Cover

Internal Training Guide

Building and Managing a Microsoft Active Directory Lab

This interactive guide walks through the complete lab in order. Use Next and Back to move between sections, or choose Show Complete Guide to display everything on one page.

Purpose and Lab Design

Purpose

The purpose of this training is to build a complete Microsoft Active Directory lab from the beginning and practice common Windows Server administration tasks.

The trainee will connect to VMware ESXi, create an isolated virtual network, upload Windows installation ISO files, install two virtual machines, configure Active Directory, DNS and DHCP, join a Windows client to the domain, manage users and groups, configure shared folders and Group Policies, and use PowerShell for bulk administration.

Lab Design

Suggested configuration

• Domain: training.local
• Network: 192.168.50.0/24
• DC01: 192.168.50.10
• DHCP range: 192.168.50.100 to 192.168.50.200
• CLIENT01: Assigned automatically by DHCP

Important Rules

Important Rules to Remember

Part 1 — Connect to VMware ESXi

Objective

Connect to the VMware ESXi Host Client and confirm that the host is ready for the training lab.

Steps

1. From a computer that can reach the ESXi management address, open a web browser.
2. Enter https://ESXI-IP-ADDRESS.
3. Review the certificate warning and continue only after confirming the address is correct.
4. Log in using the ESXi administrative credentials.
5. Review host health, CPU, memory, datastore capacity, virtual switches, port groups and existing virtual machines.

Record

• ESXi hostname and management IP
• ESXi version
• Available datastore space
• The datastore selected for the lab

Do not include passwords in the documentation.

Part 2 — Create an Isolated ESXi Network

Objective

Create a virtual network that allows DC01 and CLIENT01 to communicate without reaching the production network or internet.

Steps

1. Open Networking → Virtual switches.
2. Create a standard virtual switch named vSwitch-Lab.
3. Do not assign an uplink.
4. Open Networking → Port groups.
5. Create a port group named AD-Lab.
6. Attach it to vSwitch-Lab.
7. Use VLAN ID 0.

Validation

• vSwitch-Lab exists.
• It has no physical uplink.
• AD-Lab is connected to vSwitch-Lab.

Part 3 — Upload Installation ISO Files

Objective

Upload Windows installation media to an ESXi datastore so it can be attached to the virtual machines.

Required ISO Files

• Windows Server 2022 ISO
• Windows 10 Pro or Windows 11 Pro ISO

Steps

1. Open Storage → Datastores.
2. Select the datastore for the lab.
3. Open Datastore browser.
4. Create a folder named ISO.
5. Upload the Windows Server and Windows client ISO files.
6. Wait until each upload completes.

Validation

Confirm that both ISO files appear in the datastore browser and record their exact file names and paths.

Part 4 — Create the Domain Controller VM

Objective

Create the Windows Server virtual machine that will later become the Domain Controller.

Suggested configuration

Steps

1. Open Virtual Machines → Create / Register VM.
2. Select Create a new virtual machine.
3. Enter the suggested configuration.
4. Attach the Windows Server ISO to the CD/DVD drive.
5. Enable Connect at power on.
6. Complete the wizard.

Part 5 — Install Windows Server

Steps

1. Power on DC01.
2. Open the VM console.
3. Start Windows installation.
4. Select Windows Server 2022 Standard or the approved equivalent with Desktop Experience.
5. Complete the installation and set the local Administrator password.
6. Install VMware Tools.
7. Set the correct timezone.
8. Rename the server to DC01.
9. Restart the server.

VMware Tools

From ESXi, choose Actions → Guest OS → Install VMware Tools, then run the installer inside Windows and restart if requested.

Part 6 — Configure the DC IP Address

Objective

Assign a permanent IP address to DC01.

Configuration

Run:

ipconfig /all

Confirm that all settings are correct.

Part 7 — Install Active Directory and DNS

Objective

Install Active Directory Domain Services and create a new domain.

Steps

1. Open Server Manager.
2. Select Manage → Add Roles and Features.
3. Install Active Directory Domain Services and DNS Server.
4. Select the notification flag and choose Promote this server to a domain controller.
5. Select Add a new forest.
6. Enter training.local.
7. Set a Directory Services Restore Mode password.
8. Complete the wizard and restart.

Validation

• Log in as TRAINING\Administrator.
• Open Active Directory Users and Computers.
• Open DNS Manager.
• Open Group Policy Management.
• Run net share.
• Confirm that NETLOGON and SYSVOL exist.

Part 8 — Install and Configure DHCP

Objective

Configure DC01 to assign IP settings to lab clients automatically.

Steps

1. Install the DHCP Server role.
2. Complete the DHCP post-installation configuration.
3. Authorize the DHCP server in Active Directory.
4. Create and activate an IPv4 scope.

Suggested scope

Part 9 — Create the Client VM

Suggested configuration

Attach the Windows client ISO and enable Connect at power on.

Part 10 — Install and Prepare the Client

Steps

1. Install Windows on CLIENT01.
2. Install VMware Tools.
3. Rename the computer to CLIENT01.
4. Configure the network adapter to obtain an IP address automatically.
5. Restart the computer.

Validation

Run:

ipconfig /all
ping 192.168.50.10
nslookup dc01.training.local
nslookup training.local

The client should receive:

• An IP between 192.168.50.100 and 192.168.50.200
• Subnet mask 255.255.255.0
• DNS server 192.168.50.10
• DNS suffix training.local

Part 11 — Create the AD Structure

Organizational Units

• Lab Users
• Lab Computers
• Disabled Users
• Security Groups

Global Security Groups

• FileShare_RW
• Management_Users
• HR_Users
• IT_Users

Part 12 — Create the First User

Create one user manually

Place the user in Lab Users, require a password change at next logon, and add the user to:

• FileShare_RW
• Management_Users

Part 13 — Join CLIENT01 to the Domain

Pre-checks

ipconfig /all
nslookup dc01.training.local
ping dc01

Steps

1. Join CLIENT01 to training.local.
2. Use authorized domain administrator credentials.
3. Restart the client.
4. Move the computer object into Lab Computers.

Part 14 — Log In with the Domain User

Steps

1. At the sign-in screen, choose Other user.
2. Log in with TRAINING\jsmith or jsmith@training.local.
3. Enter the temporary password.
4. Change the password when prompted.

Run:

whoami

Expected result:

training\jsmith

Part 15 — Disable and Re-enable the User

Steps

1. Disable jsmith in Active Directory Users and Computers.
2. Sign out from CLIENT01.
3. Attempt to sign in again.
4. Record the error.
5. Re-enable the account.
6. Test sign-in again.

Part 16 — Configure Account Lockout

Configure the lab policy

Edit the Default Domain Policy:

Computer Configuration
Policies
Windows Settings
Security Settings
Account Policies
Account Lockout Policy

Suggested values

• Threshold: 5 invalid attempts
• Duration: 15 minutes
• Reset counter after: 15 minutes

Test

1. Run gpupdate /force on the client.
2. Enter the wrong password enough times to lock the account.
3. Verify that the account is locked.
4. Unlock it in Active Directory Users and Computers.
5. Test login again.

Part 17 — Reset the User Password

Steps

1. Reset the password for jsmith.
2. Assign a temporary password.
3. Enable User must change password at next logon.
4. Log in with the temporary password.
5. Set a new password.

Part 18 — Create the First Shared Folder

Create and share

Create C:\Shares\General and share it as General.

UNC path: \\DC01\General

Suggested permissions

• Share: Authenticated Users — Change and Read
• NTFS: Administrators — Full Control
• NTFS: FileShare_RW — Modify

Test

From CLIENT01, open \\DC01\General and create, modify and delete a test file.

Part 19 — Map the General Drive with GPO

Create the GPO

Name: Map General Drive

Link it to: Lab Users

Configure

User Configuration
Preferences
Windows Settings
Drive Maps

• Action: Update
• Location: \\DC01\General
• Drive letter: Z:
• Label: General Share
• Reconnect: Enabled

Test

gpupdate /force

Sign out and sign back in, then confirm that Z: appears.

Part 20 — Generate 100 Fictional Users

Objective

Use an approved AI tool to generate 100 fictional employee records.

Required fields

• FirstName
• LastName
• DisplayName
• Username
• Department
• Password

Example CSV

FirstName,LastName,DisplayName,Username,Department,Password
John,Smith,John Smith,jsmith,IT,Training@123
Sarah,Adams,Sarah Adams,sadams,HR,Training@123

Save as C:\Lab\Users.csv.

Part 21 — Create Users with PowerShell

Run on DC01

Import-Module ActiveDirectory

$Users = Import-Csv "C:\Lab\Users.csv"
$OU = "OU=Lab Users,DC=training,DC=local"

foreach ($User in $Users) {
    $SecurePassword = ConvertTo-SecureString `
        $User.Password `
        -AsPlainText `
        -Force

    New-ADUser `
        -Name $User.DisplayName `
        -GivenName $User.FirstName `
        -Surname $User.LastName `
        -DisplayName $User.DisplayName `
        -SamAccountName $User.Username `
        -UserPrincipalName "$($User.Username)@training.local" `
        -Department $User.Department `
        -Path $OU `
        -AccountPassword $SecurePassword `
        -Enabled $true `
        -ChangePasswordAtLogon $true
}

Verify

Get-ADUser `
    -SearchBase "OU=Lab Users,DC=training,DC=local" `
    -Filter * |
Measure-Object

Part 22 — Add Users to Security Groups

Example script

$Users = Import-Csv "C:\Lab\Users.csv"

foreach ($User in $Users) {
    if ($User.Department -eq "IT") {
        Add-ADGroupMember `
            -Identity "IT_Users" `
            -Members $User.Username
    }

    if ($User.Department -eq "HR") {
        Add-ADGroupMember `
            -Identity "HR_Users" `
            -Members $User.Username
    }
}

Verify

Get-ADGroupMember -Identity "IT_Users"
Get-ADGroupMember -Identity "HR_Users"

Part 23 — Export Users to CSV

Run

Get-ADUser `
    -SearchBase "OU=Lab Users,DC=training,DC=local" `
    -Filter * `
    -Properties DisplayName,Department,Enabled,DistinguishedName |
Select-Object `
    Name,
    DisplayName,
    SamAccountName,
    Department,
    Enabled,
    DistinguishedName |
Export-Csv `
    "C:\Lab\AD-User-Inventory.csv" `
    -NoTypeInformation

Part 24 — Create a Second Shared Folder

Create and share

Create C:\Shares\Management and share it as Management.

UNC path: \\DC01\Management

Suggested NTFS permissions

• Administrators — Full Control
• Management_Users — Modify
• Other users — No access

Test manually

Test with one member of Management_Users and one user who is not a member.

Part 25 — Map the Management Drive Selectively

Create the GPO

Name: Map Management Drive

Link it to: Lab Users

Drive configuration

• Location: \\DC01\Management
• Drive letter: M:
• Label: Management Share
• Action: Update

Recommended: Item-Level Targeting

1. Open the mapped drive properties.
2. Select Common.
3. Enable Item-level targeting.
4. Add a Security Group condition.
5. Select Management_Users.

Test

• A management user receives M:.
• A normal user does not receive M:.
• An unauthorized user cannot open the share manually.

Part 26 — Enforce a Desktop Wallpaper

Prepare the image

Create C:\Shares\Wallpapers, share it as Wallpapers, and copy the image there.

Example path: \\DC01\Wallpapers\company-wallpaper.jpg

Grant Domain Users read access and test that the user can open the image manually.

Create the GPO

Name: Corporate Wallpaper

Link it to: Lab Users

User Configuration
Policies
Administrative Templates
Desktop
Desktop
Desktop Wallpaper

Set the UNC path and select a wallpaper style.

Also enable:

User Configuration
Policies
Administrative Templates
Control Panel
Personalization
Prevent changing desktop background

Part 27 — Restrict Control Panel

Create the GPO

Name: Restrict Control Panel

Link it to Lab Users or to a dedicated test-user OU.

User Configuration
Policies
Administrative Templates
Control Panel
Prohibit access to Control Panel and PC settings

Enable the policy, run gpupdate /force, sign out and sign back in, then test Control Panel and Windows Settings.

Part 28 — Verify Applied Group Policies

Commands

gpresult /r
mkdir C:\Temp
gpresult /h C:\Temp\GPReport.html
rsop.msc

Event Viewer

Applications and Services Logs
Microsoft
Windows
GroupPolicy
Operational

Part 29 — Important Commands

Network and DNS

ipconfig /all
ipconfig /release
ipconfig /renew
ipconfig /flushdns
nslookup dc01.training.local
ping dc01

User and Group Policy

whoami
whoami /groups
gpupdate /force
gpresult /r
gpresult /h C:\Temp\GPReport.html

Active Directory PowerShell

Get-ADUser -Filter *
Get-ADGroupMember -Identity "FileShare_RW"

Troubleshooting Guide

CLIENT01 does not receive DHCP

• Confirm both VMs use AD-Lab.
• Confirm the DHCP service is running.
• Confirm the DHCP server is authorized.
• Confirm the scope is active and has available addresses.

CLIENT01 cannot join the domain

• Confirm the client uses 192.168.50.10 as DNS.
• Confirm nslookup dc01.training.local works.
• Confirm time and domain name are correct.

User cannot log in

• Account enabled and not locked
• Password correct
• Domain Controller reachable
• User signing in to the domain, not the local computer

Mapped drive does not appear

• Share works manually
• GPO linked to the correct user OU
• User has permission
• gpresult /r shows the GPO
• Item-Level Targeting group is correct
• User signed out and back in

Required Deliverables

Required Deliverables

1. ESXi Host Client connection screenshot
2. Host and datastore information
3. Isolated virtual switch and port group
4. Confirmation that the switch has no physical uplink
5. Uploaded Windows ISO files
6. DC01 and CLIENT01 VM configurations
7. Windows Server and client installations
8. Domain Controller static IP configuration
9. Active Directory, DNS and DHCP configuration
10. OU and security-group structure
11. Manual user and successful domain join
12. Successful domain-user login
13. Disabled, locked and reset-password tests
14. General share and mapped Z: drive
15. CSV containing 100 fictional users
16. PowerShell user-creation script
17. Evidence that users were created
18. Group-membership results
19. Exported user inventory
20. Management share and selective M: drive
21. Unauthorized-user test
22. Desktop wallpaper GPO
23. Control Panel restriction
24. Group Policy HTML report
25. Troubleshooting notes and learning summary

Documentation Template

Use this format for every task

Objective

Explain what the task is intended to achieve.

Prerequisites

List anything that must already be configured.

Steps Performed

Write the steps in the order completed.

Commands Used

Include PowerShell and Command Prompt commands.

Screenshots

Add screenshots showing the important configuration and result.

Expected Result

Explain what should happen.

Actual Result

Explain what actually happened.

Errors Encountered

Record the exact error message where possible.

Resolution

Explain how the issue was fixed.

What I Learned

Write a brief summary of what was learned.

Final Review Questions

The trainee should be able to explain

1. Why Windows Home cannot be used as a domain client.
2. Why a Domain Controller requires a static IP address.
3. Why Active Directory depends on DNS.
4. Why domain clients must use the Domain Controller as DNS.
5. Why the isolated ESXi switch has no physical uplink.
6. The difference between an OU and a security group.
7. The difference between disabling and deleting a user.
8. The difference between a disabled and locked account.
9. The difference between share and NTFS permissions.
10. Why permissions should normally be assigned to groups.
11. The difference between Security Filtering and Item-Level Targeting.
12. Why restrictive GPOs should be tested with a normal test user.
13. How to force Group Policy processing.
14. How to verify which Group Policies were applied.
15. How CSV and PowerShell simplify bulk administration.