+                an OPNsense firewall/router used for segmentation practice.
-                real problems (PDC time source, stale event log) via
+                The current client and servers remain on VMnet8 while the
-                PowerShell and WinRM.
+                VMnet2 segmented client layout is the next networking exercise.
               </p>
               <a class="view-link" href="homelab.html">View Lab Details</a>
             </div>
@@ -311,15 +311,11 @@
           <div class="panel">
             <h3>Western Governors University</h3>
             <div class="meta">Bachelor of Science, Software Engineering &middot; In Progress</div>
-            <h4>Relevant Study</h4>
+            <h4>Recent Coursework</h4>
             <ul>
-              <li>Cloud Computing</li>
+              <li>Cloud Foundations &mdash; completed</li>
-              <li>Networking</li>
+              <li>Java Frameworks &mdash; completed project work</li>
-              <li>IT Operations</li>
+              <li>Hardware &amp; Operating Systems Essentials &mdash; current study</li>
-              <li>Software Development</li>
-              <li>Java</li>
-              <li>Web Development</li>
-              <li>Security Fundamentals</li>
             </ul>
           </div>