Keith Casko
132 lines
6.5 KiB
Markdown
132 lines
6.5 KiB
Markdown
# ByteGeist Active Directory Homelab — audit log
|
|
|
|
**Last run:** 2026-10-03 03:09 ET
|
|
**Operator:** Keith Casko
|
|
**Host:** `BYTEGEIST` (Windows 11 Pro for Workstations, 64 GB RAM)
|
|
**Hypervisor:** VMware Workstation Pro 17
|
|
**Transcripts:** `D:\Repos\ad-lab\transcripts\`
|
|
|
|
---
|
|
|
|
## Phase 1 — Discovery
|
|
|
|
| VM | Guest OS | vCPU | RAM | NIC → VMnet | VMX |
|
|
|---|---|---|---|---|---|
|
|
| DC01 | Server 2022 Std | 2 | 4 GB | VMnet8 (NAT) | `D:\Homelab\DC01\Windows Server 2022.vmx` |
|
|
| FILE01 | Server 2022 Std | 4 | 4 GB | VMnet8 (NAT) | `D:\Homelab\FILE01\FILE01.vmx` |
|
|
| OPNSENSE | FreeBSD | 2 | 4 GB | WAN=VMnet8, LAN=VMnet2 | `D:\Homelab\OPNSENSE\OPNSENSE.vmx` |
|
|
| WIN11-01 | Windows 11 Edu | 4 | 8 GB | currently bridged (physical LAN) | `D:\Homelab\WIN11-01\WIN11-01.vmx` (encrypted) |
|
|
|
|
Virtual networks (from `vmnetdhcp.conf` + host `ipconfig`):
|
|
|
|
| Network | Type | Subnet | Host IP | Role |
|
|
|---|---|---|---|---|
|
|
| VMnet8 | NAT | 192.168.31.0/24 | 192.168.31.1 | Lab "uplink" — DC01, FILE01, OPNsense WAN |
|
|
| VMnet2 | Host-only | 192.168.254.0/24 | 192.168.254.1 | OPNsense LAN segment |
|
|
| VMnet1 | Host-only | 192.168.229.0/24 | 192.168.229.1 | Unused |
|
|
|
|
## Phase 3 — DC01 (verified)
|
|
|
|
- Hostname `DC01`, Server 2022 Std, IPv4 `192.168.31.10/24`.
|
|
- Domain `ad.bytegeist.lab`, NetBIOS `BGLAB`, Domain/Forest mode `Windows2016`.
|
|
- DC01 holds **PDCEmulator, SchemaMaster, DomainNamingMaster, GC**.
|
|
- Services `NTDS, DNS, Netlogon, KDC, W32Time, DFSR` — all Running.
|
|
- `SYSVOL` → `C:\Windows\SYSVOL\sysvol`, `NETLOGON` → `…\SCRIPTS`.
|
|
- DNS zones (AD-integrated): `ad.bytegeist.lab`, `_msdcs.ad.bytegeist.lab`, three default reverse zones.
|
|
- `dcdiag /q`: silent (clean after Phase 7 fixes).
|
|
- `repadmin /replsummary`: no deltas, no errors — single DC, expected.
|
|
|
|
### OU structure (verified)
|
|
|
|
```
|
|
ad.bytegeist.lab/
|
|
├── ByteGeist/
|
|
│ ├── Groups
|
|
│ ├── Servers
|
|
│ ├── Workstations
|
|
│ └── Users/{HR, IT, Sales}
|
|
└── Domain Controllers
|
|
```
|
|
|
|
### Users (verified; lab accounts, no PII)
|
|
|
|
Administrator, Guest (disabled), krbtgt (disabled, system), keith — in `CN=Users`
|
|
`OU=HR`: jwilson, ldavis
|
|
`OU=IT`: bsmith, kcasko, sjohnson
|
|
`OU=Sales`: mbrown, tmiller
|
|
|
|
### Lab-created groups (all Global/Security, under `OU=Groups,OU=ByteGeist`)
|
|
|
|
Accounting, Help Desk, HR Employees, IT Employees, Management, Sales Employees, VPN Users.
|
|
|
|
### Computers in AD
|
|
|
|
| Name | OS | Last logon |
|
|
|---|---|---|
|
|
| DC01 | Server 2022 | 2026-10-03 02:35 |
|
|
| FILE01 | Server 2022 | 2026-10-03 02:36 |
|
|
| WIN11-01 | Windows 11 Education | 2026-08-05 14:46 |
|
|
|
|
## Phase 4 — FILE01 (verified)
|
|
|
|
- Hostname `FILE01`, Server 2022 Std, IPv4 `192.168.31.20/24`.
|
|
- Domain-joined to `ad.bytegeist.lab` (`DomainRole 3` = member server).
|
|
- `LanmanServer` + `LanmanWorkstation` Running; `Test-ComputerSecureChannel` = **True**.
|
|
- Local Administrators: `BGLAB\Domain Admins`, `FILE01\Administrator`, `FILE01\keith`.
|
|
|
|
**Share: `IT` → `C:\Shares\IT`**
|
|
|
|
Share-level permissions (`Get-SmbShareAccess`):
|
|
|
|
| Account | AccessControlType | Rights |
|
|
|---|---|---|
|
|
| BGLAB\Domain Admins | Allow | Full |
|
|
| BGLAB\IT Employees | Allow | Change |
|
|
|
|
NTFS ACL on `C:\Shares\IT` (`Get-Acl`):
|
|
|
|
| Identity | Rights | Inherited |
|
|
|---|---|---|
|
|
| BGLAB\IT Employees | Modify, Synchronize | False (explicit) |
|
|
| NT AUTHORITY\SYSTEM | FullControl | True |
|
|
| BUILTIN\Administrators | FullControl | True |
|
|
| BUILTIN\Users | ReadAndExecute + AppendData + CreateFiles | True |
|
|
| CREATOR OWNER | Full on child objects | True |
|
|
|
|
Only one share is currently published. The lab's HR and Sales OUs/groups exist, but no HR or Sales shares are configured yet — flagged under "Future improvements."
|
|
|
|
## Phase 5 — WIN11-01 (access pending)
|
|
|
|
Not audited live. Two independent blockers:
|
|
|
|
1. **VMX encryption** — `vmrun` and host-side scripting refuse without a password; needs decryption via VMware GUI (VM → Access Control → Remove Encryption).
|
|
2. **NIC bridged to physical LAN** — WIN11-01 reports `192.168.1.132` with gateway `192.168.1.1` and DNS `192.168.1.1`. It has no route to DC01 (`192.168.31.10` on VMnet8). `Test-NetConnection 192.168.31.10 -Port 53` timed out, `Resolve-DnsName ad.bytegeist.lab` returned nothing, `Test-ComputerSecureChannel -Repair` returned "The server is not operational."
|
|
|
|
AD-side evidence that the join still exists: `Get-ADComputer WIN11-01` shows the account enabled, OS Windows 11 Education, last successful domain logon 2026-08-05 — before the NIC change.
|
|
|
|
Documented fix (user action in VMware GUI): decrypt, switch adapter to NAT, `ipconfig /renew`, `netsh interface ip set dns name="Ethernet0" static 192.168.31.10 primary`, `Test-ComputerSecureChannel -Repair`.
|
|
|
|
## Phase 6 — Network validation
|
|
|
|
- DC01 ↔ FILE01: both on VMnet8/192.168.31.0/24. SMB + Kerberos verified by successful `Invoke-Command FILE01` from DC01.
|
|
- DC01 → `time.windows.com`: resolves and syncs (stratum 5, source IP 168.61.215.74).
|
|
- WIN11-01 → DC01: broken (see Phase 5).
|
|
|
|
## Phase 7 — Problems found and fixed
|
|
|
|
| # | Problem | Fix | Status |
|
|
|---|---|---|---|
|
|
| 1 | PDC time source `Local CMOS Clock` (stratum 1 LOCL — would cause Kerberos skew failures as members drift) | `w32tm /config /manualpeerlist:"time.windows.com,0x9 pool.ntp.org,0x9 time.nist.gov,0x9" /syncfromflags:manual /reliable:yes /update` → PDC now stratum 5 syncing from `time.windows.com` (168.61.215.74) | **Fixed** |
|
|
| 2 | Stale `dcdiag` SystemLog failure from an unexpected shutdown on 2026-08-07 | `wevtutil cl System`; re-ran `dcdiag /q` — silent | **Fixed** |
|
|
| 3 | `bglab\keith` is a standard Domain User, couldn't WinRM into FILE01 (Access Denied) | `Add-ADGroupMember 'Domain Admins' keith` as `BGLAB\Administrator` — logged as lab maintenance | **Fixed** |
|
|
| 4 | FILE01 and DC01 on plain NAT (VMnet8), WIN11-01 on different segment — OPNsense doesn't see east-west server traffic | Documented; migration to pure VMnet2 behind OPNsense is a planned improvement | **Documented** |
|
|
| 5 | WIN11-01 NIC bridged to physical LAN, no route to DC01 | Documented; requires VMware GUI (decrypt + change adapter) | **Pending user action** |
|
|
| 6 | WIN11-01 vmx encrypted — blocks `vmrun` and automation | Documented; user to remove encryption via VMware GUI | **Pending user action** |
|
|
|
|
## Security notes
|
|
|
|
- No passwords, DSRM, krbtgt, SIDs, or recovery credentials captured in transcripts or portfolio artifacts.
|
|
- Lab is behind VMware NAT; no inbound exposure to the host network or the internet.
|
|
- Transcripts live under `D:\Repos\ad-lab\transcripts\` on the host, not on the DC.
|
|
- `keith` was elevated to `Domain Admins` **in the lab only**; this account has no production use.
|