Windows Server AD Lab Identity infrastructure case study

SCOPE 9 // PASS

Infrastructure case study Windows identity / Hyper-V

AD DS DNS GROUP POLICY POWERSHELL

Windows Server Active Directory Administration Lab

A controlled Windows Server and Windows 11 homelab demonstrating identity, name resolution, workstation policy, least-privilege access, auditing, and reusable read-only administration.

View Architecture Explore Validation View Evidence
DNS domain
adlab.test
NetBIOS
ADLAB
Domain Controller
DC01
Domain client
CLIENT01
Scope 9
PASS
ADLAB / VALIDATED TOPOLOGY Operating normally
Physical hostWindows 11 Host 10.10.10.1/24
VirtualizationHyper-V Generation 2
Internal switchAD-Lab-Internal Isolated // No default gateway
Domain services

DC01

AD DS + DNS + FSMO awareness

10.10.10.10/24
Windows 11 client

CLIENT01

Domain joined

10.10.10.20/24 DNS: 10.10.10.10

Domain boundary adlab.test

01 / Project overview

A compact lab.
A complete administration story.

The project connects infrastructure setup, directory administration, security policy, access control, audit evidence, and PowerShell validation in one public-safe case study.

Objective

Demonstrate practical Windows identity administration through a controlled, evidence-led homelab.

The environment runs on a Windows 11 Hyper-V host and uses a dedicated internal network. Each completed scope is documented with sanitized, recruiter-readable validation evidence.

PlatformWindows 11 · Hyper-V
IdentityWindows Server · AD DS · DNS
AdministrationPowerShell · Group Policy · SMB
EvidenceSanitized · fictional · public-safe
Domain membership
PASS
CLIENT01 secure channel
Workstation policy
PASS
Dedicated GPO applied
Department access
9 / 9
Allowed and denied outcomes
PowerShell validation
PASS
Read-only administration

02 / Architecture

One host boundary.
Two identity endpoints.

CLIENT01 discovers and authenticates to the domain through DC01 across an isolated Hyper-V switch with no default gateway.

Hyper-V architecture showing the isolated host, internal switch, Domain Controller, and domain client.
Host boundaryWindows 11 / Hyper-V Host adapter 10.10.10.1/24
Virtualization layerHyper-VGeneration 2 virtual machines
Internal virtual switchAD-Lab-Internal Isolated // No gateway
Domain services

DC01

Validated
IPv4
10.10.10.10/24
Roles
AD DS and DNS
Domain
adlab.test
DNS10.10.10.10Domain joinedSecure channel
Domain client

CLIENT01

Joined
IPv4
10.10.10.20/24
DNS
10.10.10.10
Membership
adlab.test
Domain identityadlab.test / ADLAB

DC01.adlab.test is writable and a Global Catalog.

Name resolutionAD-integrated DNS

LDAP SRV discovery uses _msdcs.adlab.test on TCP 389.

Service readinessSYSVOL + NETLOGON

DFSR SYSVOL state 4 (Normal); all five FSMO roles are on DC01.

03 / Directory structure

Organized for people, access, and lifecycle.

The custom ADLAB hierarchy separates users, groups, computers, service accounts, and disabled objects into recruiter-readable administrative boundaries.

ADLAB
  • Users
    • IT
    • HR
    • Finance
  • Groups
    • IT
    • HR
    • Finance
  • Computers
  • Service Accounts
  • Disabled Objects
01

IT

Daniel Weber · Sophia Klein

GG_IT_Users
02

Human Resources

Emma Fischer · Jonas Wagner

GG_HR_Users
03

Finance

Lukas Hoffmann · Hannah Becker

GG_Finance_Users

Naming convention GG_<Department>_Users identifies department Global Security Groups. Access is assigned to groups rather than directly to users.

04 / Domain services

Directory services and name resolution.

Directory
Active Directory Domain Services
Domain / NetBIOS
adlab.test / ADLAB
Functional levels
Windows2025Forest
Windows2025Domain
DNS zones
Forward, reverse, and _msdcs
Registration
Forward and reverse DNS validated
Discovery
LDAP SRV target dc01.adlab.test / TCP 389
Role awareness
All five FSMO roles held by DC01

Mail-related identity metadata

Directory attributes without a mail platform.

Implemented

  • mail
  • proxyAddresses
  • Primary uppercase SMTP: convention
  • Department aliases
  • Onboarding documentation
  • Offboarding documentation

Not implemented

  • Exchange Server
  • Mailboxes or mail delivery
  • Microsoft 365
  • Hybrid identity

These values are native directory metadata only and do not provide mail delivery.

05 / Group Policy and account security

Separate controls.
One validated baseline.

Workstation controls are applied through a dedicated GPO. Password and lockout settings remain distinct domain-level account policy.

ADLAB / effective security policy

VALIDATED
01 / Workstation GPODedicated baseline

ADLAB - Workstation Security Baseline

Inactivity timeout
900 seconds PASS
Windows Firewall
Enabled PASS
Defender real-time protection
Enabled PASS
AutoPlay
Disabled PASS
Automatic Updates
Enabled PASS
AUOptions
3 PASS
Insecure SMB guest logons
Disabled PASS
UAC baseline
Enabled PASS
02 / Domain password policyDomain level
Complexity
Enabled PASS
Minimum length
12 characters PASS
Password history
24 passwords PASS
Minimum age
1 day PASS
Maximum age
90 days PASS
Reversible encryption
Disabled PASS
03 / Account lockout policySecurity control
Threshold
5 invalid attempts
Duration
15 minutes
Observation window
15 minutes

BoundaryDefault Domain Policy was not modified for the dedicated workstation settings.

06 / File shares and permissions

Group-based access.
Explicit outcomes.

Effective access is the most restrictive combination of SMB share and NTFS permissions. Department users were tested only against the three validated shares.

Validated nine-point department access matrix
Fictional test userIT shareHR shareFinance share
Daniel WeberALLOWEDPASSDENIEDDENIED
Emma FischerDENIEDALLOWEDPASSDENIED
Hannah BeckerDENIEDDENIEDALLOWEDPASS

Each fictional user accessed only their department share. No additional access tests are claimed.

07 / Auditing and Event Viewer

Authentication events with a controlled test boundary.

Aligned Security event ledgers connect failed authentication, account lockout, restoration, successful login, and logoff evidence.

Domain Controller

DC01 Security Events

Event IDDescription
4625Failed logon
4740Account locked out
4767Account unlocked
Domain client

CLIENT01 Security Events

Event IDDescription
4624Successful logon
4634Logoff
4672Special privileges assigned

08 / PowerShell administration

Read-only queries.
Reusable validation.

PowerShell Direct and reusable PSSessions validate DC01 and CLIENT01 without fabricating terminal output or changing configuration.

  1. 01PowerShell Direct
  2. 02Reusable PSSessions
  3. 03AD / DNS / GPO queries
  4. 04SMB / NTFS queries
  5. 05CLIENT01 security validation
  6. 06Safe cleanup
Reusable script scripts/validation/scope-9-powershell-administration-validation.ps1

SCOPE_9_POWERSHELL_STATUS=PASS

09 / Troubleshooting

Real observations.
Reusable lessons.

Only issues encountered during the documented homelab work are included.

01Hyper-V memory allocation

Host RAM availability prevented the original DC01 startup allocation. Startup memory was adjusted while the validated Dynamic Memory range was preserved.

02APIPA without DHCP

The isolated internal switch had no DHCP server. Static lab addresses replaced the initial APIPA assignments.

03Firewall blocking ICMP

The DC01 Public firewall profile blocked inbound echo requests. The required built-in echo rule was enabled without disabling the firewall.

04DNS zone query correction

The LDAP SRV lookup was corrected to query the separate _msdcs.adlab.test zone.

05foreach pipeline parser issue

Loop output was assigned to a variable before sorting or formatting.

06Interactive if/else behavior

Multi-part control flow was submitted together instead of as separate interactive commands.

07gpresult filtering

Raw successful output confirmed the GPO when a filtered display appeared blank.

08Stale PSSession cleanup

The active session inventory was enumerated and remaining PSSessions were closed.

10 / Validation evidence

Eight scopes.
Visible proof.

Sanitized repository screenshots document completed validation from Scope 2 through Scope 9.

08public-safe
screenshots
02

Scope 2

AD DS and DNS validation

Validates DC01 domain services, DNS zones, records, and final service readiness.

03

Scope 3

Windows client domain join

Validates CLIENT01 membership, secure channel, authentication, and DNS registration.

04

Scope 4

Active Directory structure

Validates the ADLAB hierarchy for users, groups, computers, service accounts, and lifecycle states.

05

Scope 5

Mail-related AD attributes

Validates native directory metadata for six fictional users and three department groups.

06

Scope 6

Group Policy baseline

Validates the dedicated workstation GPO and its applied security controls.

07

Scope 7

SMB and NTFS permissions

Validates group-based share controls and the nine-point access matrix.

08

Scope 8

Security policy and auditing

Validates account policy, controlled lockout, restoration, login, and Security events.

09

Scope 9

PowerShell administration

Validates reusable read-only checks across DC01 and CLIENT01.

Evidence preview

Validation evidence

1 of 8

11 / Production Mapping

Enterprise considerations beyond the homelab.

Production considerations — not implemented in this homelab. These concepts require separate architecture, testing, security, operations, and recovery planning.

01

Resilience and directory availability

  • Redundant Domain Controllers
  • AD-integrated DNS redundancy
  • FSMO and Global Catalog planning
02

Sites and replication

  • Active Directory Sites and Services
  • Replication planning
  • Site and subnet mapping
03

Privileged administration

  • Privileged and tiered administration
  • Administrative separation
  • Change management
04

Backup and recovery

  • System State backup
  • Disaster recovery planning
  • Recovery testing
05

Monitoring and security layers

  • Monitoring and event collection
  • Alerting
  • Proxy and security layers
06

Conceptual identity integration

  • Exchange identity integration
  • Microsoft 365 identity integration
  • Hybrid identity considerations

12 / Project outcome

A validated Windows identity foundation.

The lab brings together AD DS, DNS, directory organization, workstation policy, least-privilege permissions, security auditing, troubleshooting, reusable PowerShell validation, and public-safe documentation.

Implemented and demonstrated
  • Identity administration
  • DNS and domain discovery
  • Group Policy
  • SMB and NTFS permissions
  • Security auditing
  • PowerShell administration
  • Evidence-led documentation