Build a Corporate Active Directory Lab

Set up a Windows Server 2022 domain with AD, DHCP, and WDS from scratch.

Introduction

30 Second Summary

Every office network you have ever connected to has a server behind the scenes deciding who can log in, which printers you can access, and what IP address your laptop gets. That invisible infrastructure is what keeps hundreds of people productive without calling IT every five minutes.

In this project, you will build that entire infrastructure from scratch on a single Windows Server 2022 virtual machine. You will create a working domain controller, automated IP assignment, and network-based OS deployment for a fictional company called Contoso Corp.

What You'll Build

When you are finished, you can log in with domain credentials, watch new devices receive IP addresses automatically, and PXE-boot a fresh Windows install over the network from your single server.

By the end of this project, you'll have:

A domain controller managing the contoso.local domain where you can log in with domain credentials and manage your entire network from one place.
Three department Organizational Units (IT, HR, Sales) each containing user accounts and a matching security group, mirroring a real company structure.
A DHCP scope that hands out IP addresses to any device joining the network, so you never have to configure a client manually.
A Windows Deployment Services server ready to PXE-boot client machines and deploy Windows over the network, replacing manual USB installs entirely.
Secret Mission: Lock down the HR department by applying a Group Policy that restricts access to Control Panel.

Are there any prerequisites?

You need VirtualBox installed with a Windows Server 2022 virtual machine already set up (Desktop Experience edition). You also need a Windows ISO file accessible to the VM for the deployment services step.

Before We Start

Before we dive in, let's lock in what you're about to build and why it matters.

You're going to transform a standalone Windows Server 2022 VM into a fully functional corporate server infrastructure for a fictional company called Contoso Corp. By the end, your single server will act as a domain controller, DNS server, DHCP server, and deployment server, giving you hands-on proof that you can build a real network from scratch.

Configure Your Server Foundation

Every Active Directory domain needs a single authority that manages users, computers, and policies. That authority is the domain controller. Before your server can become one, it needs two things locked in: a static IP address and a proper hostname.

Without a static IP, DNS records and Active Directory references would point to a changing address. Without a meaningful hostname, every service would reference a random string like WIN-XXXXXXX. Both would break everything that depends on them.

In this step, get ready to:

Assign a static IP address to your server's network adapter.
Rename the server from its random default to DC01.
Verify both changes with command-line tools.

Configure a static IP address

Your server currently gets its IP from DHCP, which means the address could change at any time. A domain controller needs a permanent address so every device on the network can always find it.

Right-click the network icon in the system tray (bottom-right of the taskbar).
Select Open Network and Internet settings.
Click Change adapter options.
Right-click your network adapter (labeled Ethernet) and select Properties.
Select Internet Protocol Version 4 (TCP/IPv4) in the list.
Click Properties.

The IPv4 Properties dialog lets you switch from automatic addressing to manual. You will enter your server's permanent network identity here.

Select Use the following IP address.
In the IP address field, type 192.168.1.10.
In the Subnet mask field, type 255.255.255.0.
In the Default gateway field, type 192.168.1.1.

Select Use the following DNS server addresses.
In the Preferred DNS server field, type 127.0.0.1.
Click OK to save the IPv4 settings.
Click Close on the Ethernet Properties window.

Why does DNS point to 127.0.0.1?

127.0.0.1 means "this machine." After you promote the server to a domain controller in the next step, it will also run the DNS server role. Pointing DNS to itself ensures all domain name lookups go to the right place.

Rename the server

Your server's current name is a random string that means nothing to you or anyone managing the network. A name like DC01 instantly tells you this machine is the first domain controller.

In Server Manager, click Local Server in the left pane.
Next to Computer name, click the current name (the random string like WIN-XXXXXXX).
In the System Properties dialog, click Change.
Under Computer name, clear the existing text and type DC01.
Click OK.

Windows will tell you that the computer must be restarted for the name change to take effect.

Click OK on the prompt telling you a restart is required.
Click Close on the System Properties dialog.
When prompted to restart, click Restart Now.

What happens during this restart?

Windows applies the new computer name to the system registry and network stack. After the restart, every service on this machine will identify itself as DC01 instead of the random string.

Verify the configuration

After the restart completes, log back in with your Administrator password.

Now it is time to confirm both changes took effect. Before you run the commands below, think about what you expect to see. Do you think the IP address and hostname will reflect your changes, or could something have reverted?

Press the Windows key, type Command Prompt, and press Enter to open it.
Confirm your static IP and DNS settings by running this command:

ipconfig /all

Look at the output under your Ethernet adapter. You should see your static IP address 192.168.1.10, subnet mask 255.255.255.0, and the DNS server showing 127.0.0.1.

Confirm the hostname by running this command:

hostname

The output should display DC01. If you see both the correct IP and hostname, your server foundation is solid.

Still seeing the old computer name or a different IP?

If hostname still shows the old random name, the restart may not have completed properly. Restart the server again from the Start menu.

If ipconfig /all shows a different IP, go back to the Ethernet adapter properties and double-check that you selected Use the following IP address (not the automatic option) and entered 192.168.1.10 exactly.

Need more help? Help me troubleshoot my static IP or hostname configuration

Your server now has a permanent address and a clear identity. Next up, you will install Active Directory Domain Services and promote this machine into the domain controller for contoso.local.

Install AD DS and Promote to Domain Controller

Your server now has a static IP and a clean hostname. It is ready to take on its most important role.

Right now, DC01 is just a standalone machine. There is no centralized way to manage users, computers, or security policies across a network. Active Directory Domain Services solves this by creating a single directory that every device on the network trusts. This step creates the contoso.local domain and transforms your standalone server into the authority for your entire network.

In this step, get ready to:

Install the Active Directory Domain Services role through Server Manager.
Promote DC01 to the domain controller for a brand-new forest called contoso.local.
Verify that the domain is live and the server responds as CONTOSO\Administrator.

Install the AD DS role

Before your server can become a domain controller, it needs the Active Directory Domain Services role installed. This role contains all the software components that make centralized authentication and directory lookups possible.

In Server Manager, click Manage in the top-right corner.
Select Add Roles and Features.
On the Before you begin page, click Next.
On Select installation type, choose Role-based or feature-based installation. Click Next.
On Select destination server, leave the default (DC01). Click Next.
On Select server roles, check the Active Directory Domain Services checkbox.
When prompted to add required features, click Add Features. Then click Next.
Click Next through the Features and AD DS pages.

On the Confirm installation selections page, click Install.
Wait for the installation to complete. You will see a progress bar fill up and a success message appear.
Click Close.

What did the role install do?

Installing the AD DS role copies the Active Directory binaries and management tools onto your server. It does not create a domain yet. Think of it like installing the engine before turning the key.

The actual domain creation happens in the next substep when you promote the server.

Don't see Active Directory Domain Services in the roles list?

Make sure you selected Role-based or feature-based installation on the installation type page. If you chose Remote Desktop Services installation, you will see a different set of roles.

Help me troubleshoot the Add Roles and Features wizard in Server Manager.

Promote the server to a domain controller

The AD DS role is installed, but your server still is not a domain controller. Promotion is the process that creates the actual domain database, sets up DNS, and makes this server the trusted authority for contoso.local.

In Server Manager, click the yellow notification flag at the top of the window.
Click Promote this server to a domain controller.
On Deployment Configuration, select Add a new forest.
In Root domain name, type contoso.local. Click Next.
On Domain Controller Options, leave Forest functional level and Domain functional level at the default (Windows Server 2016).
Ensure Domain Name System (DNS) server and Global Catalog (GC) are both checked.
Under Type the Directory Services Restore Mode (DSRM) password, enter P@ssw0rd123! in both fields. Click Next.

What is DSRM?

The Directory Services Restore Mode password is a recovery credential. If Active Directory ever becomes corrupted or unbootable, you use this password to start the server in a special repair mode. Keep it somewhere safe.

On DNS Options, you will see a delegation warning. This is normal for the first domain controller in a new forest. Click Next.
On Additional Options, verify the NetBIOS domain name shows as CONTOSO. Click Next.
On Paths, accept the defaults for Database, Log files, and SYSVOL folders. Click Next.
On Review Options, review your settings. Click Next.
On Prerequisites Check, wait for all checks to pass. You will see some yellow warnings about DNS delegation. These are normal. Click Install.
The server will restart automatically after promotion completes. This takes a few minutes.

Why does the server restart?

Promotion rewrites core system services. The server needs a fresh boot to start Active Directory, DNS, and the Netlogon service that handles domain authentication.

Verify the domain controller is live

After the restart, the login screen is your first clue that promotion worked.

Look at the login screen. The username field now shows CONTOSO\Administrator instead of the local account name.
Log in with your Administrator password.

Before you check Server Manager, predict what you expect to see differently compared to Step 1. What new items should appear in the left navigation pane?

Open Server Manager (it should launch automatically after login).
Look at the left navigation pane. Confirm that AD DS and DNS both appear with green status indicators.

You should see both Active Directory Domain Services and DNS Server listed with green checkmarks. This confirms your server is now the domain controller for contoso.local and is also serving DNS for the domain.

Seeing a yellow or red indicator on AD DS or DNS?

A yellow triangle usually means services are still starting. Wait one minute and click the refresh icon in Server Manager. If you see a red indicator, the DNS service may have failed to start because the static IP changed during promotion.

Open Command Prompt and run ipconfig /all to confirm your IP is still 192.168.1.10 and DNS points to 127.0.0.1.

Help me fix AD DS or DNS errors after domain controller promotion on Windows Server 2022.

Your standalone server is now the domain controller for an entire Active Directory forest. Next up, you will build out the organizational structure with departments, user accounts, and security groups that mirror a real company.

Build the OU Structure and Create Users

Your server is now the domain controller for contoso.local. Every user and computer that joins this domain will be managed from here.

Right now, Active Directory has only the default containers. Without structure, all accounts end up in one flat list with no way to apply different policies to different departments.

Organizational Units (OUs) let you mirror your company's real structure and target policies precisely. In this step, you will build a three-department structure for Contoso Corp.

In this step, get ready to:

Create three Organizational Units (IT, HR, Sales) to represent Contoso Corp's departments.
Add six user accounts across the three departments.
Create security groups and assign department members to each group.

Create Organizational Units

OUs are containers that group related objects like users, computers, and groups. You will create one OU per department so that each team's accounts live in their own space.

In Server Manager, click Tools in the top menu.
Select Active Directory Users and Computers.

The Active Directory Users and Computers console opens. This is where you manage all user accounts, groups, and OUs for your domain.

In the left pane, right-click contoso.local.
Point to New, then click Organizational Unit.
In the Name field, type IT.
Click OK.

You should see the IT OU appear under contoso.local in the left pane.

Repeat the same process: right-click contoso.local, point to New, click Organizational Unit.
Name this one HR and click OK.
Repeat once more and create an OU named Sales. Click OK.

You should now see three OUs listed under contoso.local in the left pane: IT, HR, and Sales.

Don't see all three OUs?

Make sure you right-clicked directly on contoso.local (not on an existing OU or the default containers). If an OU ended up inside another OU, right-click it and select Move to relocate it under contoso.local.

Help me fix my OU structure in Active Directory.

Create user accounts

Each department needs user accounts. You will create two users per OU, starting with the IT department. The first user walks you through the full process.

In the left pane, click the IT Organizational Unit to select it.
On the Action menu at the top, select New, then select User.

The New Object - User dialog opens.

In First name, type John.
In Last name, type Smith.
In User logon name, type jsmith.
Click Next.
In both the Password and Confirm password fields, type Welcome1!.
Uncheck User must change password at next logon.
Click Next, then click Finish.

John Smith (jsmith) now appears in the IT OU. You have created your first domain user.

Why uncheck the password change requirement?

In a production environment you would leave this checked so users set their own password on first login. For this lab, unchecking it lets you log in as any user without an extra step.

Now create the remaining five users using the same process. Each user goes into their department's OU with the same password and settings.

With the IT OU still selected, create a second user: First name Jane, Last name Doe, User logon name jdoe. Set the password to Welcome1! and uncheck the password change box.
Click the HR OU in the left pane.
Create a user: First name Mike, Last name Johnson, User logon name mjohnson. Password Welcome1!, uncheck the password change box.
Create a second user in HR: First name Sarah, Last name Williams, User logon name swilliams. Password Welcome1!, uncheck the password change box.
Click the Sales OU in the left pane.
Create a user: First name Tom, Last name Brown, User logon name tbrown. Password Welcome1!, uncheck the password change box.
Create a second user in Sales: First name Lisa, Last name Davis, User logon name ldavis. Password Welcome1!, uncheck the password change box.

Click through each OU in the left pane (IT, HR, Sales) and confirm each one shows two user accounts.

User ended up in the wrong OU?

Right-click the user and select Move. In the dialog, choose the correct OU and click OK. Always check which OU is selected in the left pane before creating a new user.

Help me move a user to the correct OU.

Create security groups and assign members

Security groups let you manage permissions for a whole department at once instead of configuring access user by user. Each department gets one group containing its members.

In the left pane, right-click the IT Organizational Unit.
Point to New, then click Group.
In Group name, type IT-Staff.
Leave Group scope as Global and Group type as Security.
Click OK.

The IT-Staff group now appears in the IT OU. Next, add the two IT users as members.

Right-click the IT-Staff group and select Properties.
Click the Members tab.
Click Add.
In the Select Users dialog, type jsmith; jdoe and click Check Names.
Both names should resolve (they will become underlined).
Click OK to close the Select Users dialog, then click OK again to close Properties.

The IT-Staff group now has two members. Repeat this process for the other two departments.

Right-click the HR OU, point to New, click Group.
Name the group HR-Staff. Leave scope as Global and type as Security. Click OK.
Right-click HR-Staff, select Properties, go to the Members tab, click Add.
Type mjohnson; swilliams, click Check Names, then click OK twice to close.
Right-click the Sales OU, point to New, click Group.
Name the group Sales-Staff. Leave scope as Global and type as Security. Click OK.
Right-click Sales-Staff, select Properties, go to the Members tab, click Add.
Type tbrown; ldavis, click Check Names, then click OK twice to close.

What are security groups for?

Instead of granting permissions to individual users, you grant them to a group. When a new employee joins the Sales team, you add them to Sales-Staff and they automatically inherit all the permissions that group already has.

You will see this in action during the Secret Mission, where a Group Policy targets all users in a single OU.

Before you verify, what do you expect to see inside each OU now? Think about how many objects each should contain.

In Active Directory Users and Computers, expand contoso.local in the left pane.
Click the IT OU. Confirm you see two user accounts (John Smith, Jane Doe) and one group (IT-Staff).
Click the HR OU. Confirm you see two user accounts (Mike Johnson, Sarah Williams) and one group (HR-Staff).
Click the Sales OU. Confirm you see two user accounts (Tom Brown, Lisa Davis) and one group (Sales-Staff).

Each OU should contain exactly three objects: two users and one security group.

Check Names won't resolve a user?

Make sure you typed the logon name exactly as you created it (case does not matter, but spelling does). If you separated multiple names, use a semicolon between them. If the user still does not resolve, open the OU and confirm the account exists there first.

Help me troubleshoot Check Names not resolving.

Your domain now has a complete organizational structure. Next up, you will install and configure DHCP so that devices on your network get IP addresses automatically without any manual setup.

Install and Configure DHCP

Your domain is alive. You have a domain controller managing contoso.local, three departments organized into OUs, and users ready to authenticate. Now it is time to solve a practical problem: how do those users' workstations get network addresses?

Without DHCP, every device joining your network needs a manually configured IP address. On a network with dozens or hundreds of machines, that is not feasible. DHCP automates IP assignment so new devices get connected immediately.

In this step, get ready to:

Install the DHCP Server role on DC01.
Authorize the DHCP server in Active Directory.
Create and activate a scope to hand out IP addresses.

Install the DHCP Server role

Installing the DHCP Server role follows the same wizard you used for AD DS. Server Manager handles the role installation, then a separate post-install step authorizes the server.

In Server Manager, click Manage in the top-right corner.
Select Add Roles and Features.
On the Before you begin page, click Next.
On Select installation type, choose Role-based or feature-based installation. Click Next.
On Select destination server, leave the default (DC01). Click Next.
On Select server roles, check the DHCP Server checkbox.
When prompted to add required features, click Add Features. Click Next.
Click Next through the Features page and the DHCP Server information page.

On Confirm installation selections, click Install.
Wait for the installation to complete, then click Close.

A yellow notification flag appears in Server Manager's top menu bar. This is your signal that post-install configuration is needed.

Don't see the yellow notification flag?

The installation may still be running. Wait for the progress bar to reach 100% and the Close button to become available.

If you already closed the wizard, click the flag icon area at the top of Server Manager. The notification should still be waiting there.

Help me troubleshoot my DHCP role installation in Server Manager.

Complete post-install configuration and authorize

A DHCP server must be authorized in Active Directory before it can hand out IP addresses. This prevents rogue DHCP servers from disrupting the network.

In Server Manager, click the yellow notification flag at the top.
Click Complete DHCP configuration.
In the DHCP Post-Install configuration wizard, click Next.
On the Authorization page, click Commit.
Verify the summary shows authorization was successful. Click Close.

What does authorization do?

The authorization step uses your CONTOSO\Administrator credentials to register this DHCP server as a trusted source in Active Directory. Only authorized servers can lease IP addresses on the domain.

This prevents someone from plugging in an unauthorized DHCP server that hands out conflicting addresses and breaks network connectivity for everyone.

To confirm authorization worked, open the DHCP console now.

In Server Manager, click Tools in the top menu.
Click DHCP.
In the DHCP console, expand dc01.contoso.local. The server icon should display a green checkmark, confirming it is authorized.

Server icon shows a red arrow or no checkmark?

Right-click the server name in the DHCP console and select Authorize. Then right-click again and select Refresh. The icon should turn green.

Make sure you are logged in as CONTOSO\Administrator. Only domain admins can authorize a DHCP server.

Help me authorize my DHCP server in Active Directory.

Create a DHCP scope

A scope defines the range of IP addresses the server can lease and the network settings it gives to clients. You will create a scope that hands out addresses from 192.168.1.100 to 192.168.1.200.

In the DHCP console, expand dc01.contoso.local, then expand IPv4.
Right-click IPv4 and select New Scope.
The New Scope Wizard opens. Click Next.
In Scope Name, type Contoso-LAN. Click Next.
On IP Address Range, enter 192.168.1.100 in the Start IP address field.
Enter 192.168.1.200 in the End IP address field.
Confirm the Subnet mask reads 255.255.255.0. Click Next.
On Add Exclusions and Delay, click Next (no exclusions needed for this lab).

What are DHCP options?

Beyond an IP address, DHCP can tell clients their default gateway (the router to reach the internet), their DNS server (for resolving domain names), and the domain they belong to. The next few wizard pages configure these options so every client gets a complete network setup automatically.

On Lease Duration, leave the default (8 days). Click Next.
On Configure DHCP Options, select Yes, I want to configure these options now. Click Next.
On Router (Default Gateway), type 192.168.1.1 and click Add. Click Next.
On Domain Name and DNS Servers, verify Parent domain shows contoso.local.
In the IP address field, type 192.168.1.10 and click Add (if not already listed). Click Next.
On WINS Servers, click Next (skip this).
On Activate Scope, select Yes, I want to activate this scope now. Click Next, then Finish.

What did the scope just configure?

Any device that connects to this network and requests an IP address will now automatically receive an address between 192.168.1.100 and 192.168.1.200, along with the gateway, DNS server, and domain name. No manual configuration needed on the client.

Before you check the final result, what do you expect to see in the DHCP console now that the scope is created and activated?

In the DHCP console, expand dc01.contoso.local, then expand IPv4.

You should see a scope named Contoso-LAN with a green checkmark showing it is active. The server icon for dc01.contoso.local also shows a green checkmark, confirming it is authorized in Active Directory.

Scope shows a red X instead of a green checkmark?

A red X means the scope was not activated. Right-click the Contoso-LAN scope, then select Activate.

If you do not see the scope at all, repeat the New Scope Wizard from the right-click menu on IPv4.

Help me fix my DHCP scope activation issue.

Your network now has automated IP addressing. Any device that connects gets an address, a gateway, and a DNS server without anyone touching its settings. Next up, you will set up Windows Deployment Services so you can push entire operating system installations across the network.

Install and Configure Windows Deployment Services

Your domain controller is managing users and your DHCP server is handing out IP addresses automatically. The next piece of the puzzle is getting Windows installed on new machines without walking around with a USB drive.

Manually installing an operating system from a USB drive or DVD on every new workstation does not scale. Windows Deployment Services (WDS) lets client computers boot over the network using PXE and pull an operating system image directly from your server. In this step, you will install WDS and load it with the images it needs to deploy Windows to any machine on your network.

In this step, get ready to:

Install the Windows Deployment Services role on your server.
Configure WDS to integrate with Active Directory and respond to PXE boot requests.
Add boot and install images from a Windows ISO so WDS can deploy operating systems.

Install the WDS role

WDS requires both Active Directory and DHCP to already be in place before it can be configured. Since you have both running, you are ready to add the role.

In Server Manager, click Manage in the top-right corner.
Select Add Roles and Features.
Click Next through the Before you begin page.
On Select installation type, choose Role-based or feature-based installation and click Next.
On Select destination server, leave the default (DC01) and click Next.
On Select server roles, check the Windows Deployment Services checkbox.
When prompted to add required features, click Add Features.
Click Next through the Features page.

On the WDS page, ensure both Deployment Server and Transport Server are checked.
Click Next.
On Confirm installation selections, click Install.
Wait for the installation to complete, then click Close.

After installation completes, you should see Windows Deployment Services listed in Server Manager's left navigation pane.

What are Deployment Server and Transport Server?

Deployment Server provides the full WDS feature set including PXE boot, image management, and client interaction. Transport Server handles the underlying multicast and network transfer functionality.

You need both for a complete WDS setup that can boot and image client machines over the network.

Don't see Windows Deployment Services in the roles list?

Make sure you are on the Select server roles page, not the Features page. WDS is a role, not a feature.

If you still don't see it, scroll to the bottom of the roles list. It is listed alphabetically under W.

Help me find the WDS role in the Add Roles and Features wizard.

Configure WDS to integrate with Active Directory

The role is installed, but WDS does not know where to store images or how to respond to network boot requests yet. The Configuration Wizard connects WDS to your Active Directory domain and sets up PXE responses.

In Server Manager, click Tools in the top menu.
Click Windows Deployment Services.
In the WDS console, expand Servers.
Right-click DC01.contoso.local and select Configure Server.

The WDS Configuration Wizard opens. Work through the following pages:

On Before You Begin, click Next.
On Install Options, select Integrated with Active Directory and click Next.
On Remote Installation Folder Location, accept the default path (C:\RemoteInstall) and click Next.
On Proxy DHCP Server, check Do not listen on DHCP and DHCPv6 ports.
Also check Configure DHCP options for Proxy DHCP and click Next.
On PXE Server Initial Settings, select Respond to all client computers (known and unknown) and click Next.

Wait for the configuration to complete.
Uncheck Add images to the server now (you will do this in the next substep).
Click Finish.

After the wizard completes, the server icon for DC01.contoso.local in the WDS console should show a green play arrow, indicating the service is running.

Why the Proxy DHCP settings?

Your DHCP server and WDS are running on the same machine. Both services use network ports that overlap. The proxy settings tell WDS to stay off the DHCP ports and instead use a separate channel (port 4011) for PXE boot traffic.

Without this configuration, WDS and DHCP would fight over the same ports and neither would work reliably.

Server icon shows a yellow warning instead of a green arrow?

This usually means the service failed to start. Right-click DC01.contoso.local in the WDS console and select All Tasks, then Start to manually start the service.

If it still fails, confirm that DHCP is running and that the scope is active. WDS depends on both AD DS and DHCP being operational.

Help me troubleshoot why my WDS server is not starting.

Add boot and install images from a Windows ISO

WDS is running, but it has no operating system images to serve. You need two types of images: a boot image (the mini environment that starts on the client machine during PXE boot) and an install image (the actual Windows OS that gets deployed).

In VirtualBox, go to your VM's settings.
Click Storage in the left panel.
Under Controller: IDE, click the empty disk icon.
Click the disk icon on the right and select Choose a disk file.
Browse to your Windows Server 2022 ISO file and select it.
Click OK to save settings.

Inside the VM, the ISO now appears as a DVD drive (typically D:). You can confirm this by opening File Explorer and checking that the drive is listed.

Now add the boot image to WDS:

Switch back to the WDS console.
Expand DC01.contoso.local in the left pane.
Right-click Boot Images and select Add Boot Image.
Click Browse and navigate to D:\sources\boot.wim.
Click Open, then click Next.
Accept the default image name and description.
Click Next, then click Finish.

You should now see your boot image listed under the Boot Images node in the WDS console.

Next, add the install image:

Right-click Install Images and select Add Install Image.
When prompted for an image group name, type Windows Images and click Next.
Click Browse and navigate to D:\sources\install.wim.
Click Open, then click Next.
Select at least one Windows edition from the list by checking its checkbox.
Click Next, then click Finish.

What are boot.wim and install.wim?

Both files live in the sources folder of any Windows installation media. boot.wim is the Windows PE environment that loads first when a client PXE-boots. It provides the setup interface where the technician picks the install image.

install.wim contains the full Windows operating system. A single install.wim can hold multiple editions (Standard, Datacenter), which is why the wizard asks you to select which editions to make available.

Can't find boot.wim at D:\sources?

Open File Explorer and check which drive letter the ISO was assigned. It might be E: instead of D: depending on your VM configuration.

If you don't see any DVD drive listed, go back to VirtualBox settings and confirm the ISO is attached under Storage. You may need to shut down the VM to change storage settings, then restart it.

Help me mount a Windows ISO in my VirtualBox VM.

Verify the full WDS setup

Before you wrap up, take a moment to predict what you expect to see. Do you think the WDS console will show all images ready and the service running?

In the WDS console, expand Servers, then expand DC01.contoso.local.
Confirm the server icon shows a green play arrow indicating the service is running.
Expand Boot Images and confirm you see your boot.wim image listed.
Expand Install Images and confirm you see the Windows Images group containing your selected edition(s).

You should see all three confirmed: the green arrow, the boot image, and the install image group. Your WDS server is now fully operational and ready to PXE-boot client machines for OS deployment.

Secret mission

Apply a Group Policy to the HR Department

Your Active Directory is organized, but it's not enforcing anything yet. Can you lock down the HR department by applying a Group Policy that restricts access to Control Panel?

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely. This project runs entirely locally in a VirtualBox VM, so there are no ongoing costs.

Resources you used:

Windows Server 2022 VM in VirtualBox (contains all roles: AD DS, DNS, DHCP, WDS, and your domain configuration).
Windows Server 2022 ISO file stored on your host machine (used for WDS boot and install images).

Keep everything running

No action needed. Choose this if you are still actively building on this environment or plan to add more roles, users, or Group Policies.

Your VM continues running (or remains in its current saved state) in VirtualBox.
All six user accounts, three OUs, DHCP scope, WDS images, and your GPO remain intact and functional.
The Windows Server 2022 evaluation license is valid for 180 days from installation.

Pause - I'll come back to this later

Save the VM state to free up memory and CPU on your host machine while preserving your full configuration.

In VirtualBox Manager, right-click your Windows Server 2022 VM.
Select Close, then Save State.
This saves the VM's current memory state to disk. When you resume later, it picks up exactly where you left off.

Delete - I don't want to use this again

Remove the VM and all associated files to reclaim disk space on your host machine.

In VirtualBox Manager, right-click your Windows Server 2022 VM.
Select Remove.
When prompted, click Delete all files to remove the virtual hard disk and all snapshots.
Delete the Windows Server 2022 ISO file from your host machine if you no longer need it.

Nice Work!

You just built a complete corporate server infrastructure from scratch on Windows Server 2022. Your single machine now runs as a domain controller, DNS server, DHCP server, and deployment server for an entire fictional company.

You've learned how to:

Promote a Windows Server to a domain controller for the contoso.local domain, establishing centralized authentication and DNS for your entire network.
Build a realistic Active Directory organizational structure with department OUs, user accounts, and security groups that mirror how real companies manage their employees.
Install and configure DHCP for automatic IP assignment and Windows Deployment Services for PXE-based OS deployment, automating the two most repetitive tasks in network administration.
Secret Mission: Apply a Group Policy to the HR OU that restricts access to Control Panel, demonstrating how GPOs enforce security policies on specific groups of users.

Ready to quiz yourself?