Build a Windows Server Home Lab

Set up a Windows Server 2022 domain controller with Active Directory in a VM.

Introduction

30 Second Summary

Most companies use Active Directory to manage employee accounts, passwords, and computer access. When you call IT to reset your password or get access to a shared folder, the technician is working in Active Directory behind the scenes.

In this project, you will build your own Active Directory domain controller inside a virtual machine. You will create users, groups, and security policies using the same tools that IT administrators use every day in real enterprise environments.

What You'll Build

A fully functional Active Directory Domain Services environment running on Windows Server 2022 in VirtualBox, simulating a small company where you are the system administrator.

By the end of this project, you'll have:

A Windows Server 2022 VM running as a domain controller for your own "yourlab.local" domain.
Organizational Units, user accounts, and security groups structured by department and managed through PowerShell.
Group Policy Objects enforcing password and audit security policies across your domain.
Secret Mission: Automate user provisioning by writing a PowerShell script that bulk-creates accounts from a CSV file.

Are there any prerequisites?

You need VirtualBox installed on your Windows PC and the Windows Server 2022 Evaluation ISO downloaded from the Microsoft Evaluation Center (4.7 GB). Your system should have at least 8 GB of RAM and 50 GB of free disk space.

Set Up Your Windows Server Virtual Machine

Every Active Directory environment starts with a server. In real IT environments, this would be a physical machine in a data center. For your home lab, you will create a virtual machine that simulates that server entirely on your own computer.

In this step, you will create a Windows Server 2022 virtual machine inside VirtualBox, install the operating system, and configure the network settings that Active Directory needs to function.

In this step, get ready to:

Create a virtual machine with the correct hardware settings for a domain controller.
Install Windows Server 2022 Standard (Desktop Experience) Evaluation edition.
Configure a static IP address and rename the computer to DC1.

Create a new virtual machine in VirtualBox

A domain controller needs dedicated resources to run reliably. You will allocate 4 GB of RAM, 2 CPU cores, and 50 GB of storage to give it enough room to operate.

In the VirtualBox Manager window, click New in the toolbar to start the Create Virtual Machine workflow.
In the Name field, type DC1.
In the ISO Image field, click the dropdown and browse to select your Windows Server 2022 ISO file that you downloaded earlier.
VirtualBox may auto-detect the OS type. If it does not, set Type to Microsoft Windows and Version to Windows 2022 (64-bit).
Check the box labelled Skip Unattended Installation. You will install the OS manually in the next substep.
Click Next to move to the hardware configuration page.
Set Base Memory to 4096 MB.
Set Processors to 2.
Click Next to move to the virtual hard disk page.
Select Create a Virtual Hard Disk Now and set the size to 50 GB. Leave it as dynamically allocated.
Click Next, review the summary, then click Finish.

Your new DC1 virtual machine now appears in the VirtualBox Manager machine list on the left side.

Why these hardware settings?

Windows Server 2022 requires a minimum of 2 GB RAM, but 4 GB gives Active Directory room to run smoothly alongside DNS and Group Policy services. The 50 GB disk exceeds the 32 GB minimum to accommodate future logs and snapshots.

Don't see Windows 2022 (64-bit) in the Version dropdown?

Make sure you selected Microsoft Windows as the Type first. The Version dropdown filters based on the Type you selected. If you attached the ISO and VirtualBox detected it, the fields may already be filled in correctly.

Help me troubleshoot my VirtualBox VM creation settings for Windows Server 2022.

Install Windows Server 2022

With the VM created, you will now boot it from the ISO and walk through the Windows Server installer. This process takes about 15-20 minutes, with most of that time being the automated file-copying phase.

Select DC1 in the machine list and click Start in the toolbar to boot the VM.
The VM window opens and boots from the ISO. When you see the language and keyboard screen, leave the defaults and click Next.
Click Install now.
On the product key screen, click I don't have a product key at the bottom of the window. This starts a free 180-day evaluation.
On the edition selection screen, select Windows Server 2022 Standard Evaluation (Desktop Experience) and click Next.
Accept the license terms and click Next.
Select Custom: Install Microsoft Server Operating System only (advanced).
Select the 50 GB virtual hard disk (it appears as unallocated space) and click Next.
Windows begins installing. This takes 15-20 minutes. The VM will reboot several times automatically.
After the final reboot, Windows prompts you to set the Administrator password. Enter a strong password you will remember and click Finish.

Why Desktop Experience?

Windows Server offers two install modes: Server Core (command-line only) and Desktop Experience (full GUI). You need Desktop Experience for this lab because Server Manager and the Active Directory management consoles require a graphical interface.

You cannot switch between these modes after installation without a clean reinstall, so selecting the correct one now is important.

After login, Server Manager opens automatically. This confirms your installation was successful.

VM boots to a black screen or hangs?

If the VM does not boot from the ISO, go to Settings > Storage in VirtualBox and confirm the ISO is attached under the optical drive. Also ensure your host PC has virtualization (VT-x) enabled in its BIOS settings.

Help me troubleshoot my Windows Server 2022 VM that won't boot in VirtualBox.

Configure the static IP address and rename the computer

Active Directory relies on a predictable network address to function as a DNS server. A static IP ensures other machines can always find your domain controller at the same address.

In Server Manager, click Local Server in the left sidebar.
In the Properties panel, find the row labelled Ethernet (it may show an IPv4 address assigned by DHCP). Click the link next to it to open the Network Connections window.
Right-click your Ethernet adapter and select Properties.
Double-click Internet Protocol Version 4 (TCP/IPv4).
Select Use the following IP address and enter these values:

IP address: 10.0.2.15.
Subnet mask: 255.255.255.0.
Default gateway: 10.0.2.2.
Preferred DNS server: 127.0.0.1.

Click OK to close the IPv4 properties, then OK again to close the adapter properties.
Close the Network Connections window.

Why set DNS to 127.0.0.1?

After you promote this server to a domain controller in the next step, it will run its own DNS service. Setting the DNS to 127.0.0.1 (localhost) tells the server to use itself for name resolution. This is required for Active Directory to function correctly.

The gateway 10.0.2.2 is the default gateway VirtualBox uses in NAT mode, which gives your VM internet access for updates.

Now rename the computer to DC1 so it has a recognizable identity on the network.

In Server Manager, click Local Server in the left sidebar.
Find the Computer name row in the Properties panel and click the current name (it will be a random string like WIN-XXXXXXX).
In the System Properties dialog, click Change.
In the Computer name field, replace the existing name with DC1.
Click OK. Windows prompts you to restart. Click Restart Now.

After the restart, log back in as Administrator. Open Server Manager and click Local Server. Confirm the Computer name field now shows DC1.

Computer name still shows the old name?

The rename only takes effect after a restart. If you dismissed the restart prompt, restart manually by clicking Start > Power > Restart. After logging back in, the name should be updated.

Help me fix my Windows Server computer rename that isn't taking effect.

Your Windows Server is ready to go. Next up, you will install Active Directory Domain Services and promote this server to a domain controller for your lab environment.

Install Active Directory and Promote to Domain Controller

Your Windows Server VM is ready with a static IP and the name DC1. Now it is time to turn this plain server into the brain of your network.

Active Directory Domain Services is the role that transforms a regular Windows Server into a domain controller. A domain controller authenticates users, enforces security policies, and manages every computer joined to the domain. In this step, you will install the AD DS role and promote DC1 to be the first domain controller in a brand new forest called yourlab.local.

In this step, get ready to:

Install the Active Directory Domain Services role.
Promote DC1 to the first domain controller in a new forest.
Verify the domain and DNS zones are operational.

Install the Active Directory Domain Services role

The AD DS role is what gives Windows Server the ability to create and manage a domain. You install it through Server Manager's Add Roles and Features wizard.

In Server Manager, click Manage in the top menu bar.
Click Add Roles and Features.
On the Installation Type page, select Role-based or feature-based installation and click Next.
On the Server Selection page, confirm your server (DC1) is selected and click Next.
On the Server Roles page, check the box for Active Directory Domain Services.
A popup appears asking to add required features. Click Add Features.
Click Next through the remaining pages (Features, AD DS).
On the Confirmation page, click Install.

What is Active Directory Domain Services?

AD DS is the directory service that stores information about every object on your network. Objects include user accounts, computers, printers, and security groups.

When a user logs in, the domain controller checks their credentials against the directory. This centralised authentication is what makes enterprise networks manageable.

Installation takes a few minutes

The progress bar may take 2-5 minutes to complete. Do not close Server Manager or restart the VM while the installation is running.

Once the installation finishes, a blue link reading Close appears at the bottom of the wizard. Click it to dismiss the wizard.

Promote the server to a domain controller

Installing the AD DS role only adds the software. You still need to promote the server so it actually becomes a domain controller serving a domain.

In Server Manager, look for the yellow warning flag icon with a triangle near the top-right of the toolbar.
Click the flag icon.
Click the blue link that says Promote this server to a domain controller.

What is the yellow flag?

After you install a role, Server Manager shows a notification flag with a yellow triangle exclamation mark. This indicates post-deployment configuration is needed. For AD DS, the required post-deployment step is promoting the server to a domain controller.

The Active Directory Domain Services Configuration Wizard opens. Walk through it with these settings:

On the Deployment Configuration page, select Add a new forest.
In the Root domain name field, type yourlab.local.
Click Next.
On the Domain Controller Options page, set Forest functional level to Windows Server 2016.
Set Domain functional level to Windows Server 2016.
Enter and confirm a DSRM password. Choose something you will remember.
Click Next.
On the DNS Options page, ignore the delegation warning and click Next.
On the Additional Options page, wait for the NetBIOS name to populate as YOURLAB and click Next.
Accept defaults on the Paths page and click Next.
On the Review Options page, click Next.
On the Prerequisites Check page, click Install.

What is the DSRM password?

DSRM stands for Directory Services Restore Mode. It is a special boot mode used to repair or recover the Active Directory database if it becomes corrupted.

You will rarely need it in a lab environment, but it is required during promotion. Store this password somewhere safe.

Why Windows Server 2016 functional level?

The functional level determines which AD features are available. Windows Server 2016 is the most common level in production environments today. Setting it here mirrors what you will see in real enterprise networks.

The server restarts automatically after promotion completes. This restart may take several minutes as Windows configures the domain for the first time.

Server seems stuck on restarting?

The first restart after promotion can take 5-10 minutes. Windows is building the AD database, creating DNS zones, and configuring services. Let it finish without forcing a shutdown.

If the VM shows a black screen for more than 15 minutes, press any key or move the mouse to wake the display. Ask for help if your server won't come back online after restarting.

Verify the domain is operational

After the restart, you need to confirm that AD DS and DNS are both running correctly.

On the login screen, notice the domain name has changed. Log in as YOURLAB\Administrator using the same Administrator password you set during Windows installation.
Wait for Server Manager to open automatically.
Click Tools in the top menu bar of Server Manager.
Click Active Directory Users and Computers.
In the left panel, confirm you see yourlab.local with folders underneath it including Computers, Domain Controllers, and Users.
Close Active Directory Users and Computers.
Return to Server Manager. Click Tools again.
Click DNS to open DNS Manager.
In the left panel, expand DC1 > Forward Lookup Zones.
Confirm you see a zone named yourlab.local.

What should I see?

Active Directory Users and Computers should show yourlab.local as the top-level domain with several default containers. These containers (Computers, Domain Controllers, Users) are created automatically when a new domain is born.

DNS Manager should show a forward lookup zone for yourlab.local. This zone was created during promotion so that computers on the network can find the domain controller by name.

Don't see yourlab.local in Active Directory Users and Computers?

Make sure you are logged in as YOURLAB\Administrator and not the local Administrator account. After promotion, the domain login is required to access AD tools.

If Server Manager shows errors about AD DS or DNS services, give the server another minute to finish starting all services after the reboot. Help me troubleshoot why my domain isn't showing up.

DC1 is now the authoritative domain controller for yourlab.local. Next up, you will populate this domain with an organisational structure of departments, user accounts, and security groups.

Create Organizational Units, Users, and Groups

Your domain controller is up and running. Now it is time to populate it with the objects that make Active Directory useful: departments, people, and permissions.

In a real company, the IT team organizes the directory into Organizational Units (OUs) that mirror departments. Each OU holds the user accounts and groups for that team. This structure lets administrators delegate control and apply policies at the department level.

In this step, get ready to:

Create three Organizational Units representing company departments.
Create user accounts with PowerShell and place them in the correct OUs.
Create a security group and assign a member to it.

Create three Organizational Units

Organizational Units are containers that group related objects together. You will create one OU for each department in your simulated company: IT, Sales, and HR.

In Server Manager, click Tools in the top menu bar.
Select Active Directory Users and Computers from the dropdown.
In the left pane, right-click yourlab.local.
Point to New, then click Organizational Unit.
Type IT in the Name field and click OK.
Repeat the process: right-click yourlab.local again, select New > Organizational Unit, and create an OU named Sales.
Repeat one more time to create an OU named HR.

You should now see three new OUs listed under yourlab.local in the left pane: IT, Sales, and HR.

What is an Organizational Unit?

An OU is a container inside Active Directory that mirrors your company's structure. Think of it like a folder on a file system, but for user accounts, computers, and groups.

The real power of OUs is delegation and policy. You can apply different security policies to each OU and give specific admins control over only their department's objects.

Don't see the new OUs?

Make sure you right-clicked the domain name yourlab.local itself, not one of the default containers like Users or Computers.

Try pressing F5 or clicking Action > Refresh to update the view.

Help me troubleshoot missing OUs in Active Directory Users and Computers.

Create user accounts with PowerShell

Now you will add users to each department. PowerShell lets you create user accounts with precise control over every attribute, which is faster and more repeatable than clicking through the GUI.

Open PowerShell as Administrator by right-clicking the Start menu and selecting Windows PowerShell (Admin).

Create your first user, Alice Johnson in the IT department, by running this command:

# Create a user in the IT Organizational Unit
New-ADUser -Name "Alice Johnson" -GivenName "Alice" -Surname "Johnson" -SamAccountName "ajohnson" -UserPrincipalName "ajohnson@yourlab.local" -Path "OU=IT,DC=yourlab,DC=local" -AccountPassword (ConvertTo-SecureString "P@ssw0rd123" -AsPlainText -Force) -Enabled $true

What does this command do?

-Name sets the display name that appears in Active Directory Users and Computers.
-SamAccountName is the short login name (what appears before the @ sign).
-UserPrincipalName is the full login in email format (ajohnson@yourlab.local).
-Path places the user inside the IT OU using its distinguished name.
-AccountPassword converts a plain text string into the secure format Windows requires.
-Enabled $true activates the account immediately so the user can log in.

Create a user in the Sales OU by running this command:

# Create a user in the Sales Organizational Unit
New-ADUser -Name "Bob Smith" -GivenName "Bob" -Surname "Smith" -SamAccountName "bsmith" -UserPrincipalName "bsmith@yourlab.local" -Path "OU=Sales,DC=yourlab,DC=local" -AccountPassword (ConvertTo-SecureString "P@ssw0rd123" -AsPlainText -Force) -Enabled $true

Create a user in the HR OU by running this command:

# Create a user in the HR Organizational Unit
New-ADUser -Name "Carol White" -GivenName "Carol" -Surname "White" -SamAccountName "cwhite" -UserPrincipalName "cwhite@yourlab.local" -Path "OU=HR,DC=yourlab,DC=local" -AccountPassword (ConvertTo-SecureString "P@ssw0rd123" -AsPlainText -Force) -Enabled $true

Why the same password for all users?

In a real company, you would generate unique passwords and force users to change them at first login. For this lab, a shared initial password keeps things simple so you can focus on the AD structure.

The password P@ssw0rd123 meets Windows Server complexity requirements: uppercase, lowercase, number, and special character.

Verify your users were created by running this command:

# List all users in the domain
Get-ADUser -Filter * -SearchBase "DC=yourlab,DC=local" | Select-Object Name, SamAccountName

You should see Alice Johnson, Bob Smith, and Carol White in the output alongside the default Administrator and Guest accounts.

Command returns an error?

If you see a message about the term not being recognized, make sure you are running PowerShell as Administrator on the domain controller. The ActiveDirectory module loads automatically on a DC.

If you see an error about the path not being found, double-check the OU names match exactly: OU=IT,DC=yourlab,DC=local. The path is case-sensitive for the OU name you created.

Help me fix a PowerShell error when creating AD users.

Create a security group and add a member

Security groups control access to resources. Instead of assigning permissions to individual users, you assign them to a group. When someone joins or leaves the team, you just update group membership.

Create the IT-Admins security group in the IT OU by running this command:

# Create a Global security group in the IT OU
New-ADGroup -Name "IT-Admins" -GroupScope Global -GroupCategory Security -Path "OU=IT,DC=yourlab,DC=local"

What does this command do?

-GroupScope Global means members can come from the same domain and the group can be used in any domain in the forest.
-GroupCategory Security means this group can be assigned permissions on resources (unlike Distribution groups, which are for email only).
-Path places the group inside the IT OU to keep things organized.

Add Alice Johnson to the IT-Admins group by running this command:

# Add the user ajohnson to the IT-Admins group
Add-ADGroupMember -Identity "IT-Admins" -Members "ajohnson"

Confirm the group membership by running this command:

# Verify who is in the IT-Admins group
Get-ADGroupMember -Identity "IT-Admins"

You should see ajohnson listed as a member of the IT-Admins group.

Group membership not showing?

Make sure you typed the SamAccountName exactly as ajohnson (all lowercase). If the user was not found, run Get-ADUser -Identity "ajohnson" to confirm the account exists.

Help me troubleshoot AD group membership issues.

Your directory now has a realistic department structure with users and permissions. Next up, you will enforce security policies across these OUs using Group Policy.

Configure Group Policy

Your domain is taking shape with departments, employees, and security groups all in place.

In a real enterprise, system administrators don't configure security settings on every machine individually. They use Group Policy Objects to push rules across the entire organization from a single console. In this step, you'll create two GPOs that enforce password requirements and enable security auditing.

In this step, get ready to:

Create a password policy GPO for the IT department.
Create a security baseline GPO for the entire domain.
Verify your GPOs are applied using PowerShell.

Open Group Policy Management and create the IT Password Policy

Group Policy Management is the console where you create, link, and edit GPOs. You'll create a GPO specifically for the IT department's password requirements.

In Server Manager, click Tools in the top menu bar.
Select Group Policy Management.
In the left pane, expand Forest: yourlab.local, then Domains, then yourlab.local.
Right-click the IT OU.
Select Create a GPO in this domain, and Link it here....
Type IT Password Policy in the Name field.
Click OK.
Right-click the new IT Password Policy GPO (now visible under the IT OU).
Select Edit.

What is a Group Policy Object?

A GPO is a collection of settings that Windows applies to users and computers in your domain. By linking a GPO to a specific OU, those settings only affect the objects inside that OU.

In this case, the IT Password Policy will only apply to user and computer accounts you place in the IT OU.

Configure the password policy settings

The Group Policy Management Editor is now open. You'll navigate to the password policy section and set three requirements that match common enterprise standards.

In the left pane of the Group Policy Management Editor, navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Password Policy.
Double-click Minimum password length in the right pane.
Check Define this policy setting.
Set the value to 10 characters and click OK.
Double-click Password must meet complexity requirements.
Check Define this policy setting, set it to Enabled, and click OK.
Double-click Maximum password age.
Check Define this policy setting.
Set the value to 90 days and click OK.
Close the Group Policy Management Editor window.

Why these specific password settings?

A minimum length of 10 characters, complexity requirements, and a 90-day maximum age are standard enterprise settings. These force users to create strong passwords and change them regularly.

In job interviews, you can reference these exact values and explain why they prevent brute-force attacks and credential reuse.

Create the Security Baseline GPO

Your second GPO will apply to the entire domain, not just one department. Security auditing tracks who logs in and when, which is a baseline expectation for any enterprise network.

Switch back to the Group Policy Management console.
Right-click yourlab.local (the domain root, not an OU).
Select Create a GPO in this domain, and Link it here....
Type Security Baseline in the Name field and click OK.
Right-click the new Security Baseline GPO and select Edit.
In the Group Policy Management Editor, navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Audit Policy.
Double-click Audit account logon events in the right pane.
Check Define these policy settings.
Check both Success and Failure.
Click OK.
Close the Group Policy Management Editor.

Why audit logon events?

Auditing account logon events records every successful and failed login attempt across the domain. This is one of the first security baselines employers expect administrators to configure.

When a security incident occurs, these logs are what investigators review to determine who accessed what and when.

Now verify that your GPOs exist and that the domain-level policy is being applied.

Open Windows PowerShell as Administrator by right-clicking the Start button and selecting Windows PowerShell (Admin).
Force an immediate policy refresh by running this command:

gpupdate /force

After the update completes, verify applied policies by running:

gpresult /r

In the output, look under Applied Group Policy Objects in the COMPUTER SETTINGS section. You should see Security Baseline listed because it is linked to the domain root and applies to all computers.

Confirm both GPOs exist in the domain by running:

Get-GPO -All | Select-Object DisplayName, GpoStatus

You should see both IT Password Policy and Security Baseline in the output with a status of AllSettingsEnabled.

Why does IT Password Policy not show in gpresult?

The gpresult /r command shows policies applied to the current computer and user. Your domain controller sits in the Domain Controllers OU, not the IT OU.

The IT Password Policy only applies to objects inside the IT OU. That is exactly how scoping works. Domain-wide policies like Security Baseline apply everywhere, while OU-linked policies target specific departments.

GPOs not appearing in the output?

Make sure you ran gpupdate /force before running gpresult /r. Group Policy changes do not apply instantly.

If Get-GPO -All returns an error, make sure PowerShell is running as Administrator. The GroupPolicy module requires elevated privileges.

Help me troubleshoot why my GPO isn't appearing.

Your domain now enforces real security policies. Next, you'll practice the diagnostic and troubleshooting commands that help desk technicians use every day on the job.

Run Network Diagnostics and AD Troubleshooting

Your Group Policy Objects are now enforcing security standards across the domain. The next skill every help desk technician needs is the ability to diagnose network issues and troubleshoot user account problems quickly.

In this step, you will practice the exact PowerShell commands that IT professionals use on a daily basis. These include network diagnostics for verifying connectivity and Active Directory commands for managing user accounts.

In this step, get ready to:

Run network diagnostic commands to verify connectivity and DNS.
Query Active Directory to look up user details and account status.
Simulate common help desk tasks like disabling accounts and resetting passwords.

Run network diagnostic commands

When a user reports they cannot connect to a shared drive or log into their workstation, the first thing you check is network connectivity. These three commands help you verify the server's network configuration, DNS resolution, and domain controller reachability.

In your PowerShell window, check the full network configuration by running:

ipconfig /all

Verify that IPv4 Address shows 10.0.2.15 and DNS Servers shows 127.0.0.1.
Test DNS resolution for your domain by running:

nslookup yourlab.local

Confirm the output shows your server's IP address (10.0.2.15) resolving for yourlab.local.
Test LDAP connectivity to the domain controller by running:

Test-NetConnection -ComputerName DC1 -Port 389

Confirm the output shows TcpTestSucceeded : True.

What do these commands check?

ipconfig /all displays every network adapter's configuration including IP address, subnet mask, gateway, and DNS servers.
nslookup yourlab.local queries DNS to confirm your domain name resolves to an IP address. If this fails, machines cannot find the domain controller.
Test-NetConnection on port 389 verifies that LDAP (Lightweight Directory Access Protocol) is reachable. LDAP is how machines communicate with Active Directory.

nslookup returning an error?

If nslookup cannot resolve yourlab.local, your DNS server setting may have changed.

Confirm your DNS is set to 127.0.0.1 in your network adapter properties (Server Manager > Local Server > Ethernet adapter). The domain controller must use itself as its DNS server.

Still stuck? Help me fix DNS resolution on my domain controller

Query Active Directory with PowerShell

Help desk technicians frequently need to look up user account details, check if accounts are locked, and unlock them. These are the commands you will use for those tasks.

Look up a user's full account details by running:

Get-ADUser -Identity "ajohnson" -Properties *

You should see a long list of properties including GivenName, Surname, Enabled, and DistinguishedName.
Unlock a locked account by running:

Unlock-ADAccount -Identity "ajohnson"

This command produces no output if successful. In a real workplace, you would run this when a user calls saying they are locked out after too many failed password attempts.
Search for all locked accounts in the domain by running:

Search-ADAccount -LockedOut

Since no accounts are actually locked in your lab, this returns no results. In production, it would list every locked account in the domain.

When would I use these commands?

These three commands cover the most common help desk call: a user who cannot log in.

First, you look up the account with Get-ADUser to see if it is disabled or expired. If the account is locked, you run Unlock-ADAccount. If you need to find all locked accounts at once (during a Monday morning rush), you use Search-ADAccount -LockedOut.

Simulate a help desk troubleshooting scenario

Now you will walk through the exact sequence of actions a help desk technician performs when an employee leaves temporarily and then returns. You will disable an account, re-enable it, and reset its password.

Disable the user account to simulate an employee going on extended leave:

Disable-ADAccount -Identity "ajohnson"

Verify the account is disabled by running:

Get-ADUser -Identity "ajohnson" | Select-Object Name, Enabled

The Enabled field should show False.
Re-enable the account to simulate the employee returning:

Enable-ADAccount -Identity "ajohnson"

Reset the user's password (a common request when someone returns and forgets their old password):

Set-ADAccountPassword -Identity "ajohnson" -Reset -NewPassword (ConvertTo-SecureString "NewP@ss456" -AsPlainText -Force)

Confirm the account is enabled and ready for use:

Get-ADUser -Identity "ajohnson" | Select-Object Name, Enabled

The Enabled field should now show True.

What does this sequence prove to employers?

Disabling accounts (instead of deleting them) preserves the user's group memberships and permissions. When the employee returns, you re-enable and reset the password instead of recreating everything from scratch.

This is standard practice in enterprise environments. Interviewers often ask how you would handle an employee leaving and returning. Now you can describe the exact commands.

Password reset failing?

If Set-ADAccountPassword returns an error about password complexity, your new password does not meet the policy requirements.

The password must contain uppercase, lowercase, a number, and a special character. The password NewP@ss456 meets these requirements. Make sure you typed it exactly as shown.

Need more help? Why is my Set-ADAccountPassword command failing?

Secret mission

Automate User Provisioning with PowerShell

You've created users one at a time. But what happens when your company hires 50 new employees in a single week? In this secret mission, you'll write a PowerShell script that bulk-creates users from a CSV file, proving you can automate repetitive tasks that separate junior sysadmins from basic help desk applicants.

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely. This project runs entirely locally in a VirtualBox virtual machine, so there are no ongoing cloud costs.

Resources you used:

VirtualBox VM DC1 (Windows Server 2022 Evaluation, ~50 GB virtual hard disk).
Active Directory domain yourlab.local with OUs, users, groups, and GPOs (all stored inside the VM).
PowerShell scripts and CSV files on the VM (C:\CreateUsers.ps1, C:\NewUsers.csv).
Windows Server 2022 Evaluation ISO file on your host machine (~4.7 GB).

Keep everything running

No action needed. Choose this if you plan to keep practicing Active Directory administration, adding more users, or experimenting with additional Group Policy settings.

Your VM will remain in VirtualBox and you can start it any time.
The Windows Server 2022 Evaluation license is valid for 180 days from first activation.
The VM's virtual hard disk uses up to 50 GB on your host machine while it exists.
The Windows Server 2022 ISO (~4.7 GB) will remain on your host wherever you downloaded it.

Pause - I'll come back to this later

Shut down the VM to free up RAM and CPU on your host. Your VM files stay on disk so you can resume later.

In the Windows Server VM, click **Start** > **Power** > **Shut down**. Select a reason and click **Continue**.
Alternatively, in VirtualBox Manager, right-click DC1 and select **Close** > **Power Off** if the guest OS is unresponsive.
Your VM will show as Powered Off in VirtualBox Manager. You can start it again any time by selecting it and clicking **Start**.

Delete - I don't want to use this again

Remove all project resources and reclaim disk space. This permanently deletes the VM, its virtual hard disk, and all Active Directory data inside it.

Shut down the DC1 VM if it is still running. The Remove option is disabled while the VM is running.
In VirtualBox Manager, right-click DC1 in the machine list and select Remove.
In the confirmation dialog, choose the option to delete the associated files. This removes the virtual hard disk and all VM configuration from your host.
Delete the Windows Server 2022 Evaluation ISO file from your Downloads folder (or wherever you saved it) to reclaim ~4.7 GB of disk space.

What about VirtualBox itself?

VirtualBox was already installed before this project. If you want to keep using it for other labs or projects, leave it installed. If you want to remove it, use Settings > Apps > Apps & features on Windows and uninstall Oracle VirtualBox from there.

Nice Work!

You just built a fully functional Active Directory domain controller from scratch. You now have hands-on experience with the exact infrastructure that powers most enterprise IT environments.

You learned how to:

Set up a Windows Server 2022 domain controller in a virtual machine with Active Directory Domain Services and DNS.
Created Organizational Units, users, security groups, and Group Policy Objects enforcing password and audit policies.
Used PowerShell for AD administration, network diagnostics, and common help desk tasks like unlocking accounts and resetting passwords.
Secret Mission: Automated bulk user provisioning with a PowerShell script that reads from a CSV file and creates accounts across multiple OUs.

Ready to quiz yourself?