Build an Active Directory Domain

Introduction

30 Second Summary

Every time you log into a work computer, something behind the scenes checks who you are and what you're allowed to access. That something is usually Active Directory, the identity system at the heart of every Windows enterprise network.

In this project, you will build a complete Active Directory lab environment on your own PC. You'll deploy a Domain Controller, create users and departments with PowerShell, enforce security policies, and join a workstation to your domain.

What You'll Build

A fully functional Active Directory domain running on virtual machines, simulating a small enterprise with departments, users, security groups, and Group Policy enforcement.

By the end of this project, you'll have:

• A Windows Server 2022 Domain Controller running Active Directory Domain Services and DNS for the domain corp.local.
• An organized enterprise directory with Organizational Units, security groups, and users created via PowerShell bulk provisioning.
• Group Policy Objects enforcing security baselines like password requirements, account lockout, and screen lock timeouts across your domain.
• Secret Mission: Simulate a real-world employee offboarding workflow to secure a departing user's account.

Are there any prerequisites?

You need a Windows PC with at least 16 GB of RAM and around 120 GB of free disk space. No prior software installations are required. This guide walks you through setting up every tool from scratch using free evaluation licenses.

Download and Install VirtualBox

Every enterprise network runs on Active Directory. It is the identity system that controls who can log in, what they can access, and how security policies get enforced across thousands of machines.

To build your own Active Directory lab safely, you need virtual machines running on your PC. In this step, you will install VirtualBox (a free virtualization tool), download the Windows ISOs you need, and create your first VM for the Domain Controller.

In this step, get ready to:

• Install VirtualBox 7.2.8 on your Windows PC.
• Download Windows Server 2022 and Windows 11 Enterprise evaluation ISOs.
• Create and configure the DC01 virtual machine with Windows Server 2022 installed.

Install VirtualBox on your PC

VirtualBox lets you run entire operating systems inside windows on your desktop. You will use it to host both your Domain Controller and a Windows 11 workstation without needing separate physical hardware.

• Press the Windows key to open your search bar.
• Type VirtualBox and look at what appears in the results.

✔️ I see VirtualBox 7.2 or higher

You already have a compatible version installed. You can skip ahead to the next substep where you download the evaluation ISOs.

ⓧ I see an older version of VirtualBox

You need to upgrade to version 7.2.8 for compatibility with this project.

• Open your currently installed VirtualBox.
• Click File in the top menu bar, then click Check for Updates.
• If an update is available, follow the prompts to download and install it.
• If no update appears, uninstall VirtualBox from Settings > Apps > Installed apps, then follow the fresh install instructions in the next tab.

ⓧ VirtualBox doesn't appear in my search

VirtualBox is not installed yet. Follow these steps to download and install it.

• Open your web browser and navigate to the VirtualBox downloads page:
• https://www.virtualbox.org/wiki/Downloads
• Click the Windows hosts link to download the installer. The file is named VirtualBox-7.2.8-173730-Win.exe and is approximately 170 MB.
• Once the download completes, double-click the installer file to run it.
• Click Next on each screen, accepting all the default options.
• Click Install when prompted. Windows may ask for permission to install network drivers. Click Yes to allow them.
• Click Finish when the installation completes.

Verify the installation by pressing the Windows key, typing VirtualBox, and pressing Enter. You should see the Oracle VirtualBox Manager window open.

VirtualBox won't install or VMs run extremely slowly?

The most common cause is a conflict with Hyper-V. Windows enables Hyper-V features in the background for security tools like Memory Integrity, which blocks VirtualBox from using hardware virtualization.

To fix this, open Turn Windows features on or off from the Start menu. Uncheck Hyper-V, Virtual Machine Platform, and Windows Hypervisor Platform. Restart your PC, then try again.

If VMs still run slowly, also disable Memory Integrity under Windows Security > Device Security > Core isolation details.

Help me fix a Hyper-V conflict with VirtualBox

Download the Windows evaluation ISOs

You need two ISO files for this project. Microsoft offers free evaluation licenses for both Windows Server 2022 (180 days) and Windows 11 Enterprise (90 days). These are large downloads, so start them now.

What is an ISO file?

An ISO file is a complete disc image. VirtualBox treats it like a physical DVD inserted into a virtual machine's optical drive. You boot from it to install the operating system.

Download the Windows Server 2022 ISO first:

• Open the Microsoft Evaluation Center download page for Windows Server 2022:
• https://www.microsoft.com/en-us/evalcenter/download-windows-server-2022
• If prompted, sign in with a Microsoft account or register for free.
• Select English (United States) under ISO downloads.
• Click the download link. The file is approximately 4.7 GB.

While that downloads, start the Windows 11 Enterprise ISO download:

• Open the Windows 11 Enterprise Evaluation page:
• https://www.microsoft.com/en-us/evalcenter/evaluate-windows-11-enterprise
• Select version 25H2 and the 64-bit ISO edition.
• Complete the registration form if prompted, then click download.

Let the ISOs download in the background

Both files are large and may take 15-30 minutes depending on your internet speed. You only need the Windows Server 2022 ISO to continue with the next substep. The Windows 11 ISO is used in Step 5.

Once the Windows Server 2022 ISO finishes downloading, note where your browser saved it (usually your Downloads folder). You will need the file path in the next substep.

Download page asks for a product key?

The Evaluation Center pages require registration but do not require a purchased product key. If you see a registration form, fill it out with your details and the download link will appear afterwards. The evaluation is free for 180 days (Server) and 90 days (Windows 11).

Help me download the Windows Server 2022 evaluation ISO

Create the DC01 virtual machine

Now you will create the virtual machine that becomes your Domain Controller. A Domain Controller is the server that runs Active Directory and authenticates every user and computer on the network.

• In VirtualBox Manager, click the New button in the toolbar at the top.
• In the Name field, type DC01.
• Set Type to Microsoft Windows.
• Set Version to Windows 2022 (64-bit).
• Click Next.
• Set the Base Memory to 4096 MB (4 GB).
• Click Next.
• For the virtual hard disk, select Create a Virtual Hard Disk Now and set the size to 60 GB.
• Click Next, review the summary, then click Finish.

You should now see DC01 listed in the left panel of VirtualBox Manager.

Next, attach the Windows Server 2022 ISO to the VM's optical drive:

• Select DC01 in the left panel, then click Settings.
• Click Storage in the left sidebar of the Settings window.
• Under Controller: IDE, click the disc icon that shows Empty.
• On the right side, click the small disc icon next to Optical Drive and select Choose a disk file.
• Browse to your Downloads folder and select the Windows Server 2022 ISO file you downloaded.
• Click OK to close the Settings window.

Now start the VM and install Windows Server:

• Double-click DC01 in the left panel (or select it and click Start) to boot the VM.
• The VM will boot from the ISO. On the language screen, leave the defaults (English) and click Next.
• Click Install now.
• On the product key screen, click I don't have a product key. This activates the free 180-day evaluation.
• Select Windows Server 2022 Standard Evaluation (Desktop Experience) from the list, then click Next.
• Accept the license terms and click Next.
• Select Custom: Install Microsoft Server Operating System only (advanced).
• Select the 60 GB unallocated drive and click Next. The installation will begin.
• Wait for the installation to complete. The VM will restart automatically during this process.
• After the final restart, you will be prompted to set an Administrator password. Choose a strong password you will remember and click Finish.

Why Desktop Experience?

Windows Server comes in two flavours: Server Core (command-line only) and Desktop Experience (full GUI). Desktop Experience gives you the familiar Windows interface with Server Manager, which makes learning Active Directory much more approachable.

After setting the password, Windows will show the lock screen. Press Ctrl+Alt+Delete to unlock. In VirtualBox, use the menu Input > Keyboard > Insert Ctrl+Alt+Del instead (since your host PC will intercept the key combination).

• Log in with the Administrator password you just set.

You should now see the Windows Server 2022 desktop with Server Manager opening automatically.

VM shows a black screen or won't boot?

Make sure you attached the ISO to the optical drive before starting the VM. If you see a black screen with no activity, power off the VM (close the window and select Power off the machine), go back to Settings > Storage, and confirm the ISO is loaded.

If the VM starts but runs extremely slowly, you likely have a Hyper-V conflict. Refer to the troubleshooting callout in the install substep above.

Help me troubleshoot my DC01 VM not booting

Your virtualization environment is ready and Windows Server is running. Next up, you will configure networking on DC01 and promote it to a Domain Controller.

Configure Networking and Promote to Domain Controller

Your DC01 VM is running Windows Server 2022, but it is still a standalone machine with no identity on the network. Before you can build your Active Directory domain, the server needs a fixed address so other machines can always find it.

In this step, you will give DC01 a static IP, rename it, install the Active Directory Domain Services role, and promote it to the Domain Controller for a brand-new forest called corp.local.

In this step, get ready to:

• Rename DC01 and set a static IP with DNS pointing to itself.
• Install the AD DS role and promote DC01 to a Domain Controller.
• Verify the domain is operational.

Set a static IP and rename the server

A Domain Controller must have a predictable IP address so every device on the network can reach it for authentication and DNS lookups. You will also point the server's preferred DNS to itself (127.0.0.1) because once promoted, it will host the domain's DNS zone.

• Inside the DC01 VM, right-click the Start button and select Windows PowerShell (Admin).
• Confirm you see Administrator in the title bar of the window that opens.

Why PowerShell as Administrator?

Network configuration and server roles require elevated privileges. Running PowerShell as Administrator ensures your commands have the permissions they need.

• First, identify your network adapter's interface index by running:

# List all network adapters and their interface indexes
Get-NetAdapter

What does this command do?

Get-NetAdapter displays all network adapters on the server along with their Name, InterfaceDescription, and ifIndex (interface index). You will need the ifIndex number for the next commands.

• Note the ifIndex number of the adapter whose Status is Up. In a default VirtualBox NAT setup this is typically Ethernet with an index like 6 (your number may differ).
• Rename the computer to DC01 and assign the static IP by running these commands (replace 6 with your actual interface index):

# Rename the computer to DC01
Rename-Computer -NewName "DC01" -Force

# Remove the existing DHCP-assigned IP (answer Yes if prompted)
Remove-NetIPAddress -InterfaceIndex [[IFINDEX="your interface index number (e.g. 6)"]] -Confirm:$false

# Assign a static IP address
New-NetIPAddress -InterfaceIndex [[IFINDEX="your interface index number (e.g. 6)"]] -IPAddress 10.0.2.15 -PrefixLength 24 -DefaultGateway 10.0.2.2

# Set the preferred DNS server to the loopback address (itself)
Set-DnsClientServerAddress -InterfaceIndex [[IFINDEX="your interface index number (e.g. 6)"]] -ServerAddresses 127.0.0.1

# Restart to apply the computer name change
Restart-Computer

What does this code do?

Rename-Computer changes the hostname from a random string to DC01. A clean hostname makes your lab easier to manage.

New-NetIPAddress assigns 10.0.2.15 as the static IP. VirtualBox NAT uses the 10.0.2.0/24 subnet with 10.0.2.2 as the default gateway.

Set-DnsClientServerAddress points DNS to 127.0.0.1 (itself). Once promoted, this server becomes the authoritative DNS server for the domain.

• Wait for the VM to restart. Log back in as Administrator with the password you set during installation.

Can't connect after restarting?

If you see No internet after the restart, double-check that you used the correct interface index and that the gateway is 10.0.2.2 (VirtualBox NAT default). Run Get-NetIPConfiguration to review the current settings.

help me fix my static IP configuration on Windows Server in VirtualBox

Install AD DS and promote to Domain Controller

With networking in place, you can now install the Active Directory Domain Services role and promote this server to the first Domain Controller in a new forest.

• Open PowerShell as Administrator again (right-click Start and select Windows PowerShell (Admin)).
• Install the AD DS role by running:

# Install Active Directory Domain Services and management tools
Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools

What does this command do?

Install-WindowsFeature adds the AD DS binaries and all associated management consoles (like Active Directory Users and Computers) to the server. This does not yet create a domain. It just installs the software needed for the next step.

• Wait for the installation to complete. You should see Success with True in the output.
• Promote the server to a Domain Controller by running:

# Create a new AD forest and promote this server to Domain Controller
Install-ADDSForest -DomainName "corp.local" -DomainNetbiosName "CORP" -InstallDns

What does this command do?

Install-ADDSForest creates an entirely new Active Directory forest with the domain name corp.local and the NetBIOS name CORP.

The -InstallDns flag ensures the DNS Server role is installed alongside AD DS. Active Directory depends on DNS to locate domain resources.

You will be prompted for a DSRM password

The command will ask you to set a Directory Services Restore Mode (DSRM) password. This is a recovery password used if you ever need to boot the DC into repair mode. Enter a strong password and remember it.

You will also see several warnings about DNS delegation and Windows Server technical defaults. These are safe to accept in a lab environment. Type A and press Enter if prompted to continue.

• The server will restart automatically after promotion completes. This may take a few minutes.
• Once restarted, the login screen will show CORP\Administrator. Sign in with the same Administrator password you set earlier.

Server stuck on restarting?

AD DS promotion can take 3 to 5 minutes on a VM. If the screen stays black for more than 10 minutes, press the Right Ctrl key to release keyboard capture, then use the VirtualBox menu Machine > Reset to force a reboot.

help me troubleshoot my AD DS promotion that seems stuck during restart

Verify the domain is running

After the reboot you should be logged in as CORP\Administrator. Now you will confirm that Active Directory and DNS are functioning.

• Open PowerShell as Administrator.
• Verify the domain by running:

# Confirm the domain name and forest details
Get-ADDomain

• Confirm the output shows DNSRoot as corp.local and NetBIOSName as CORP.
• Verify DC01 is listed as a domain controller by running:

# Confirm this server is a domain controller
Get-ADDomainController

• Confirm Name shows DC01 and Domain shows corp.local.

What should I see?

Get-ADDomain returns the full details of your new forest: domain name, forest name, domain controllers, and infrastructure masters.

Get-ADDomainController confirms that DC01 is registered as the domain controller for corp.local, handling authentication and DNS for the entire domain.

Get-ADDomain returns an error?

If you see a "cannot contact the server" error, the DNS service may not have finished starting. Wait 60 seconds and try again. You can also run Get-Service dns to check if the DNS service status is Running.

help me fix Get-ADDomain errors after promoting my server to a domain controller

Your domain is live. DC01 is now the authoritative Domain Controller and DNS server for corp.local. Next, you will populate this domain with an enterprise-style OU structure, security groups, and users.

Build the OU Structure and Create Users

Your Domain Controller is live and running Active Directory Domain Services. Right now, corp.local is an empty domain with no structure for organizing the people and machines that belong to it.

In this step, you will build the directory structure that mirrors a real enterprise. You will create Organizational Units for departments, security groups for access control, and domain users for each team using PowerShell.

In this step, get ready to:

• Create an OU hierarchy with IT, HR, and Finance departments.
• Provision security groups for role-based access control.
• Bulk-create domain users with PowerShell and assign group memberships.

Create the OU hierarchy

Organizational Units are containers that let you group AD objects by department, location, or function. They are also the smallest unit you can target with Group Policy.

• Switch back to PowerShell (Admin) on DC01.
• Create the three top-level department OUs by running this script:

# Create top-level Organizational Units for each department
New-ADOrganizationalUnit -Name "IT" -Path "DC=corp,DC=local"
New-ADOrganizationalUnit -Name "HR" -Path "DC=corp,DC=local"
New-ADOrganizationalUnit -Name "Finance" -Path "DC=corp,DC=local"

What does this code do?

Each New-ADOrganizationalUnit command creates a new OU directly under the corp.local domain root. The -Path parameter uses X.500 distinguished name format to specify where the OU lives in the directory tree.

• Create sub-OUs for Users and Computers inside each department by running:

# Create Users and Computers sub-OUs inside each department
New-ADOrganizationalUnit -Name "Users" -Path "OU=IT,DC=corp,DC=local"
New-ADOrganizationalUnit -Name "Computers" -Path "OU=IT,DC=corp,DC=local"

New-ADOrganizationalUnit -Name "Users" -Path "OU=HR,DC=corp,DC=local"
New-ADOrganizationalUnit -Name "Computers" -Path "OU=HR,DC=corp,DC=local"

New-ADOrganizationalUnit -Name "Users" -Path "OU=Finance,DC=corp,DC=local"
New-ADOrganizationalUnit -Name "Computers" -Path "OU=Finance,DC=corp,DC=local"

Why sub-OUs for Users and Computers?

Splitting each department into a Users sub-OU and a Computers sub-OU lets you apply different Group Policies to people versus machines. This mirrors how real enterprise environments separate user accounts from workstation objects.

• Verify the OU structure was created by running:

Get-ADOrganizationalUnit -Filter * | Select-Object Name, DistinguishedName

You should see 9 OUs listed: IT, HR, Finance at the top level, plus Users and Computers nested under each.

Not seeing all 9 OUs?

• Check for typos in the -Path values. The distinguished name must match exactly (e.g., OU=IT,DC=corp,DC=local not OU=IT, DC=corp, DC=local with spaces).
• If you see an error about an object already existing, a previous run may have partially completed. Run the Get-ADOrganizationalUnit command to see what exists and only create the missing ones.
• help me troubleshoot my OU creation errors

Create security groups for role-based access control

Security groups let you assign permissions and target GPOs to a collection of users rather than managing each account individually. This is the foundation of Role-Based Access Control (RBAC).

• Create one security group per department by running:

# Create security groups for role-based access
New-ADGroup -Name "IT-Admins" -GroupScope Global -GroupCategory Security -Path "OU=IT,DC=corp,DC=local"
New-ADGroup -Name "HR-Staff" -GroupScope Global -GroupCategory Security -Path "OU=HR,DC=corp,DC=local"
New-ADGroup -Name "Finance-Team" -GroupScope Global -GroupCategory Security -Path "OU=Finance,DC=corp,DC=local"

What does this code do?

• -GroupScope Global means these groups can contain members from this domain and be used in any domain in the forest.
• -GroupCategory Security makes them usable for permission assignments (as opposed to Distribution groups, which are for email lists).
• Each group is placed inside its department's OU so it stays organized alongside the users it contains.

• Confirm the groups exist by running:

Get-ADGroup -Filter * -SearchBase "DC=corp,DC=local" | Where-Object { $_.Name -in @("IT-Admins","HR-Staff","Finance-Team") } | Select-Object Name, GroupScope, DistinguishedName

You should see all three groups listed with their scope set to Global and their paths inside the correct department OUs.

Groups not showing up?

• Verify the -Path in each New-ADGroup command points to an OU that exists. If you skipped the OU creation step, the groups have nowhere to land.
• Make sure you used -GroupScope Global (not Local or Universal). The filter above looks for the exact group names.
• help me troubleshoot my AD group creation

Bulk-create users with PowerShell

Instead of creating each user one at a time, you will use a PowerShell array and loop to provision all six users in one script. Each user gets a department, title, and security group membership assigned automatically.

• Bulk-create six domain users and assign them to their security groups by running this script:

# Define a shared password for all lab users
$password = ConvertTo-SecureString "P@ssw0rd2024" -AsPlainText -Force

# Define user details: 2 per department
$users = @(
    @{First="John"; Last="Smith"; Username="jsmith"; Dept="IT"; Title="Systems Administrator"; OU="OU=Users,OU=IT,DC=corp,DC=local"; Group="IT-Admins"},
    @{First="Sarah"; Last="Chen"; Username="schen"; Dept="IT"; Title="Network Engineer"; OU="OU=Users,OU=IT,DC=corp,DC=local"; Group="IT-Admins"},
    @{First="Mike"; Last="Johnson"; Username="mjohnson"; Dept="HR"; Title="HR Manager"; OU="OU=Users,OU=HR,DC=corp,DC=local"; Group="HR-Staff"},
    @{First="Lisa"; Last="Park"; Username="lpark"; Dept="HR"; Title="Recruiter"; OU="OU=Users,OU=HR,DC=corp,DC=local"; Group="HR-Staff"},
    @{First="David"; Last="Wilson"; Username="dwilson"; Dept="Finance"; Title="Financial Analyst"; OU="OU=Users,OU=Finance,DC=corp,DC=local"; Group="Finance-Team"},
    @{First="Emma"; Last="Davis"; Username="edavis"; Dept="Finance"; Title="Accountant"; OU="OU=Users,OU=Finance,DC=corp,DC=local"; Group="Finance-Team"}
)

# Loop through each user and create their account
foreach ($user in $users) {
    New-ADUser `
        -Name "$($user.First) $($user.Last)" `
        -GivenName $user.First `
        -Surname $user.Last `
        -SamAccountName $user.Username `
        -UserPrincipalName "$($user.Username)@corp.local" `
        -Path $user.OU `
        -Department $user.Dept `
        -Title $user.Title `
        -AccountPassword $password `
        -Enabled $true

    # Add the user to their department security group
    Add-ADGroupMember -Identity $user.Group -Members $user.Username
}

What does this script do?

• The $password variable stores a secure string that all lab users share. In production you would never do this, but for a lab it keeps things simple.
• The $users array holds a hashtable for each user with their name, username, department, title, target OU, and security group.
• The foreach loop calls New-ADUser to create the account and Add-ADGroupMember to place them in the correct security group.
• -SamAccountName sets the pre-Windows 2000 logon name (e.g., CORP\jsmith). -UserPrincipalName sets the modern logon format (e.g., jsmith@corp.local).

• Verify the users were created and placed in the correct OUs by running:

Get-ADUser -Filter * -SearchBase "DC=corp,DC=local" -Properties Department, MemberOf | Where-Object { $_.SamAccountName -in @("jsmith","schen","mjohnson","lpark","dwilson","edavis") } | Select-Object Name, SamAccountName, Department, DistinguishedName

You should see all six users listed with their departments and distinguished names confirming they are in the correct Users sub-OU for their department.

• Open Active Directory Users and Computers (ADUC) for a visual check. Press the Windows key, type dsa.msc, and press Enter.
• Expand corp.local in the left pane. You should see the IT, HR, and Finance OUs.
• Click into any department OU, then expand its Users sub-OU to confirm the user accounts and security group are present.

Users not appearing in ADUC?

• If the PowerShell script showed errors during creation, check that the OU paths in the $users array match the OUs you created. A single character difference (wrong case, extra space) will cause the user to fail silently.
• Make sure you ran the OU creation commands first. New-ADUser cannot place a user into an OU that does not exist.
• In ADUC, click View in the menu bar and enable Advanced Features to see all containers.
• help me figure out why my AD users are missing

✔️ Awesome, I've got everything!

Great. Double check you have all three department OUs, all three security groups, and all six users showing in ADUC.

ⓧ I'd like to double check the full code

Here is the complete set of PowerShell commands for this step combined into one script:

# === Step 3: Build the OU Structure and Create Users ===

# --- Create top-level Organizational Units ---
New-ADOrganizationalUnit -Name "IT" -Path "DC=corp,DC=local"
New-ADOrganizationalUnit -Name "HR" -Path "DC=corp,DC=local"
New-ADOrganizationalUnit -Name "Finance" -Path "DC=corp,DC=local"

# --- Create Users and Computers sub-OUs ---
New-ADOrganizationalUnit -Name "Users" -Path "OU=IT,DC=corp,DC=local"
New-ADOrganizationalUnit -Name "Computers" -Path "OU=IT,DC=corp,DC=local"

New-ADOrganizationalUnit -Name "Users" -Path "OU=HR,DC=corp,DC=local"
New-ADOrganizationalUnit -Name "Computers" -Path "OU=HR,DC=corp,DC=local"

New-ADOrganizationalUnit -Name "Users" -Path "OU=Finance,DC=corp,DC=local"
New-ADOrganizationalUnit -Name "Computers" -Path "OU=Finance,DC=corp,DC=local"

# --- Create security groups ---
New-ADGroup -Name "IT-Admins" -GroupScope Global -GroupCategory Security -Path "OU=IT,DC=corp,DC=local"
New-ADGroup -Name "HR-Staff" -GroupScope Global -GroupCategory Security -Path "OU=HR,DC=corp,DC=local"
New-ADGroup -Name "Finance-Team" -GroupScope Global -GroupCategory Security -Path "OU=Finance,DC=corp,DC=local"

# --- Bulk-create users ---
$password = ConvertTo-SecureString "P@ssw0rd2024" -AsPlainText -Force

$users = @(
    @{First="John"; Last="Smith"; Username="jsmith"; Dept="IT"; Title="Systems Administrator"; OU="OU=Users,OU=IT,DC=corp,DC=local"; Group="IT-Admins"},
    @{First="Sarah"; Last="Chen"; Username="schen"; Dept="IT"; Title="Network Engineer"; OU="OU=Users,OU=IT,DC=corp,DC=local"; Group="IT-Admins"},
    @{First="Mike"; Last="Johnson"; Username="mjohnson"; Dept="HR"; Title="HR Manager"; OU="OU=Users,OU=HR,DC=corp,DC=local"; Group="HR-Staff"},
    @{First="Lisa"; Last="Park"; Username="lpark"; Dept="HR"; Title="Recruiter"; OU="OU=Users,OU=HR,DC=corp,DC=local"; Group="HR-Staff"},
    @{First="David"; Last="Wilson"; Username="dwilson"; Dept="Finance"; Title="Financial Analyst"; OU="OU=Users,OU=Finance,DC=corp,DC=local"; Group="Finance-Team"},
    @{First="Emma"; Last="Davis"; Username="edavis"; Dept="Finance"; Title="Accountant"; OU="OU=Users,OU=Finance,DC=corp,DC=local"; Group="Finance-Team"}
)

foreach ($user in $users) {
    New-ADUser `
        -Name "$($user.First) $($user.Last)" `
        -GivenName $user.First `
        -Surname $user.Last `
        -SamAccountName $user.Username `
        -UserPrincipalName "$($user.Username)@corp.local" `
        -Path $user.OU `
        -Department $user.Dept `
        -Title $user.Title `
        -AccountPassword $password `
        -Enabled $true

    Add-ADGroupMember -Identity $user.Group -Members $user.Username
}

# --- Verify ---
Get-ADOrganizationalUnit -Filter * | Select-Object Name, DistinguishedName
Get-ADUser -Filter * -SearchBase "DC=corp,DC=local" -Properties Department | Where-Object { $_.SamAccountName -in @("jsmith","schen","mjohnson","lpark","dwilson","edavis") } | Select-Object Name, SamAccountName, Department, DistinguishedName

Your domain now has a structured directory with departments, security groups, and real user accounts. Next up, you will enforce security policies across this structure using Group Policy Objects.

Configure Group Policy Security Controls

Your domain now has departments, users, and groups. The next step is enforcing security rules across the organization automatically.

In any enterprise, security policies need to apply consistently without relying on individual users to configure their own machines. Group Policy Objects (GPOs) let you define rules once and push them to every computer and user in the domain.

In this step, get ready to:

• Create a Security Baseline GPO with password and lockout policies.
• Create a Workstation Lockdown GPO with screen lock and Command Prompt restrictions.
• Force a policy update and verify both GPOs are applied.

Create the Security Baseline GPO

Password policies and account lockout rules protect the domain from weak credentials and brute-force attacks. You will create a GPO called "Security Baseline" and link it to the domain root so it applies to every user.

• Open the Group Policy Management Console by clicking Start, typing Group Policy Management, and pressing Enter.
• In the left pane, expand Forest: corp.local, then Domains, then corp.local.
• Right-click Group Policy Objects and select New.
• Enter Security Baseline as the name and click OK.
• Right-click the corp.local domain node in the left pane and select Link an Existing GPO.
• Select Security Baseline from the list and click OK.

Now configure the password and lockout settings inside the GPO.

• Under Group Policy Objects, right-click Security Baseline and select Edit.
• In the Group Policy Management Editor, navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Password Policy.
• Double-click Minimum password length. Check Define this policy setting, set the value to 10 characters, and click OK.
• Double-click Password must meet complexity requirements. Check Define this policy setting, select Enabled, and click OK.
• Double-click Maximum password age. Check Define this policy setting, set the value to 90 days, and click OK.

• Now navigate to Account Policies > Account Lockout Policy (one level up from Password Policy, then into the sibling folder).
• Double-click Account lockout threshold. Set the value to 5 invalid logon attempts and click OK.
• A dialog may appear suggesting values for lockout duration and reset counter. Accept the suggested defaults and click OK.
• Close the Group Policy Management Editor window.

What is a Group Policy Object?

A GPO is a collection of settings that Windows applies to computers and users in a domain. When you link a GPO to the domain root, every computer and user in that domain receives those settings during the next policy refresh cycle.

Account policies (password and lockout) are special. They only take effect when the GPO is linked at the domain level, not at an OU level. This is why you linked Security Baseline to corp.local directly.

Don't see Account Policies in the editor?

Make sure you are navigating under Computer Configuration > Policies > Windows Settings > Security Settings. The Account Policies folder sits directly under Security Settings.

If you accidentally opened User Configuration instead of Computer Configuration, collapse it and expand the correct node.

Help me find Account Policies in the Group Policy Management Editor

Create the Workstation Lockdown GPO

The second GPO targets specific departments. You will enforce screen lock after 10 minutes of inactivity and block Command Prompt access for non-IT users by linking this GPO only to the Finance and HR OUs.

• Switch back to the Group Policy Management Console.
• Right-click Group Policy Objects and select New.
• Enter Workstation Lockdown as the name and click OK.
• In the left pane, expand corp.local and right-click the Finance OU.
• Select Link an Existing GPO, choose Workstation Lockdown, and click OK.
• Right-click the HR OU, select Link an Existing GPO, choose Workstation Lockdown, and click OK.

Now configure the screen lock and Command Prompt restriction.

• Under Group Policy Objects, right-click Workstation Lockdown and select Edit.
• Navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options.
• Double-click Interactive logon: Machine inactivity limit.
• Check Define this policy setting, enter 600 seconds (which equals 10 minutes), and click OK.

• Now navigate to User Configuration > Policies > Administrative Templates > System.
• Double-click Prevent access to the command prompt.
• Select Enabled and click OK.
• Close the Group Policy Management Editor window.

Why link Workstation Lockdown to OUs instead of the domain?

Unlike password policies, workstation restrictions should target specific groups. By linking only to Finance and HR, IT staff keep full access to the Command Prompt for troubleshooting.

The screen lock setting uses seconds as its unit. 600 seconds equals 10 minutes of inactivity before Windows automatically locks the workstation.

Can't find the inactivity limit setting?

Make sure you are in Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options. The setting is listed alphabetically as Interactive logon: Machine inactivity limit.

If you navigated to Account Policies by mistake, go one level up to Security Settings and then into Local Policies.

Help me locate the inactivity limit setting in Group Policy

Force a policy update and verify

Group Policy changes take effect on the next refresh cycle (every 90 minutes by default). You can force an immediate update.

• Open PowerShell as Administrator on DC01 and force a policy update by running this command:

gpupdate /force

• Wait for the output to confirm that both Computer Policy and User Policy updates completed successfully.
• Verify which GPOs are applied by running this command:

gpresult /r

• Scroll through the output and look under Applied Group Policy Objects in the Computer Settings section.
• Confirm that Security Baseline appears in the list.
• Confirm that Workstation Lockdown also appears (it shows here because DC01 is a member of corp.local, though the OU-linked settings will be most relevant on workstations in Finance and HR).

What does gpresult show?

The gpresult /r command displays the Resultant Set of Policy for the current computer and user. It lists every GPO that was applied, along with the site, domain, and OU from which each GPO was linked.

This is the quickest way to confirm your GPOs are active without waiting for a user to trigger a policy violation.

GPO not showing in the applied list?

Make sure you linked the GPO to the correct target. Open Group Policy Management Console and verify that Security Baseline shows as a link under corp.local and Workstation Lockdown shows under both the Finance and HR OUs.

If you created the GPO but forgot to link it, right-click the target OU or domain and select Link an Existing GPO.

Help me troubleshoot why my GPO is not appearing in gpresult

Your domain now enforces password strength, account lockout, screen lock, and Command Prompt restrictions through centrally managed Group Policy. Next up, you will join a Windows 11 workstation to the domain and prove the whole system works end-to-end.

Join a Windows 11 Workstation to the Domain

Your domain is configured with users, groups, and security policies. The real test is whether an actual workstation can join the domain, authenticate users, and receive those policies.

In this step, you will create a Windows 11 workstation VM, join it to your corp.local domain, and prove the entire Active Directory environment works end-to-end.

In this step, get ready to:

• Create a Windows 11 Enterprise VM named WS01 in VirtualBox.
• Configure networking and join WS01 to the corp.local domain.
• Log in as a domain user and verify Group Policy is applied.

Create the WS01 virtual machine

Every enterprise domain needs client workstations. You will build a second VM to simulate an employee's computer joining the corporate network.

• Switch to your host machine (outside the DC01 VM window).
• In VirtualBox Manager, click New to create a new virtual machine.
• Set the Name to WS01.
• Set Type to Microsoft Windows.
• Set Version to Windows 11 (64-bit).
• Allocate 4 GB of RAM (4096 MB).
• Create a virtual hard disk with 60 GB of space.
• Click Finish to create the VM.

• Right-click the WS01 VM and select Settings.
• Go to Storage, click the empty optical drive icon, then click the disk icon on the right and select Choose a disk file.
• Select the Windows 11 Enterprise Evaluation ISO you downloaded earlier.
• Go to Network and change Adapter 1 to Attached to: Internal Network. Set the network name to match DC01's Internal Network (e.g., intnet).
• Click OK to save settings, then double-click WS01 to start the VM.

Why Internal Network?

VirtualBox's Internal Network mode places both DC01 and WS01 on the same isolated virtual network. This lets WS01 reach DC01's DNS and Active Directory services, just like a real office network.

• The Windows 11 installer will start. Select your language and click Next, then Install now.
• On the product key screen, click I don't have a product key to use the 90-day evaluation.
• Select Windows 11 Enterprise from the edition list and continue.
• Accept the license terms, choose Custom: Install Windows only, select the virtual disk, and let the installation proceed.
• The VM will restart several times during installation. Wait for the Out-of-Box Experience (OOBE) setup wizard to appear.

How do I create a local account during OOBE?

Windows 11 Enterprise edition allows you to create a local account during initial setup. When prompted, click Sign-in options and then select Offline account. This bypasses the Microsoft account requirement.

If you do not see this option, select the setup for work or school path, then choose the domain join option. This also creates a local account without actually joining a domain yet.

• Complete the OOBE wizard with a local account. Set a username (e.g., LocalAdmin) and a password.
• Once you reach the Windows desktop, WS01 is ready for domain configuration.

VM won't boot or shows a black screen?

Make sure you attached the ISO to the optical drive before starting. If you see a UEFI shell or black screen, power off the VM, re-check the Storage settings, and start again.

help me troubleshoot my Windows 11 VM not booting in VirtualBox

Configure networking and join the domain

For WS01 to find your Domain Controller, it must use DC01 as its DNS server. Without this, the domain join will fail because WS01 cannot locate corp.local.

• Inside WS01, right-click the Start button and select Windows Terminal (Admin) or PowerShell (Admin).
• Set a static IP address and point DNS to DC01 by running the following commands:

# Find the name of your network adapter
Get-NetAdapter

# Set a static IP on the same subnet as DC01
New-NetIPAddress -InterfaceAlias "Ethernet" -IPAddress 10.0.0.2 -PrefixLength 24 -DefaultGateway 10.0.0.1

# Point DNS to DC01's IP address
Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses [[DC01_IP="DC01's IP address (e.g. 10.0.0.1)"]]

What do these commands do?

• Get-NetAdapter shows the name of the network adapter. It is usually Ethernet in a VM. If yours is different, replace Ethernet in the following commands with your adapter's name.
• New-NetIPAddress assigns WS01 a static IP on the same subnet as DC01 so the two VMs can communicate.
• Set-DnsClientServerAddress tells WS01 to use DC01 for all DNS lookups. This is critical because Active Directory relies on DNS to locate domain controllers.

Match DC01's network

The IP address you use for DC01 here must match the static IP you configured on DC01 in Step 2. If you used a different subnet (e.g., 192.168.1.x), adjust the commands accordingly.

• Verify connectivity to DC01 by running:

# Test that WS01 can reach DC01
ping [[DC01_IP="DC01's IP address (e.g. 10.0.0.1)"]]

• You should see reply packets. If you see "Request timed out", double-check that both VMs are on the same Internal Network name and that DC01's Windows Firewall allows ICMP.
• Now join WS01 to the domain by running:

# Join this computer to the corp.local domain
Add-Computer -DomainName "corp.local" -Credential (Get-Credential) -Restart

What happens when you run this?

PowerShell will prompt you for credentials. Enter CORP\Administrator as the username and the Administrator password you set on DC01. After successfully joining, WS01 restarts automatically.

Why PowerShell instead of Settings?

Recent Windows 11 updates have moved or removed the domain join option from the Settings GUI. The PowerShell command Add-Computer is the most reliable method and is what IT professionals use in production environments.

Domain join failed?

• If you see an error about the domain not being found, confirm that DNS on WS01 points to DC01's IP. Run nslookup corp.local to verify DNS resolution.
• If you get an access denied error, make sure you are entering CORP\Administrator (with the domain prefix) and the correct password.
• If the ping to DC01 fails, verify both VMs use the same Internal Network name in their VirtualBox network settings.

help me troubleshoot my Windows 11 domain join failure

Verify domain login and Group Policy

The ultimate proof that your Active Directory environment works is logging in as a domain user and confirming that Group Policy objects are enforced on the workstation.

• After WS01 restarts, you will see the Windows login screen.
• Click Other user in the bottom-left corner of the login screen.
• Log in as one of the domain users you created in Step 3. For example, enter CORP\jsmith as the username and the password you set for that user.

What does CORP\jsmith mean?

The CORP\ prefix tells Windows to authenticate against the corp.local domain rather than the local machine. CORP is the NetBIOS name you set when creating the domain.

• Once logged in, right-click the Start button and open Windows Terminal or PowerShell.
• Verify that GPOs are applied by running:

# Check which Group Policies are applied to this computer and user
gpresult /r

What should I see?

Scroll through the output and look for the Applied Group Policy Objects section. You should see both Security Baseline and Workstation Lockdown listed. This confirms that your Domain Controller is successfully pushing policies to the workstation.

If the user you logged in as belongs to the Finance or HR OU, the Workstation Lockdown GPO will appear. If the user is in the IT OU, only Security Baseline will appear (since Workstation Lockdown is linked to Finance and HR OUs only).

• Confirm that Security Baseline appears in the applied GPOs list.
• Confirm that Workstation Lockdown appears in the applied GPOs list (for Finance or HR users).

This proves your AD environment is fully functional end-to-end. Your Domain Controller is serving DNS, authenticating users, and enforcing group policy across the network.

GPOs not showing up?

• Run gpupdate /force to manually pull the latest policies, then run gpresult /r again.
• Make sure the user account's computer object is in the correct OU. If the WS01 computer object landed in the default Computers container instead of a department OU, the Workstation Lockdown GPO (linked to Finance/HR OUs) will not apply to the computer.
• Verify the GPO links are correct on DC01 by opening Group Policy Management and checking each GPO's linked location.

help me troubleshoot Group Policy not applying to my domain-joined workstation

Secret mission

Simulate Employee Offboarding

When an employee leaves a company, IT must secure their account within minutes. A delayed response means the ex-employee could still access email, files, and internal systems. In this secret mission, you will practice the exact offboarding workflow that help desk teams perform daily.

Clean Up Your Resources

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely. This project runs entirely on your local machine using free evaluation licenses, so there are no ongoing cloud costs.

Resources you used:

• DC01 VM (Windows Server 2022 Domain Controller, approximately 60 GB disk).
• WS01 VM (Windows 11 Enterprise workstation, approximately 60 GB disk).
• VirtualBox 7.2.8 installation on your host PC.
• Downloaded ISO files (Windows Server 2022 and Windows 11 Enterprise).

Keep everything running

No action needed. Choose this if you are still actively building or want to continue practising with your Active Directory lab.

• Both VMs consume no CPU or RAM when powered off. They only use disk space (approximately 120 GB total).
• VirtualBox itself uses minimal disk space and does not run background processes when no VMs are active.
• The ISO files can be kept for future lab rebuilds or deleted to reclaim approximately 10 GB.

Pause - I'll come back to this later

Shut down both VMs cleanly to free up memory while keeping all your files intact for next time.

• Inside WS01, click the Start menu, then click the power icon, then click Shut down.
• Inside DC01, click the Start menu, then click the power icon, then click Shut down.
• Close VirtualBox Manager on your host PC.
• Your VMs will be exactly as you left them the next time you open VirtualBox and start them.

Delete - I don't want to use this again

Remove all project resources and reclaim approximately 120 GB of disk space.

• In VirtualBox Manager, right-click the DC01 VM and select Remove.
• In the confirmation dialog, click Delete all files to remove the virtual disk and all associated data.
• Right-click the WS01 VM and select Remove, then click Delete all files.
• To uninstall VirtualBox, open Settings on your host PC, select Apps, then Apps & features. Find Oracle VM VirtualBox in the list, click it, and select Uninstall. Restart your PC when prompted.
• Delete the ISO files from your Downloads folder (or wherever you saved them) to reclaim an additional 10 GB.

Nice Work!

Nice Work!

You just built a fully functional Active Directory domain from scratch on your own machine. This is the same identity infrastructure that powers authentication and access control in enterprise Windows environments worldwide.

You've learned how to:

• Deploy a Windows Server 2022 Domain Controller running Active Directory Domain Services and DNS for the domain corp.local.
• Build an enterprise-style Organizational Unit hierarchy and bulk-provision users and security groups using PowerShell.
• Configure Group Policy Objects enforcing password requirements, account lockout, and workstation lockdown, then verify end-to-end authentication by joining a Windows 11 workstation to the domain.
• Secret Mission: Performed a complete employee offboarding workflow including account disable, OU move, and group membership removal.

Ready to quiz yourself?