Active Directory Lab
Context and motivation
Administering Active Directory from the GUI is easy to do and hard to repeat. I built this lab to practice real AD administration from PowerShell and automation, in a repeatable, auditable way.
The lab automatically promotes a lab.local forest on Windows Server 2025 Core, structures the OUs by department and manages the user lifecycle (onboarding, offboarding, recovery) from CSV files.
Besides the domain it includes DHCP with reservations, a RHEL 9 client joined via realmd/sssd and a Squid proxy with filtering by domain groups.
Technologies
Main features
- Automated promotion of the lab.local forest (Windows Server 2025 Core)
- 18-point security audit aligned with the CIS Benchmark
- Hardening with mandatory SMBv2, Kerberos AES and LDAP signing
- AD Recycle Bin enabled for account recovery
- Desktop-standardization GPOs and per-role security groups
- Linux (RHEL 9) integration into the domain with realmd/sssd
- Pester test suite and documented architecture decisions (ADRs)
Gallery
Conclusion
It's a learning environment and I say so explicitly in the repository. There's a single DC, DHCP runs on the controller itself and the credentials are weak on purpose.
Standing up the domain was the easy part. What really paid off was documenting the decisions. Every unconventional solution (WinRM, LDAP signing via GPO templates, proxy authentication) has an ADR explaining why.