- PowerShell
- Oracle Virtual Box
- Windows 10 (22H2)
- Windows Server 2019
Diagram of Project
This is the diagram that is going to be used to set up the two main virtual machines (VMs) for the home lab environment. The first VM will be the Domain Controller (DC), which is the sever that runs Active Directory (AD) and all its components, so we need to set it up with all the following services. The Fully Qualified Domain Name (FQDN) is the complete domain name for AD, which we will need to set up within the DC in order to have clients connect to the AD server. Network Address Translation (NAT) will need to be setup as well in order to have the internal Network Interface Card (NIC) comunicate with the internet NIC, so that internet access is avilable within the domain when users sign in to the domain. Lastly, Dynamic Host Configuration Protocol (DHCP) is set up so that when Clients sign on to the domain, they automatically get leased an IP address and are immediatly connected to the Internet.
Create a new VM machine by clicking on "New" in VirtualBox, to avoid confusion name VM "Domain Controller" and make sure to set "Windows 2019" as version. We Will load boot media after setting up VM.
Configure the DC VM with two Network Interface Cards (NICs). One internal NIC for the Domain and the External NIC to be able to connect to the Internet on the Host Computer.
Install Windows Server 2019 on DC VM (Make sure to Select Desktop Experience), Identify the Internal (the one with no network access) & External NICs and assign IP address for internal Network Card.
Go to Server Manager then add the AD Domain services role and create the the domain (example- mydomain.com).
Next go to the Server Manager again and add the RAT/NAT service and configure to be able to allow clients access to internet while in the domain. Make sure to select the external NIC when setting up NAT internet connection.
Now go back to the Server Manager yet again to set up the Dynamic Host Configuration Protocol (DHCP) on the DC based on the Diagram Specifications.
Download and run the PowerShell script within the DC VM to create 1000 users in AD.
Create a new VM and name it (Example- Client1) and install Windows 10 (Make sure to Select Windows 10 PRO) in order to be able to use this VM to connect to our new domain. Connect the Client VM to the network, then to the domain by adding it to the System Properties.
Login to the client machine within the domain using a domain account. As you can see the client VM shows that we are now in the domain.
To Create a new Organizational Unit (OU), go to Active Directory Users and Computers and then right click the domain (in this case THM) and select new, then Organizational Unit.
To Delete an OU, you must activate Advanced Features under view in order to be able to select the OU properties and uncheck Protect from accidental Deletion.
Checking Login of a User, you must enable Advanced Features (if not enabled already), right click on the user, go to properties, within properties select the Attribute Editor tab and look for lastLogon.
To Delegate control of a OU, or give privileges to certain users (giving IT privileges to reset passwords for the sales dept. for example) you must right click the OU and right click Delegate Control. There another popup appears where you click next and are able to give access to users or groups and specify what privileges they get to recieve.
Managing Computers In AD, In this example, we created another OU to differentiate between workstations and servers, which can be helpful when managing the domain, as it would be easier to create different policies for each OU.
Examples of Group policy editor, and examples of whats in a policy. Policies created are under the Group Policy Objects, when linked (when they are actively used) will show them under the OUs or Domain.
Showing how to edit a poilicy example. In this example, we will be showing how one would go to edit the Minimum password length policy.
After creating and editing a Group Policy Object, the next step would be to link the policy to OU(s) needed, in this example we will be linking the Prohibit Accesss to Control Panel and PC settings policy to 3 OUs inside the Domain, as well as the Auto Lock Screen policy to the whole domain instead of specific OUs.
