# ByteGeist Active Directory Homelab — audit log

**Last run:** 2026-10-03 03:09 ET
**Operator:** Keith Casko
**Host:** `BYTEGEIST` (Windows 11 Pro for Workstations, 64 GB RAM)
**Hypervisor:** VMware Workstation Pro 17
**Transcripts:** `D:\Repos\ad-lab\transcripts\`

---

## Phase 1 — Discovery

| VM | Guest OS | vCPU | RAM | NIC → VMnet | VMX |
|---|---|---|---|---|---|
| DC01 | Server 2022 Std | 2 | 4 GB | VMnet8 (NAT) | `D:\Homelab\DC01\Windows Server 2022.vmx` |
| FILE01 | Server 2022 Std | 4 | 4 GB | VMnet8 (NAT) | `D:\Homelab\FILE01\FILE01.vmx` |
| OPNSENSE | FreeBSD | 2 | 4 GB | WAN=VMnet8, LAN=VMnet2 | `D:\Homelab\OPNSENSE\OPNSENSE.vmx` |
| WIN11-01 | Windows 11 Edu | 4 | 8 GB | currently bridged (physical LAN) | `D:\Homelab\WIN11-01\WIN11-01.vmx` (encrypted) |

Virtual networks (from `vmnetdhcp.conf` + host `ipconfig`):

| Network | Type | Subnet | Host IP | Role |
|---|---|---|---|---|
| VMnet8 | NAT | 192.168.31.0/24 | 192.168.31.1 | Lab "uplink" — DC01, FILE01, OPNsense WAN |
| VMnet2 | Host-only | 192.168.254.0/24 | 192.168.254.1 | OPNsense LAN segment |
| VMnet1 | Host-only | 192.168.229.0/24 | 192.168.229.1 | Unused |

## Phase 3 — DC01 (verified)

- Hostname `DC01`, Server 2022 Std, IPv4 `192.168.31.10/24`.
- Domain `ad.bytegeist.lab`, NetBIOS `BGLAB`, Domain/Forest mode `Windows2016`.
- DC01 holds **PDCEmulator, SchemaMaster, DomainNamingMaster, GC**.
- Services `NTDS, DNS, Netlogon, KDC, W32Time, DFSR` — all Running.
- `SYSVOL` → `C:\Windows\SYSVOL\sysvol`, `NETLOGON` → `…\SCRIPTS`.
- DNS zones (AD-integrated): `ad.bytegeist.lab`, `_msdcs.ad.bytegeist.lab`, three default reverse zones.
- `dcdiag /q`: silent (clean after Phase 7 fixes).
- `repadmin /replsummary`: no deltas, no errors — single DC, expected.

### OU structure (verified)

```
ad.bytegeist.lab/
├── ByteGeist/
│   ├── Groups
│   ├── Servers
│   ├── Workstations
│   └── Users/{HR, IT, Sales}
└── Domain Controllers
```

### Users (verified; lab accounts, no PII)

Administrator, Guest (disabled), krbtgt (disabled, system), keith — in `CN=Users`
`OU=HR`: jwilson, ldavis
`OU=IT`: bsmith, kcasko, sjohnson
`OU=Sales`: mbrown, tmiller

### Lab-created groups (all Global/Security, under `OU=Groups,OU=ByteGeist`)

Accounting, Help Desk, HR Employees, IT Employees, Management, Sales Employees, VPN Users.

### Computers in AD

| Name | OS | Last logon |
|---|---|---|
| DC01 | Server 2022 | 2026-10-03 02:35 |
| FILE01 | Server 2022 | 2026-10-03 02:36 |
| WIN11-01 | Windows 11 Education | 2026-08-05 14:46 |

## Phase 4 — FILE01 (verified)

- Hostname `FILE01`, Server 2022 Std, IPv4 `192.168.31.20/24`.
- Domain-joined to `ad.bytegeist.lab` (`DomainRole 3` = member server).
- `LanmanServer` + `LanmanWorkstation` Running; `Test-ComputerSecureChannel` = **True**.
- Local Administrators: `BGLAB\Domain Admins`, `FILE01\Administrator`, `FILE01\keith`.

**Share: `IT` → `C:\Shares\IT`**

Share-level permissions (`Get-SmbShareAccess`):

| Account | AccessControlType | Rights |
|---|---|---|
| BGLAB\Domain Admins | Allow | Full |
| BGLAB\IT Employees | Allow | Change |

NTFS ACL on `C:\Shares\IT` (`Get-Acl`):

| Identity | Rights | Inherited |
|---|---|---|
| BGLAB\IT Employees | Modify, Synchronize | False (explicit) |
| NT AUTHORITY\SYSTEM | FullControl | True |
| BUILTIN\Administrators | FullControl | True |
| BUILTIN\Users | ReadAndExecute + AppendData + CreateFiles | True |
| CREATOR OWNER | Full on child objects | True |

Only one share is currently published. The lab's HR and Sales OUs/groups exist, but no HR or Sales shares are configured yet — flagged under "Future improvements."

## Phase 5 — WIN11-01 (access pending)

Not audited live. Two independent blockers:

1. **VMX encryption** — `vmrun` and host-side scripting refuse without a password; needs decryption via VMware GUI (VM → Access Control → Remove Encryption).
2. **NIC bridged to physical LAN** — WIN11-01 reports `192.168.1.132` with gateway `192.168.1.1` and DNS `192.168.1.1`. It has no route to DC01 (`192.168.31.10` on VMnet8). `Test-NetConnection 192.168.31.10 -Port 53` timed out, `Resolve-DnsName ad.bytegeist.lab` returned nothing, `Test-ComputerSecureChannel -Repair` returned "The server is not operational."

AD-side evidence that the join still exists: `Get-ADComputer WIN11-01` shows the account enabled, OS Windows 11 Education, last successful domain logon 2026-08-05 — before the NIC change.

Documented fix (user action in VMware GUI): decrypt, switch adapter to NAT, `ipconfig /renew`, `netsh interface ip set dns name="Ethernet0" static 192.168.31.10 primary`, `Test-ComputerSecureChannel -Repair`.

## Phase 6 — Network validation

- DC01 ↔ FILE01: both on VMnet8/192.168.31.0/24. SMB + Kerberos verified by successful `Invoke-Command FILE01` from DC01.
- DC01 → `time.windows.com`: resolves and syncs (stratum 5, source IP 168.61.215.74).
- WIN11-01 → DC01: broken (see Phase 5).

## Phase 7 — Problems found and fixed

| # | Problem | Fix | Status |
|---|---|---|---|
| 1 | PDC time source `Local CMOS Clock` (stratum 1 LOCL — would cause Kerberos skew failures as members drift) | `w32tm /config /manualpeerlist:"time.windows.com,0x9 pool.ntp.org,0x9 time.nist.gov,0x9" /syncfromflags:manual /reliable:yes /update` → PDC now stratum 5 syncing from `time.windows.com` (168.61.215.74) | **Fixed** |
| 2 | Stale `dcdiag` SystemLog failure from an unexpected shutdown on 2026-08-07 | `wevtutil cl System`; re-ran `dcdiag /q` — silent | **Fixed** |
| 3 | `bglab\keith` is a standard Domain User, couldn't WinRM into FILE01 (Access Denied) | `Add-ADGroupMember 'Domain Admins' keith` as `BGLAB\Administrator` — logged as lab maintenance | **Fixed** |
| 4 | FILE01 and DC01 on plain NAT (VMnet8), WIN11-01 on different segment — OPNsense doesn't see east-west server traffic | Documented; migration to pure VMnet2 behind OPNsense is a planned improvement | **Documented** |
| 5 | WIN11-01 NIC bridged to physical LAN, no route to DC01 | Documented; requires VMware GUI (decrypt + change adapter) | **Pending user action** |
| 6 | WIN11-01 vmx encrypted — blocks `vmrun` and automation | Documented; user to remove encryption via VMware GUI | **Pending user action** |

## Security notes

- No passwords, DSRM, krbtgt, SIDs, or recovery credentials captured in transcripts or portfolio artifacts.
- Lab is behind VMware NAT; no inbound exposure to the host network or the internet.
- Transcripts live under `D:\Repos\ad-lab\transcripts\` on the host, not on the DC.
- `keith` was elevated to `Domain Admins` **in the lab only**; this account has no production use.