Enterprise IT Helpdesk Lab is a Windows Server infrastructure project designed to simulate a small corporate IT environment.
The lab includes a Windows Server domain controller, Active Directory administration, DNS, DHCP, departmental file shares, NTFS permissions, Group Policy Objects, security auditing, PowerShell automation and Jira Service Management ticketing.
The goal of this project is to demonstrate practical skills relevant to IT Support, Helpdesk, Junior Systems Administration, Active Directory administration and Service Desk roles.
This lab simulates an organisation with multiple departments:
- Sales
- Administration
- Human Resources
- IT
Each department has dedicated users, groups, workstations, shared folders and permissions.
The environment also includes a Jira Service Management portal to manage IT incidents and service requests such as:
- Password reset requests
- Shared folder access requests
- New employee onboarding
- Employee offboarding
- Account access incidents
- Security-related access investigations
The environment contains the following virtual machines:
| Machine | Operating System | Role |
|---|---|---|
| DC01 | Windows Server 2022 | Active Directory, DNS, DHCP, File Server, GPOs and auditing |
| PC-VENTAS | Windows 11 Pro | Sales workstation |
| PC-ADMIN | Windows 10 Pro | Administration workstation |
| PC-IT | Windows 11 Pro | IT workstation |
| Component | Configuration |
|---|---|
| Domain | corp.local |
| NetBIOS Name | CORP |
| Internal Network | LAB-CORP |
| Subnet | 192.168.50.0/24 |
| Domain Controller | DC01 |
| DC01 Internal IP | 192.168.50.10 |
| DHCP Range | 192.168.50.100 - 192.168.50.200 |
| DNS Server | 192.168.50.10 |
The domain controller uses two network adapters:
- NAT adapter for Internet access.
- Internal Network adapter for corporate traffic between virtual machines.
The lab includes a Windows Server domain controller and three Windows clients representing different departments.
Active Directory Domain Services was deployed on DC01 using the corp.local domain.
The environment uses a structured OU design to separate users, computers, groups and disabled accounts.
corp.local
│
├── OU_Users
│ ├── Sales
│ ├── Administration
│ ├── HR
│ └── IT
│
├── OU_Computers
│ ├── Sales-PCs
│ ├── Administration-PCs
│ └── IT-PCs
│
├── OU_Groups
│
├── OU_Servers
│
└── OU_Disabled_Users
Departmental access is managed through Active Directory security groups instead of assigning permissions directly to individual users.
Examples of groups created:
GG_Sales
GG_Administration
GG_HR
GG_IT
GG_File_Sales_RW
GG_File_Administration_RW
GG_File_HR_RW
GG_File_IT_RW
This approach allows permissions to be centrally managed and simplifies onboarding, offboarding and access requests.
DHCP was configured on DC01 to automatically provide IP addresses and DNS settings to client machines.
The DHCP scope provides:
IP Range: 192.168.50.100 - 192.168.50.200
DNS Server: 192.168.50.10
DNS Domain: corp.local
Client machines automatically receive their network configuration from the DHCP server.
All client workstations were joined to the corp.local domain.
Example validation from PC-VENTAS:
The workstation confirms:
User: CORP\mgarcia
Computer: PC-VENTAS
Domain: corp.local
A file server structure was created on DC01 to simulate departmental shared resources.
Shared folders include:
\\DC01\Sales
\\DC01\Administration
\\DC01\HR
\\DC01\IT
\\DC01\Public
Each departmental folder is protected through NTFS permissions using Active Directory groups.
The HR folder grants access only to:
SYSTEM
Administrators
GG_File_HR_RW
This prevents users outside the HR department from accessing confidential content.
A Sales user is denied access to the HR shared folder:
Group Policy Objects were used to automate user configuration and apply corporate restrictions.
The following GPOs were created:
GPO_Sales_Map_Drives
GPO_Corporate_Wallpaper
GPO_Sales_ControlPanel_Restriction
GPO_Audit_Security_Events
Sales users automatically receive mapped network drives when logging in.
Configured mappings:
S: → \\DC01\Sales
P: → \\DC01\Public
This confirms that the policy was successfully applied to the Sales user workstation.
Security auditing was configured through Group Policy and NTFS auditing settings.
The lab records events related to:
- Failed logon attempts
- Account lockouts
- Account management changes
- Security group changes
- Active Directory object changes
- File system access attempts
The HR folder was configured as a sensitive resource with auditing enabled.
This allows administrators to investigate unauthorised access attempts and review the affected user, resource and action.
Example investigation scenario:
User: CORP\mgarcia
Resource: C:\Shares\HR
Event ID: 4663
Result: Access denied
Cause: User was not a member of GG_File_HR_RW
PowerShell scripts were created to automate common Active Directory administration tasks.
scripts/
├── 01-Onboard-User.ps1
├── 02-Disable-User.ps1
└── 03-Grant-Department-Access.ps1
The onboarding script automates the creation of a new Active Directory user.
It performs the following actions:
- Creates the user account.
- Places the user in the correct OU.
- Adds the user to departmental security groups.
- Adds the user to file access groups.
- Forces a password change on first logon.
The offboarding script:
- Disables the user account.
- Removes access-related group memberships.
- Updates the account description.
- Moves the user to
OU_Disabled_Users.
The access management script can grant or revoke access to departmental shared folders by modifying the appropriate Active Directory security group.
Example use case:
User: mgarcia
Requested Resource: \\DC01\HR
Action: Grant temporary access
Group Added: GG_File_HR_RW
A Jira Service Management project named IT Service Desk was created to simulate an IT support workflow.
The portal includes requests such as:
Restablecer contraseña
Solicitar acceso a carpeta compartida
No puedo iniciar sesión
Problema con equipo o conexión
Alta de nuevo empleado
Baja de empleado
The Jira project is used to track incidents, service requests, onboarding processes, offboarding processes and access-related tasks.
Request: Temporary access to HR documentation
User: CORP\mgarcia
Technical Action:
- Executed 03-Grant-Department-Access.ps1
- Added user to GG_File_HR_RW
- Validated access from PC-VENTAS
- Removed access after the request was completed
Result:
Request resolved and access successfully revoked after use.
This project demonstrates practical experience with:
- Windows Server 2022
- Active Directory Domain Services
- DNS
- DHCP
- User and group management
- Organisational Units
- NTFS permissions
- Shared folders
- Group Policy Objects
- Security auditing
- Event Viewer investigation
- PowerShell automation
- User onboarding and offboarding
- Access management
- Jira Service Management
- IT support workflows
- Incident documentation
Windows-Server-Jira-Lab/
│
├── Architecture/
│ └── network-architecture.png
│
├── documentation/
│ ├── 01-environment-setup.md
│ ├── 02-active-directory.md
│ ├── 03-network-dhcp-dns.md
│ ├── 04-file-server-permissions.md
│ ├── 05-group-policy.md
│ ├── 06-auditing-security.md
│ ├── 07-powershell-automation.md
│ └── 08-jira-service-management.md
│
├── scripts/
│ ├── 01-Onboard-User.ps1
│ ├── 02-Disable-User.ps1
│ └── 03-Grant-Department-Access.ps1
│
├── Screenshots/
│
├── README.md
│
└── .gitignore