keith-portfolio/docs/homelab-audit.md

# ByteGeist Active Directory Homelab — audit log

**Last run:** 2026-10-03 03:09 ET
**Operator:** Keith Casko
**Host:** `BYTEGEIST` (Windows 11 Pro for Workstations, 64 GB RAM)
**Hypervisor:** VMware Workstation Pro 17
**Transcripts:** `D:\Repos\ad-lab\transcripts\`

---

## Phase 1 — Discovery

| VM | Guest OS | vCPU | RAM | NIC → VMnet | VMX |
|---|---|---|---|---|---|
| DC01 | Server 2022 Std | 2 | 4 GB | VMnet8 (NAT) | `D:\Homelab\DC01\Windows Server 2022.vmx` |
| FILE01 | Server 2022 Std | 4 | 4 GB | VMnet8 (NAT) | `D:\Homelab\FILE01\FILE01.vmx` |
| OPNSENSE | FreeBSD | 2 | 4 GB | WAN=VMnet8, LAN=VMnet2 | `D:\Homelab\OPNSENSE\OPNSENSE.vmx` |
| WIN11-01 | Windows 11 Edu | 4 | 8 GB | VMnet8 (NAT) | `D:\Homelab\WIN11-01\WIN11-01.vmx` (decrypted 2026-10-03) |

Virtual networks (from `vmnetdhcp.conf` + host `ipconfig`):

| Network | Type | Subnet | Host IP | Role |
|---|---|---|---|---|
| VMnet8 | NAT | 192.168.31.0/24 | 192.168.31.1 | Lab "uplink" — DC01, FILE01, OPNsense WAN |
| VMnet2 | Host-only | 192.168.254.0/24 | 192.168.254.1 | OPNsense LAN segment |
| VMnet1 | Host-only | 192.168.229.0/24 | 192.168.229.1 | Unused |

## Phase 3 — DC01 (verified)

- Hostname `DC01`, Server 2022 Std, IPv4 `192.168.31.10/24`.
- Domain `ad.bytegeist.lab`, NetBIOS `BGLAB`, Domain/Forest mode `Windows2016`.
- DC01 holds **PDCEmulator, SchemaMaster, DomainNamingMaster, GC**.
- Services `NTDS, DNS, Netlogon, KDC, W32Time, DFSR` — all Running.
- `SYSVOL` → `C:\Windows\SYSVOL\sysvol`, `NETLOGON` → `…\SCRIPTS`.
- DNS zones (AD-integrated): `ad.bytegeist.lab`, `_msdcs.ad.bytegeist.lab`, three default reverse zones.
- `dcdiag /q`: silent (clean after Phase 7 fixes).
- `repadmin /replsummary`: no deltas, no errors — single DC, expected.

### OU structure (verified)

```
ad.bytegeist.lab/
├── ByteGeist/
│   ├── Groups
│   ├── Servers
│   ├── Workstations
│   └── Users/{HR, IT, Sales}
└── Domain Controllers
```

### Users (verified; lab accounts, no PII)

Administrator, Guest (disabled), krbtgt (disabled, system), keith — in `CN=Users`
`OU=HR`: jwilson, ldavis
`OU=IT`: bsmith, kcasko, sjohnson
`OU=Sales`: mbrown, tmiller

### Lab-created groups (all Global/Security, under `OU=Groups,OU=ByteGeist`)

Accounting, Help Desk, HR Employees, IT Employees, Management, Sales Employees, VPN Users.

### Computers in AD

| Name | OS | Last logon |
|---|---|---|
| DC01 | Server 2022 | 2026-10-03 02:35 |
| FILE01 | Server 2022 | 2026-10-03 02:36 |
| WIN11-01 | Windows 11 Education | 2026-08-05 14:46 |

## Phase 4 — FILE01 (verified)

- Hostname `FILE01`, Server 2022 Std, IPv4 `192.168.31.20/24`.
- Domain-joined to `ad.bytegeist.lab` (`DomainRole 3` = member server).
- `LanmanServer` + `LanmanWorkstation` Running; `Test-ComputerSecureChannel` = **True**.
- Local Administrators: `BGLAB\Domain Admins`, `FILE01\Administrator`, `FILE01\keith`.

**Share: `IT` → `C:\Shares\IT`**

Share-level permissions (`Get-SmbShareAccess`):

| Account | AccessControlType | Rights |
|---|---|---|
| BGLAB\Domain Admins | Allow | Full |
| BGLAB\IT Employees | Allow | Change |

NTFS ACL on `C:\Shares\IT` (`Get-Acl`):

| Identity | Rights | Inherited |
|---|---|---|
| BGLAB\IT Employees | Modify, Synchronize | False (explicit) |
| NT AUTHORITY\SYSTEM | FullControl | True |
| BUILTIN\Administrators | FullControl | True |
| BUILTIN\Users | ReadAndExecute + AppendData + CreateFiles | True |
| CREATOR OWNER | Full on child objects | True |

Only one share is currently published. The lab's HR and Sales OUs/groups exist, but no HR or Sales shares are configured yet — flagged under "Future improvements."

## Phase 5 — WIN11-01 (restored 2026-10-03)

Originally blocked by two issues: the vmx was encrypted (blocking `vmrun` automation) and the NIC was bridged to the physical LAN (`192.168.1.132`, gateway `192.168.1.1`), leaving no route to DC01 (`192.168.31.10` on VMnet8). `Test-NetConnection 192.168.31.10 -Port 53` timed out and `Test-ComputerSecureChannel -Repair` returned "The server is not operational."

Resolution, performed in the guest as `BGLAB\Administrator`:

1. Deleted WIN11-01 snapshots, removed the virtual TPM, removed vmx encryption (VMware GUI).
2. Changed the network adapter from Bridged to NAT (VMnet8).
3. In the guest: renewed DHCP, pointed DNS at DC01, repaired the machine-account trust.

Verification output (2026-10-03):

```powershell
PS C:\Users\keith> Test-ComputerSecureChannel -Verbose
VERBOSE: Performing the operation "Test-ComputerSecureChannel" on target "WIN11-01".
True
VERBOSE: The secure channel between the local computer and the domain ad.bytegeist.lab is in good condition.

PS C:\Users\keith> nltest /dsgetdc:ad.bytegeist.lab
           DC: \\DC01.ad.bytegeist.lab
      Address: \\192.168.31.10
     Dom Name: ad.bytegeist.lab
  Forest Name: ad.bytegeist.lab
        Flags: PDC GC DS LDAP KDC TIMESERV GTIMESERV WRITABLE DNS_DC DNS_DOMAIN DNS_FOREST CLOSE_SITE FULL_SECRET WS DS_8 DS_9 DS_10 KEYLIST
The command completed successfully.

PS C:\Users\keith> whoami
bglab\administrator
```

`Get-ADComputer WIN11-01` already showed the account enabled (OS Windows 11 Education); the repair restored live trust without a rejoin.

## Phase 6 — Network validation

- DC01 ↔ FILE01: both on VMnet8/192.168.31.0/24. SMB + Kerberos verified by successful `Invoke-Command FILE01` from DC01.
- DC01 → `time.windows.com`: resolves and syncs (stratum 5, source IP 168.61.215.74).
- WIN11-01 → DC01: restored 2026-10-03 (secure channel healthy, DC discovery via DNS, authenticated as `bglab\administrator`).

## Phase 7 — Problems found and fixed

| # | Problem | Fix | Status |
|---|---|---|---|
| 1 | PDC time source `Local CMOS Clock` (stratum 1 LOCL — would cause Kerberos skew failures as members drift) | `w32tm /config /manualpeerlist:"time.windows.com,0x9 pool.ntp.org,0x9 time.nist.gov,0x9" /syncfromflags:manual /reliable:yes /update` → PDC now stratum 5 syncing from `time.windows.com` (168.61.215.74) | **Fixed** |
| 2 | Stale `dcdiag` SystemLog failure from an unexpected shutdown on 2026-08-07 | Confirmed the stale shutdown event was the cause, cleared the lab System log, and re-ran `dcdiag /q` — silent. Production-safe procedure would export first with `wevtutil epl System <path>.evtx` before clearing. | **Fixed / procedure improved** |
| 3 | `bglab\keith` is a standard Domain User, couldn't WinRM into FILE01 (Access Denied) | Temporarily added `keith` to `Domain Admins` for the lab audit. This restored WinRM access but is documented as a hardening gap; target state is a separate named admin account. | **Functional / hardening pending** |
| 4 | FILE01 and DC01 on plain NAT (VMnet8), WIN11-01 on different segment — OPNsense doesn't see east-west server traffic | Documented; migration to pure VMnet2 behind OPNsense is a planned improvement | **Documented** |
| 5 | WIN11-01 NIC bridged to physical LAN, no route to DC01 | Snapshots removed, TPM removed, vmx decrypted, adapter switched to NAT, DNS pointed at DC01, `Test-ComputerSecureChannel -Repair` — verified `True` | **Fixed** |
| 6 | WIN11-01 vmx encrypted — blocked `vmrun` and automation | Removed via VMware GUI after snapshot/TPM removal | **Fixed** |

## Security notes

- No passwords, DSRM, krbtgt, SIDs, or recovery credentials captured in transcripts or portfolio artifacts.
- Lab is behind VMware NAT; no inbound exposure to the host network or the internet.
- Transcripts live under `D:\Repos\ad-lab\transcripts\` on the host, not on the DC.
- `keith` was elevated to `Domain Admins` **in the lab only** for this audit. That is not the target operating model; the hardening plan is a separate named admin account plus a non-privileged daily account.