keith-portfolio/docs/homelab-audit.md

ByteGeist Active Directory Homelab — audit log

Last run: 2026-10-03 03:09 ET Operator: Keith Casko Host: BYTEGEIST (Windows 11 Pro for Workstations, 64 GB RAM) Hypervisor: VMware Workstation Pro 17 Transcripts: D:\Repos\ad-lab\transcripts\

---

Phase 1 — Discovery

VM	Guest OS	vCPU	RAM	NIC → VMnet	VMX
DC01	Server 2022 Std	2	4 GB	VMnet8 (NAT)	D:\Homelab\DC01\Windows Server 2022.vmx
FILE01	Server 2022 Std	4	4 GB	VMnet8 (NAT)	D:\Homelab\FILE01\FILE01.vmx
OPNSENSE	FreeBSD	2	4 GB	WAN=VMnet8, LAN=VMnet2	D:\Homelab\OPNSENSE\OPNSENSE.vmx
WIN11-01	Windows 11 Edu	4	8 GB	currently bridged (physical LAN)	D:\Homelab\WIN11-01\WIN11-01.vmx (encrypted)

Virtual networks (from vmnetdhcp.conf + host ipconfig):

Network	Type	Subnet	Host IP	Role
VMnet8	NAT	192.168.31.0/24	192.168.31.1	Lab "uplink" — DC01, FILE01, OPNsense WAN
VMnet2	Host-only	192.168.254.0/24	192.168.254.1	OPNsense LAN segment
VMnet1	Host-only	192.168.229.0/24	192.168.229.1	Unused

Phase 3 — DC01 (verified)

• Hostname DC01, Server 2022 Std, IPv4 192.168.31.10/24.
• Domain ad.bytegeist.lab, NetBIOS BGLAB, Domain/Forest mode Windows2016.
• DC01 holds PDCEmulator, SchemaMaster, DomainNamingMaster, GC.
• Services NTDS, DNS, Netlogon, KDC, W32Time, DFSR — all Running.
• SYSVOL → C:\Windows\SYSVOL\sysvol, NETLOGON → …\SCRIPTS.
• DNS zones (AD-integrated): ad.bytegeist.lab, _msdcs.ad.bytegeist.lab, three default reverse zones.
• dcdiag /q: silent (clean after Phase 7 fixes).
• repadmin /replsummary: no deltas, no errors — single DC, expected.

OU structure (verified)

ad.bytegeist.lab/
├── ByteGeist/
│   ├── Groups
│   ├── Servers
│   ├── Workstations
│   └── Users/{HR, IT, Sales}
└── Domain Controllers

Users (verified; lab accounts, no PII)

Administrator, Guest (disabled), krbtgt (disabled, system), keith — in CN=Users OU=HR: jwilson, ldavis OU=IT: bsmith, kcasko, sjohnson OU=Sales: mbrown, tmiller

Lab-created groups (all Global/Security, under OU=Groups,OU=ByteGeist)

Accounting, Help Desk, HR Employees, IT Employees, Management, Sales Employees, VPN Users.

Computers in AD

Name	OS	Last logon
DC01	Server 2022	2026-10-03 02:35
FILE01	Server 2022	2026-10-03 02:36
WIN11-01	Windows 11 Education	2026-08-05 14:46

Phase 4 — FILE01 (verified)

• Hostname FILE01, Server 2022 Std, IPv4 192.168.31.20/24.
• Domain-joined to ad.bytegeist.lab (DomainRole 3 = member server).
• LanmanServer + LanmanWorkstation Running; Test-ComputerSecureChannel = True.
• Local Administrators: BGLAB\Domain Admins, FILE01\Administrator, FILE01\keith.

Share: IT → C:\Shares\IT

Share-level permissions (Get-SmbShareAccess):

Account	AccessControlType	Rights
BGLAB\Domain Admins	Allow	Full
BGLAB\IT Employees	Allow	Change

NTFS ACL on C:\Shares\IT (Get-Acl):

Identity	Rights	Inherited
BGLAB\IT Employees	Modify, Synchronize	False (explicit)
NT AUTHORITY\SYSTEM	FullControl	True
BUILTIN\Administrators	FullControl	True
BUILTIN\Users	ReadAndExecute + AppendData + CreateFiles	True
CREATOR OWNER	Full on child objects	True

Only one share is currently published. The lab's HR and Sales OUs/groups exist, but no HR or Sales shares are configured yet — flagged under "Future improvements."

Phase 5 — WIN11-01 (access pending)

Not audited live. Two independent blockers:

1. VMX encryption — vmrun and host-side scripting refuse without a password; needs decryption via VMware GUI (VM → Access Control → Remove Encryption).
2. NIC bridged to physical LAN — WIN11-01 reports 192.168.1.132 with gateway 192.168.1.1 and DNS 192.168.1.1. It has no route to DC01 (192.168.31.10 on VMnet8). Test-NetConnection 192.168.31.10 -Port 53 timed out, Resolve-DnsName ad.bytegeist.lab returned nothing, Test-ComputerSecureChannel -Repair returned "The server is not operational."

AD-side evidence that the join still exists: Get-ADComputer WIN11-01 shows the account enabled, OS Windows 11 Education, last successful domain logon 2026-08-05 — before the NIC change.

Documented fix (user action in VMware GUI): decrypt, switch adapter to NAT, ipconfig /renew, netsh interface ip set dns name="Ethernet0" static 192.168.31.10 primary, Test-ComputerSecureChannel -Repair.

Phase 6 — Network validation

• DC01 ↔ FILE01: both on VMnet8/192.168.31.0/24. SMB + Kerberos verified by successful Invoke-Command FILE01 from DC01.
• DC01 → time.windows.com: resolves and syncs (stratum 5, source IP 168.61.215.74).
• WIN11-01 → DC01: broken (see Phase 5).

Phase 7 — Problems found and fixed

#	Problem	Fix	Status
1	PDC time source Local CMOS Clock (stratum 1 LOCL — would cause Kerberos skew failures as members drift)	w32tm /config /manualpeerlist:"time.windows.com,0x9 pool.ntp.org,0x9 time.nist.gov,0x9" /syncfromflags:manual /reliable:yes /update → PDC now stratum 5 syncing from time.windows.com (168.61.215.74)	Fixed
2	Stale dcdiag SystemLog failure from an unexpected shutdown on 2026-08-07	wevtutil cl System; re-ran dcdiag /q — silent	Fixed
3	bglab\keith is a standard Domain User, couldn't WinRM into FILE01 (Access Denied)	Add-ADGroupMember 'Domain Admins' keith as BGLAB\Administrator — logged as lab maintenance	Fixed
4	FILE01 and DC01 on plain NAT (VMnet8), WIN11-01 on different segment — OPNsense doesn't see east-west server traffic	Documented; migration to pure VMnet2 behind OPNsense is a planned improvement	Documented
5	WIN11-01 NIC bridged to physical LAN, no route to DC01	Documented; requires VMware GUI (decrypt + change adapter)	Pending user action
6	WIN11-01 vmx encrypted — blocks vmrun and automation	Documented; user to remove encryption via VMware GUI	Pending user action

Security notes

• No passwords, DSRM, krbtgt, SIDs, or recovery credentials captured in transcripts or portfolio artifacts.
• Lab is behind VMware NAT; no inbound exposure to the host network or the internet.
• Transcripts live under D:\Repos\ad-lab\transcripts\ on the host, not on the DC.
• keith was elevated to Domain Admins in the lab only; this account has no production use.