A completed, validation-led Windows infrastructure homelab demonstrating Active Directory Domain Services, DNS, domain membership, identity administration, Group Policy, least-privilege file access, security auditing, and reusable PowerShell administration.
- Live case-study site: https://farhanrahmananik.github.io/windows-server-active-directory-lab/
- GitHub repository: https://github.com/farhanrahmananik/windows-server-active-directory-lab
This project implements a compact Windows Server Active Directory environment on Hyper-V and documents the result as a public-safe technical case study. The completed lab includes a Windows Server 2025 Domain Controller and DNS server, a domain-joined Windows 11 client, a structured directory hierarchy, fictional departmental identities, security policy, departmental SMB access, controlled login testing, Event Viewer evidence, and read-only PowerShell validation.
The environment is intentionally isolated and uses the fictional lab domain adlab.test. The repository contains sanitized evidence and troubleshooting records from work that was actually completed and validated.
| Project area | Verified result | Detailed documentation |
|---|---|---|
| Hyper-V and Windows installation | Complete and validated | Scope 1 |
| AD DS and DNS | SCOPE_2_STATUS=PASS |
Scope 2 |
| Windows client domain join | SCOPE_3_STATUS=PASS |
Scope 3 |
| OU structure, users, groups, and naming | Validated | Scope 4 |
| Mail-related AD attributes | SCOPE_5_ATTRIBUTE_STATUS=PASS |
Scope 5 |
| Workstation Group Policy baseline | SCOPE_6_STATUS=PASS |
Scope 6 |
| SMB and NTFS departmental access | SCOPE_7_STATUS=PASS and 9 of 9 access checks passed |
Scope 7 |
| Security policy, login, and Event Viewer | SCOPE_8_TECHNICAL_STATUS=PASS |
Scope 8 |
| Read-only PowerShell administration | SCOPE_9_POWERSHELL_STATUS=PASS |
Validation script |
| Recruiter-facing case-study site | Live on GitHub Pages | Open the case study |
- Build and validate an isolated two-VM Active Directory environment.
- Demonstrate practical administration across identity, DNS, Group Policy, access control, and auditing.
- Apply repeatable naming, OU placement, group-based authorization, and lifecycle documentation practices.
- Use PowerShell Direct and reusable PSSessions for safe, read-only validation.
- Record real troubleshooting observations and verified outcomes.
- Present the work through sanitized, recruiter-readable documentation and a static GitHub Pages case study.
| Area | Technologies |
|---|---|
| Physical host and virtualization | Windows 11 host, Hyper-V |
| Server platform | Windows Server 2025 Standard Evaluation with Desktop Experience |
| Client platform | Windows 11 Pro 25H2 |
| Identity and name resolution | Active Directory Domain Services, AD-integrated DNS |
| Policy and endpoint security | Group Policy, Microsoft Defender, Windows Defender Firewall |
| File access | SMB, Access-Based Enumeration, SMB encryption, NTFS permissions |
| Security validation | Domain account policy, Windows Event Viewer, Security event logs |
| Administration | Windows PowerShell 5.1, PowerShell Direct, reusable PSSessions |
| Documentation and portfolio | VS Code, Git, GitHub, GitHub Pages, HTML, CSS, JavaScript |
The lab runs on a Windows 11 Hyper-V host. Both Generation 2 virtual machines use the dedicated AD-Lab-Internal internal switch. The network has no default gateway and does not rely on DHCP.
flowchart TB
Host["Windows 11 Host"] --> HyperV["Hyper-V"]
HyperV --> Switch["AD-Lab-Internal<br/>Isolated internal virtual switch<br/>No default gateway"]
subgraph Domain["Fictional lab domain: adlab.test"]
DC["DC01<br/>Windows Server 2025<br/>Domain Controller + DNS"]
Client["CLIENT01<br/>Windows 11 Pro 25H2<br/>Domain joined"]
end
Switch --> DC
Switch --> Client
Client -- "DNS discovery, authentication, and secure channel" --> DC
Key validated architecture facts:
- Host lab adapter:
10.10.10.1/24 - DC01:
10.10.10.10/24, with no default gateway - CLIENT01:
10.10.10.20/24, using10.10.10.10for DNS - Domain:
adlab.test; NetBIOS name:ADLAB - Hyper-V virtual disks and runtime files are stored outside the Git repository
See Scope 1 - Hyper-V and Windows Setup for the validated VM foundation.
DC01 was promoted as the writable Domain Controller for the new adlab.test forest. It provides AD DS, DNS, Kerberos Key Distribution Center, Global Catalog, SYSVOL, NETLOGON, and domain authentication services.
Validated highlights include:
- Forest functional level:
Windows2025Forest - Domain functional level:
Windows2025Domain - All five FSMO roles held by
DC01.adlab.test - Forward zone:
adlab.test - Forest zone:
_msdcs.adlab.test - AD-integrated reverse zone:
10.10.10.in-addr.arpa - Forward, reverse, and LDAP SRV records validated
- DFSR SYSVOL state:
4 (Normal) - DCDIAG Connectivity, Advertising, SysVolCheck, NetLogons, Services, and DNS tests passed
Full details are available in Scope 2 - Domain Controller and DNS Setup.
CLIENT01 was configured with static addressing, pointed to DC01 for DNS, and successfully joined to adlab.test. Validation confirmed:
PartOfDomain: True- Healthy secure channel:
True - Domain trust result:
NERR_Success - Enabled CLIENT01 computer account in Active Directory
- Forward DNS:
CLIENT01.adlab.testresolves to10.10.10.20 - Reverse DNS:
10.10.10.20resolves toCLIENT01.adlab.test - LDAP SRV discovery through
dc01.adlab.teston TCP 389
See Scope 3 - Windows Client Domain Join.
The custom ADLAB hierarchy separates users, groups, computers, service accounts, and disabled objects. Custom OUs are protected from accidental deletion, while the default Domain Controllers OU remains unchanged.
adlab.test
└── ADLAB
├── Users
│ ├── IT
│ ├── Human Resources
│ └── Finance
├── Groups
│ ├── IT
│ ├── Human Resources
│ └── Finance
├── Computers
├── Service Accounts
└── Disabled Objects
Six fictional users were created and validated: Daniel Weber, Sophia Klein, Emma Fischer, Lukas Hoffmann, Hannah Becker, and Jonas Wagner. Three department Global Security Groups support group-based access:
GG_IT_UsersGG_HR_UsersGG_Finance_Users
| Object | Convention |
|---|---|
| Display name | Firstname Lastname |
| sAMAccountName | firstname.lastname |
| UserPrincipalName | [email protected] |
| Department group | GG_<Department>_Users |
| Domain Controller | DC01 |
| Client computer | CLIENT01 |
CLIENT01 was moved into OU=Computers,OU=ADLAB,DC=adlab,DC=test without disrupting its secure channel. See Scope 4 - OU, Users, Groups, and Naming Convention.
Scope 5 validated native Active Directory metadata for the six fictional users and three department Global Security Groups:
mailproxyAddressesuserPrincipalNamefor identity comparison and sign-in context
User addresses follow [email protected]. An uppercase SMTP: prefix identifies the primary proxy address value. Department group metadata uses [email protected], [email protected], and [email protected].
The repository also includes sanitized workflow references for:
These lifecycle documents define naming, OU placement, department-group assignment, account security, attribute review, containment, retention, and validation expectations. Their Alex Morgan examples are explicitly illustrative and were not implemented or validated as lifecycle events.
No Exchange Server was installed. No Microsoft 365, hybrid mail flow, mailbox provisioning, AD schema extension, or mail delivery was configured. The mail-related values are directory metadata only. See Scope 5 - Mail-Related Active Directory Attributes.
The dedicated ADLAB - Workstation Security Baseline GPO is linked to the custom Computers OU and applies to CLIENT01. The Default Domain Policy was not modified for these workstation controls.
| Validated workstation control | Result |
|---|---|
| Machine inactivity timeout | 900 seconds |
| Firewall Domain, Private, and Public profiles | Enabled |
| Microsoft Defender real-time monitoring | Enabled |
| AutoPlay | Disabled for all drive types |
| Windows automatic updates | Enabled |
Windows Update AUOptions |
3 |
| Insecure SMB guest logons | Disabled |
| User Account Control and secure desktop | Enabled |
gpupdate, gpresult, registry-based checks, Defender status, and firewall-profile checks confirmed the applied baseline. See Scope 6 - Group Policy Baseline.
Domain account policy was validated separately from the workstation GPO.
| Policy setting | Validated value |
|---|---|
| Password complexity | Enabled |
| Minimum password length | 12 characters |
| Password history | 24 passwords |
| Minimum password age | 1 day |
| Maximum password age | 90 days |
| Reversible encryption | Disabled |
| Account lockout threshold | 5 invalid attempts |
| Account lockout duration | 15 minutes |
| Reset observation window | 15 minutes |
DC01 hosts three departmental shares protected through Global Security Groups:
| Department | SMB share | Share permission | NTFS permission |
|---|---|---|---|
| IT | \\DC01\IT |
GG_IT_Users: Change |
GG_IT_Users: Modify |
| Human Resources | \\DC01\HR |
GG_HR_Users: Change |
GG_HR_Users: Modify |
| Finance | \\DC01\Finance |
GG_Finance_Users: Change |
GG_Finance_Users: Modify |
BUILTIN\Administrators and NT AUTHORITY\SYSTEM retain Full Control. Broad inherited BUILTIN\Users and CREATOR OWNER access was removed from the secured parent baseline. No Everyone or Authenticated Users share permission is present.
SMB1 is disabled, SMB2 is enabled, SMB signing is required, unencrypted access is rejected, and all three shares use Access-Based Enumeration and SMB encryption.
The departmental validation matrix passed all 9 of 9 checks:
| Fictional test user | IT | Human Resources | Finance |
|---|---|---|---|
| Daniel Weber | Allowed - create/read/delete passed | Denied | Denied |
| Emma Fischer | Denied | Allowed - create/read/delete passed | Denied |
| Hannah Becker | Denied | Denied | Allowed - create/read/delete passed |
See Scope 7 - File Share and NTFS Permissions.
A controlled lockout test used the fictional standard account ADLAB\daniel.weber; the Domain Administrator account was not used as the target. Five distinct failed domain authentications were counted, the account locked at BadPwdCount: 5, and the account was then manually restored to LockedOut: False and BadPwdCount: 0.
CLIENT01 successful-login evidence used Logon Type 2 and the Negotiate authentication package. The Security logs remained enabled and were not cleared or deleted.
| System | Event ID | Validated meaning |
|---|---|---|
| DC01 | 4625 |
Failed logon |
| DC01 | 4740 |
User account locked out |
| DC01 | 4767 |
User account unlocked |
| CLIENT01 | 4624 |
Successful logon |
| CLIENT01 | 4634 |
Account logged off |
| CLIENT01 | 4672 |
Special privileges assigned to new logon |
See Scope 8 - Security Policy, Login, and Event Viewer Validation.
The reusable Scope 9 validation script runs from elevated Windows PowerShell on the Hyper-V host. It prompts securely for the fictional domain administrator credential, creates reusable PowerShell Direct sessions to DC01 and CLIENT01, performs read-only queries, and closes sessions in a finally block.
The validated workflow covers:
- AD domain, OU, user, group, and CLIENT01 computer-account queries
- LDAP SRV discovery and DNS target validation
- GPO link and version checks
- SMB encryption and Access-Based Enumeration checks
- CLIENT01 IP, DNS, domain, and secure-channel checks
- Firewall, Defender, and inactivity-policy validation
- Compact summaries without remoting metadata or credential output
Final technical evidence records SCOPE_9_POWERSHELL_STATUS=PASS. A separate cleanup check confirmed RemainingSessionCount=0 and SESSION_CLEANUP_STATUS=PASS after stale PowerShell Direct sessions were enumerated and closed.
Only real homelab observations are recorded in the Troubleshooting Guide. Key lessons include:
| Observation | Resolution or lesson |
|---|---|
| DC01 could not start with the original 4 GB startup allocation | Startup memory was adjusted to 3 GB while the 2 GB minimum and 6 GB maximum were retained. |
| DC01 and CLIENT01 initially received APIPA addresses | Static addressing was used because the isolated switch has no DHCP server. |
| Host-to-DC01 ICMP initially failed | The required built-in ICMPv4 echo rule was enabled without disabling the firewall. |
| DCDIAG reported a time-server advertising warning | DC01 was configured as a reliable domain time source. |
| LDAP SRV lookup targeted the wrong zone | The query was corrected to the separate _msdcs.adlab.test zone. |
A filtered gpresult display appeared blank |
Raw successful output confirmed the workstation GPO was applied. |
Interactive foreach and if/else parsing failed |
Loop output and multi-part control flow were submitted in PowerShell-safe forms. |
| Stale PSSessions remained open | The active session inventory was enumerated and all remaining sessions were removed. |
These incidents reinforced a repeatable approach: start with read-only queries, validate DNS early, distinguish display problems from configuration failures, confirm each correction, and keep credentials out of output.
The repository includes sanitized screenshots from completed Scopes 1 through 9. The following focused selection shows the principal identity, policy, access, auditing, and PowerShell outcomes.
DC01 domain services, DNS records, role ownership, and final validation state.
Custom ADLAB organizational hierarchy for users, groups, computers, service accounts, and disabled objects.
Dedicated workstation GPO application and validated security controls on CLIENT01.
Group-based share controls and the completed nine-point departmental access matrix.
Domain policy, controlled lockout and restoration, successful login, and relevant Windows Security events.
Read-only administration summaries for DC01 and CLIENT01 with the final PASS result.
- Hyper-V virtual machine, storage, and isolated-network administration
- Windows Server installation and Domain Controller deployment
- Active Directory Domain Services, DNS zones, records, and service validation
- Windows client domain join, trust, secure-channel, and DNS troubleshooting
- OU design, identity naming, user administration, and Global Security Groups
- Native
mailandproxyAddressesattribute administration - Group Policy design and client-side validation
- Domain password, account lockout, and audit policy administration
- Least-privilege SMB share and NTFS permission design
- Controlled authentication testing and Windows Security event interpretation
- PowerShell Direct, reusable PSSessions, read-only validation, and safe cleanup
- Evidence-led troubleshooting and public-safe technical documentation
- Delivered a functioning two-VM Active Directory lab with validated domain services and client membership.
- Established a maintainable directory structure and group-based authorization model.
- Applied and verified workstation and domain-account security controls.
- Proved department isolation through allowed and denied SMB access tests.
- Connected login behavior to relevant Domain Controller and client Security events.
- Produced reusable PowerShell validation and documented session cleanup.
- Published a responsive recruiter-facing case-study site and a sanitized evidence set.
- Demonstrated the difference between implemented homelab controls and conceptual production requirements.
windows-server-active-directory-lab/
├── README.md
├── LICENSE
├── assets/
│ └── screenshots/
│ ├── scope-1/
│ └── scope-2/ ... scope-9/
├── docs/
│ ├── index.html
│ ├── assets/
│ │ ├── css/
│ │ ├── images/
│ │ └── js/
│ ├── lifecycle/
│ │ ├── onboarding-workflow.md
│ │ └── offboarding-workflow.md
│ ├── scope-1-hyper-v-and-windows-setup.md
│ ├── scope-2-domain-controller-and-dns-setup.md
│ ├── scope-3-windows-client-domain-join.md
│ ├── scope-4-ou-users-groups-naming-convention.md
│ ├── scope-5-mail-related-ad-attributes.md
│ ├── scope-6-group-policy-baseline.md
│ ├── scope-7-file-share-ntfs-permissions.md
│ ├── scope-8-security-policy-login-event-viewer-validation.md
│ ├── troubleshooting-guide.md
│ ├── security-redaction-rules.md
│ └── real-world-production-considerations.md
└── scripts/
└── validation/
└── scope-9-powershell-administration-validation.ps1
- Every user identity in the repository is fictional.
adlab.testis a lab-only namespace.- No passwords, password hints, security-question answers, or credential values are stored.
- No private client or employer documents were used or reproduced.
- No production domains, hostnames, IP addresses, screenshots, or confidential configurations are exposed.
- Evidence was reviewed and sanitized before publication.
- VM IDs, GUIDs, MAC addresses, product keys, recovery keys, private keys, and sensitive Event Viewer data are excluded.
- Exchange Server, Microsoft 365, mailboxes, mail delivery, and hybrid identity were not deployed.
This repository is an independently built homelab, not a production deployment. Its architecture, validation approach, and documentation are production-informed, while all client, employer, and production-environment details remain excluded. The following capabilities would require separate design and implementation in a production environment:
| Area | Production consideration |
|---|---|
| Domain Controllers | Deploy multiple Domain Controllers for redundancy, high availability, authentication resilience, and suitable Global Catalog placement. |
| AD-integrated DNS | Provide redundant DNS service, planned forwarders, appropriate site placement, and documented recovery procedures. |
| FSMO roles and authoritative time | Document FSMO role holders and recovery procedures; design the PDC Emulator and upstream time source as part of an authoritative domain time hierarchy. |
| AD Sites and Services | Map sites, subnets, site links, and schedules to physical network topology and authentication requirements. |
| Replication | Monitor replication health and plan topology, latency, bandwidth, and recovery across locations. |
| Backup and disaster recovery | Implement tested System State backup, authoritative and non-authoritative restore procedures, recovery objectives, and disaster recovery exercises. |
| Monitoring and alerting | Centralize event collection, define actionable alerts, size and retain logs appropriately, and integrate operational or SIEM monitoring where required. |
| Privileged administration | Apply separation of duties, tiered or privileged administration, hardened administrative workstations, controlled service accounts, and audited change management. |
| Proxy and security layers | Integrate appropriate proxy services, network firewalls, endpoint protection, centralized logging, certificate management, and layered security controls. |
| Exchange and Microsoft 365 identity | Treat Exchange Server, Microsoft 365, mail flow, schema preparation, certificates, availability, backup, and hybrid identity as a separate architecture. This lab demonstrates only native AD metadata and conceptual identity integration. |
The compact two-VM design is appropriate for controlled learning and portfolio validation. It does not claim enterprise high availability, production-scale disaster recovery, multi-site replication, centralized monitoring, or a completed Exchange or Microsoft 365 deployment. See Real-World Production Considerations for the full conceptual mapping.