Active Directory Enterprise Home Lab
A simulated corporate IT environment on Windows Server featuring Active Directory Domain Services, Organizational Units (OU), Group Policies (GPO), and integrated DNS/DHCP.
Overview
This hands-on lab environment simulates the IT infrastructure of a 50+ employee enterprise. A Domain Controller was configured on Windows Server 2022 with AD DS, and Windows 10/11 client workstations were successfully joined to the domain.
Project Objective & Scope
To gain deep practical experience in enterprise systems administration, including identity & access management (IAM), organizational unit (OU) design, Group Policy security baseline deployment, and centralized administration.
Lab Environment & Hardware/Software
The architecture features a structured OU hierarchy segmented into Management, HR, Finance, and IT departments. Global and Domain Local security groups manage department file share permissions.
Implementation & Configuration Steps
1. Server Provisioning & Static IP Assignment
Installed Windows Server 2022, configured static IPv4 (192.168.10.10/24), local DNS loopback (127.0.0.1), and standardized hostname.
2. AD DS & DNS Role Promotion
Installed Active Directory Domain Services role and promoted the server to a Domain Controller for the root domain "corp.local".
3. Hierarchical OU & Security Group Architecture
Engineered OU structure for HR, Finance, IT, and Sales. Created departmental security groups adhering to least-privilege principles.
4. Group Policy Objects (GPOs) Implementation
Enforced password complexity standards, 15-minute screen lock, USB storage restriction policies, and standardized desktop environments.
5. Domain Join & Workstation Validation
Configured client DNS resolvers to point to DC01 and successfully joined client workstations to the domain.
Troubleshooting & Problems Encountered
Client workstation threw a DNS Name Resolution error during domain join attempts.
Running "nslookup corp.local" showed that the client was querying the external gateway DNS instead of the internal domain DNS.
Configured the client network adapter with Primary DNS set to DC01 (192.168.10.10) and ran "ipconfig /flushdns", resolving the issue.
Applied USB restriction GPO did not take effect immediately on client endpoints.
Inspected applied policies using "gpresult /r" and discovered client policy refresh interval had not elapsed.
Executed "gpupdate /force" on the client machine to apply updated computer policies instantly.
What I Learned & Key Takeaways
- Learned firsthand that DNS architecture is the core foundation of Active Directory stability.
- Mastered Group Policy inheritance, precedence rules, and enforcement mechanics.
- Applied the Principle of Least Privilege in enterprise user and group permissions.