keith-portfolio/docs/homelab-audit.md

ByteGeist Active Directory Homelab — audit log

Last run: 2026-10-03 03:09 ET Operator: Keith Casko Host: BYTEGEIST (Windows 11 Pro for Workstations, 64 GB RAM) Hypervisor: VMware Workstation Pro 17 Transcripts: D:\Repos\ad-lab\transcripts\

---

Phase 1 — Discovery

VM	Guest OS	vCPU	RAM	NIC → VMnet	VMX
DC01	Server 2022 Std	2	4 GB	VMnet8 (NAT)	D:\Homelab\DC01\Windows Server 2022.vmx
FILE01	Server 2022 Std	4	4 GB	VMnet8 (NAT)	D:\Homelab\FILE01\FILE01.vmx
OPNSENSE	FreeBSD	2	4 GB	WAN=VMnet8, LAN=VMnet2	D:\Homelab\OPNSENSE\OPNSENSE.vmx
WIN11-01	Windows 11 Edu	4	8 GB	VMnet8 (NAT)	D:\Homelab\WIN11-01\WIN11-01.vmx (decrypted 2026-10-03)

Virtual networks (from vmnetdhcp.conf + host ipconfig):

Network	Type	Subnet	Host IP	Role
VMnet8	NAT	192.168.31.0/24	192.168.31.1	Lab "uplink" — DC01, FILE01, OPNsense WAN
VMnet2	Host-only	192.168.254.0/24	192.168.254.1	OPNsense LAN segment
VMnet1	Host-only	192.168.229.0/24	192.168.229.1	Unused

Phase 3 — DC01 (verified)

• Hostname DC01, Server 2022 Std, IPv4 192.168.31.10/24.
• Domain ad.bytegeist.lab, NetBIOS BGLAB, Domain/Forest mode Windows2016.
• DC01 holds PDCEmulator, SchemaMaster, DomainNamingMaster, GC.
• Services NTDS, DNS, Netlogon, KDC, W32Time, DFSR — all Running.
• SYSVOL → C:\Windows\SYSVOL\sysvol, NETLOGON → …\SCRIPTS.
• DNS zones (AD-integrated): ad.bytegeist.lab, _msdcs.ad.bytegeist.lab, three default reverse zones.
• dcdiag /q: silent (clean after Phase 7 fixes).
• repadmin /replsummary: no deltas, no errors — single DC, expected.

OU structure (verified)

ad.bytegeist.lab/
├── ByteGeist/
│   ├── Groups
│   ├── Servers
│   ├── Workstations
│   └── Users/{HR, IT, Sales}
└── Domain Controllers

Users (verified; lab accounts, no PII)

Administrator, Guest (disabled), krbtgt (disabled, system), keith — in CN=Users OU=HR: jwilson, ldavis OU=IT: bsmith, kcasko, sjohnson OU=Sales: mbrown, tmiller

Lab-created groups (all Global/Security, under OU=Groups,OU=ByteGeist)

Accounting, Help Desk, HR Employees, IT Employees, Management, Sales Employees, VPN Users.

Computers in AD

Name	OS	Last logon
DC01	Server 2022	2026-10-03 02:35
FILE01	Server 2022	2026-10-03 02:36
WIN11-01	Windows 11 Education	2026-08-05 14:46

Phase 4 — FILE01 (verified)

• Hostname FILE01, Server 2022 Std, IPv4 192.168.31.20/24.
• Domain-joined to ad.bytegeist.lab (DomainRole 3 = member server).
• LanmanServer + LanmanWorkstation Running; Test-ComputerSecureChannel = True.
• Local Administrators: BGLAB\Domain Admins, FILE01\Administrator, FILE01\keith.

Share: IT → C:\Shares\IT

Share-level permissions (Get-SmbShareAccess):

Account	AccessControlType	Rights
BGLAB\Domain Admins	Allow	Full
BGLAB\IT Employees	Allow	Change

NTFS ACL on C:\Shares\IT (Get-Acl):

Identity	Rights	Inherited
BGLAB\IT Employees	Modify, Synchronize	False (explicit)
NT AUTHORITY\SYSTEM	FullControl	True
BUILTIN\Administrators	FullControl	True
BUILTIN\Users	ReadAndExecute + AppendData + CreateFiles	True
CREATOR OWNER	Full on child objects	True

Only one share is currently published. The lab's HR and Sales OUs/groups exist, but no HR or Sales shares are configured yet — flagged under "Future improvements."

Phase 5 — WIN11-01 (restored 2026-10-03)

Originally blocked by two issues: the vmx was encrypted (blocking vmrun automation) and the NIC was bridged to the physical LAN (192.168.1.132, gateway 192.168.1.1), leaving no route to DC01 (192.168.31.10 on VMnet8). Test-NetConnection 192.168.31.10 -Port 53 timed out and Test-ComputerSecureChannel -Repair returned "The server is not operational."

Resolution, performed in the guest as BGLAB\Administrator:

1. Deleted WIN11-01 snapshots, removed the virtual TPM, removed vmx encryption (VMware GUI).
2. Changed the network adapter from Bridged to NAT (VMnet8).
3. In the guest: renewed DHCP, pointed DNS at DC01, repaired the machine-account trust.

Verification output (2026-10-03):

PS C:\Users\keith> Test-ComputerSecureChannel -Verbose
VERBOSE: Performing the operation "Test-ComputerSecureChannel" on target "WIN11-01".
True
VERBOSE: The secure channel between the local computer and the domain ad.bytegeist.lab is in good condition.

PS C:\Users\keith> nltest /dsgetdc:ad.bytegeist.lab
           DC: \\DC01.ad.bytegeist.lab
      Address: \\192.168.31.10
     Dom Name: ad.bytegeist.lab
  Forest Name: ad.bytegeist.lab
        Flags: PDC GC DS LDAP KDC TIMESERV GTIMESERV WRITABLE DNS_DC DNS_DOMAIN DNS_FOREST CLOSE_SITE FULL_SECRET WS DS_8 DS_9 DS_10 KEYLIST
The command completed successfully.

PS C:\Users\keith> whoami
bglab\administrator

Get-ADComputer WIN11-01 already showed the account enabled (OS Windows 11 Education); the repair restored live trust without a rejoin.

Phase 6 — Network validation

• DC01 ↔ FILE01: both on VMnet8/192.168.31.0/24. SMB + Kerberos verified by successful Invoke-Command FILE01 from DC01.
• DC01 → time.windows.com: resolves and syncs (stratum 5, source IP 168.61.215.74).
• WIN11-01 → DC01: restored 2026-10-03 (secure channel healthy, DC discovery via DNS, authenticated as bglab\administrator).

Phase 7 — Problems found and fixed

#	Problem	Fix	Status
1	PDC time source Local CMOS Clock (stratum 1 LOCL — would cause Kerberos skew failures as members drift)	w32tm /config /manualpeerlist:"time.windows.com,0x9 pool.ntp.org,0x9 time.nist.gov,0x9" /syncfromflags:manual /reliable:yes /update → PDC now stratum 5 syncing from time.windows.com (168.61.215.74)	Fixed
2	Stale dcdiag SystemLog failure from an unexpected shutdown on 2026-08-07	Confirmed the stale shutdown event was the cause, cleared the lab System log, and re-ran dcdiag /q — silent. Production-safe procedure would export first with wevtutil epl System <path>.evtx before clearing.	Fixed / procedure improved
3	bglab\keith is a standard Domain User, couldn't WinRM into FILE01 (Access Denied)	Temporarily added keith to Domain Admins for the lab audit. This restored WinRM access but is documented as a hardening gap; target state is a separate named admin account.	Functional / hardening pending
4	FILE01 and DC01 on plain NAT (VMnet8), WIN11-01 on different segment — OPNsense doesn't see east-west server traffic	Documented; migration to pure VMnet2 behind OPNsense is a planned improvement	Documented
5	WIN11-01 NIC bridged to physical LAN, no route to DC01	Snapshots removed, TPM removed, vmx decrypted, adapter switched to NAT, DNS pointed at DC01, Test-ComputerSecureChannel -Repair — verified True	Fixed
6	WIN11-01 vmx encrypted — blocked vmrun and automation	Removed via VMware GUI after snapshot/TPM removal	Fixed

Security notes

• No passwords, DSRM, krbtgt, SIDs, or recovery credentials captured in transcripts or portfolio artifacts.
• Lab is behind VMware NAT; no inbound exposure to the host network or the internet.
• Transcripts live under D:\Repos\ad-lab\transcripts\ on the host, not on the DC.
• keith was elevated to Domain Admins in the lab only for this audit. That is not the target operating model; the hardening plan is a separate named admin account plus a non-privileged daily account.