Module 19 Lesson 2 of 6 🕑 ~65 min

> cat module-19-2-windows-server-active-directory.md

Windows Server & Active Directory

Windows Server remains fundamental infrastructure across a huge number of organisations. This lesson builds the identity backbone of the whole lab — two Domain Controllers, a real OU structure, RBAC groups, DNS, DHCP, Windows clients, Group Policy, and the authentication underneath all of it.

1 Windows Server & Installing AD DS

Build at least one Windows Server VM — recommended, a current generation such as Windows Server 2025 or 2022 as DC01. For legacy exposure, you can later add Windows Server 2019 or 2016, kept isolated and never treated as suitable for production just because it can be installed in a lab.

Install the Active Directory Domain Services role and promote the server to a Domain Controller for corp.cybersecuritycafe.lab, e.g. DC01 at 10.10.10.10. Understand what promotion actually does: the server becomes responsible for Active Directory, LDAP, Kerberos, DNS, SYSVOL, and Group Policy. Explore Active Directory Users and Computers, the Active Directory Administrative Center, DNS Manager, Group Policy Management, Server Manager, Event Viewer, and PowerShell — these are the tools you'll live in for the rest of this lesson.

2 Enterprise AD Structure & RBAC

Don't dump everything in the default Users container. Build organisational units that mirror a real company:

Cyber Security Cafe
|
+--- Users
|    +--- IT
|    +--- Finance
|    +--- HR
|    +--- Sales
+--- Computers
|    +--- Workstations
|    +--- Laptops
+--- Servers
+--- Service Accounts
+--- Admin Accounts
+--- Groups

Create fictional employees with realistic usernames (Alice Smith / asmith as a Finance Analyst, Bob Jones / bjones as a Help Desk Analyst, and similar). Then avoid assigning permissions to individuals — create security groups instead (GG-Finance-Users, GG-Helpdesk-Users, GG-VPN-Users, GG-FileServer-Finance-RW, GG-Database-Admins, GG-SOC-Analysts) and assign users to groups. This is Role-Based Access Control (RBAC): instead of "Alice → Finance Folder," it's "Alice → Finance Users Group → Finance Folder." The reason this matters becomes obvious once you imagine the same design at 10 employees versus 100,000.

3 A Second Domain Controller & Replication

Build DC02 at 10.10.10.11 and promote it as a second Domain Controller. Create a user on DC01 and verify it replicates to DC02, using repadmin /replsummary and dcdiag. Then simulate failure: shut down DC01. Can users still authenticate? Can DNS still resolve? This is where redundancy, replication, high availability, disaster recovery, and single points of failure stop being vocabulary and become something you actually watched happen.

4 DNS & DHCP Labs

Create DNS records for your servers (dc01.corp.cybersecuritycafe.lab, sql01..., splunk01..., linux01...) and investigate them with nslookup and dig. Understand A, AAAA, CNAME, MX, PTR, SRV and TXT records — Active Directory relies heavily on DNS, so a useful exercise is deliberately pointing a workstation at the wrong DNS server and watching exactly what breaks.

Configure a DHCP scope (e.g. 10.10.20.100–10.10.20.200) with default gateway, DNS servers, domain name, and lease duration. Investigate with ipconfig /all, ipconfig /release, and ipconfig /renew, and understand the DHCP process — Discover, Offer, Request, Acknowledgement, often remembered as DORA.

5 Windows Clients, Group Policy & File Servers

Join at least one Windows 11 workstation (WIN11-01) to corp.cybersecuritycafe.lab and log in as CORP\asmith — now you can compare a local account against a domain account directly. Add a second workstation (WIN11-02) and the environment starts behaving like a real corporate network.

Create Group Policy Objects — password configuration, account lockout, Windows Defender settings, firewall rules, desktop restrictions, drive mappings, security settings, audit policy — organised as e.g. GPO-Corporate-Security, GPO-Windows-Workstations, GPO-Helpdesk, GPO-Finance, applied with gpupdate /force and checked with gpresult /r. The underlying lesson: enterprise administrators don't manually configure thousands of machines individually — centralised policy exists because configuration needs to scale.

Build a file server (FILE01) with shares like \\FILE01\Finance, \\FILE01\HR, \\FILE01\IT, controlled by your AD security groups. Understand both share permissions and NTFS permissions as separate layers, and deliberately test a user who can read, cannot write, has full control, or gets Access Denied — then troubleshoot why, which is exactly the kind of layered thinking Lesson 1's opening scenario was about.

6 Kerberos & NTLM

Modern Active Directory primarily uses Kerberos. Run klist after logging in to inspect Kerberos tickets, and understand TGT, Service Ticket, KDC, and SPN (Module 9 covers the protocol mechanics in depth — this lesson is where you actually watch it happen). Also learn NTLM, because it remains present in many legacy environments — legacy authentication technologies often survive far longer inside large organisations than textbooks suggest, which is why many migrations have to support both modern authentication and legacy compatibility at the same time, sometimes for years.