Documentation, Automation & the Capstone

1💥 Breaking the Lab & Example Incidents

Deliberately create faults: stop DNS, use the wrong DNS server, disable DHCP, block Kerberos, expire a certificate, lock an account, disable a user, stop SQL Server, stop the web server, block TCP 443, fill a disk, change file permissions, stop the Splunk forwarder, remove a route — then troubleshoot each one systematically. This may be the single most educational part of the entire lab.

2🔐 A Security Investigation & Vulnerability Management

Generate abnormal behaviour — many failed logins followed by a successful one — and send the logs to Splunk or Sentinel. Investigate the user, timestamp, source device, source address, number of attempts, whether authentication succeeded afterward, and any other activity involving the same account. Document the investigation as if you were actually working in a SOC (Module 11's investigation format applies directly here).

Use appropriate vulnerability-scanning tools against systems inside your own controlled lab and identify missing patches, weak configurations, unnecessary services, open ports, outdated packages, and TLS configuration problems. The important part is what happens after the scan: for every finding, ask what's vulnerable, why it matters, whether it's exploitable in this specific architecture, what the remediation is, whether remediation could break anything, and how the fix will be tested. That's what separates real vulnerability management from just producing a scan report nobody acts on.

3📄 Documentation, Diagrams & the GitHub Portfolio

Document everything: architecture, IP addresses, hostnames, operating systems, applications, firewall rules, user roles, service accounts, dependencies, backup process, and troubleshooting notes. A simple inventory table goes a long way:

Create a professional network diagram (draw.io, Visio, Lucidchart, Mermaid or Excalidraw all work) — being able to explain architecture visually is a real professional skill, not decoration.

Then publish a repository, e.g. enterprise-home-lab, structured with a README.md, a /docs folder (architecture, active-directory, networking, databases, logging, security), a /diagrams folder, a /scripts folder, and a /screenshots folder. Never upload passwords, API keys, private keys, cloud credentials, or real company information — everything in this lab is fictional by design, keep it that way.

Write the README as an actual pitch, not a file listing:

Enterprise IT & Cybersecurity Home Lab

Built a segmented enterprise-style network containing:
- Windows Server, Active Directory, DNS/DHCP
- Windows clients, Linux, pfSense
- SQL Server, Docker, Splunk, Microsoft Sentinel
- Kali Linux, vulnerable applications

Implemented:
- RBAC, Group Policy, network segmentation
- Database access controls, centralised logging
- SIEM monitoring, certificate-based HTTPS
- Database security, backup and recovery

This is far more valuable than "I know Active Directory" on a CV, because every line is something a reviewer can ask you to explain in detail.

4🤖 Automation: PowerShell & Linux Scripting

Automate part of the build. Use PowerShell to create users from a CSV of dozens of fictional employees:

Import-Csv users.csv | ForEach-Object {
    New-ADUser `
        -Name $_.Name `
        -SamAccountName $_.Username `
        -Enabled $true
}

Now you're demonstrating Active Directory, PowerShell, CSV handling and automation in a single project (Module 15 covers PowerShell in depth). On the Linux side, write a basic shell script to collect hostname, disk usage, memory, IP address, and running services, and schedule it with cron — connecting the Linux and automation skills from earlier in the course.

5🏢 Enterprise Scale & the Recommended Final Lab

Your lab might have 10 servers, 5 users, and 2 networks. A real enterprise might have 20,000 servers, 80,000 employees, 200 offices, multiple data centres, AWS, Azure, GCP, thousands of applications, multiple Active Directory forests, and multiple SIEM platforms. The underlying concepts stay the same — what changes at scale is the need for automation, standardisation, monitoring, governance, high availability, change management, security controls, and documentation. A realistic organisation might also simultaneously run Windows Server 2016 through 2025, Active Directory alongside Microsoft Entra ID, NTLM alongside Kerberos, OAuth 2.0, OIDC and SAML, Oracle and SQL Server and PostgreSQL, VMware, Docker and Kubernetes, and on-premises infrastructure alongside cloud and SaaS — and that complexity is completely normal, not a sign something's wrong.

By the end of this module, aim for: FW01 (pfSense), DC01 and DC02 (Windows Server/AD/DNS), FILE01 (Windows file server), WIN11-01 and WIN11-02 (Windows 11), LINUX01 (Linux server), DOCKER01 (Linux + Docker), SQL01 (SQL Server/PostgreSQL/MySQL), optionally ORACLE01, SPLUNK01 (Splunk Enterprise), KALI01 (Kali Linux), VULN01 (vulnerable applications) — plus an Azure presence with Microsoft Sentinel and Microsoft Entra ID, and Server/Client/Security VLANs plus a DMZ.

6🏆 The Capstone Project

7🏆 Interview Prep & the Final Challenge

After completing the lab, you should comfortably answer questions like: what happens when a computer joins an Active Directory domain? What's a Domain Controller, and why would an organisation have two? Why is DNS important to Active Directory? What's the difference between NTLM and Kerberos? What's RBAC, and what's a service account? How would you troubleshoot a user who can't access a file share? What's network segmentation, a DMZ, a VLAN? Why shouldn't databases normally be directly accessible from every workstation? What's a SIEM, an index, KQL? What's the difference between a VM and a container? How do SSH keys work? Why shouldn't an application connect as a database administrator? How would you troubleshoot HTTP 500 vs. 401 vs. 403, or an application that suddenly becomes unavailable? A student who genuinely built and broke this environment answers these with practical examples, not memorised definitions.

Rewrite your CV accordingly. Instead of "Knowledge of Windows Server and cybersecurity," write something closer to: "Designed and deployed a segmented enterprise-style infrastructure using Windows Server, Active Directory, DNS, DHCP, Linux, pfSense, SQL Server, Docker, Splunk and Microsoft Sentinel. Implemented Active Directory RBAC, Group Policy, network segmentation, database access controls, centralised logging and security monitoring. Created Splunk and Sentinel detections for authentication activity and performed simulated incident investigations. Automated Active Directory administration using PowerShell and documented infrastructure using network diagrams, configuration documentation and troubleshooting runbooks." Every sentence is now something an interviewer can ask you to go deeper on. When they ask "Do you have any experience with Active Directory?", instead of "I studied Active Directory," you can say exactly what you built, what you configured, and what you tested when things failed — that difference is enormous.

This is where you move from following labs to designing systems — one of the biggest steps toward becoming employable in IT and cybersecurity.

Module 19 Complete — and Section 04

You should now be able to open a laptop and show a real network: Domain Controllers, users, Group Policy, a Linux server, a database, a Docker environment, a firewall and its rules, a Splunk dashboard, Sentinel queries, an incident you investigated, PowerShell automation you wrote, a network diagram, documentation, something you broke, how you diagnosed it, and how you fixed it. That's practical experience — and it's worth more to an employer than a certificate saying you completed a course.

The lab doesn't need to be huge. It needs to demonstrate that you understand how modern and legacy enterprise technologies fit together, know how to troubleshoot and secure them, and can explain what you built and why. Mark this lesson complete to close out Module 19 and Section 04: Professional Communication, and continue to Section 05: Getting Your First Job.