Active Directory Home Lab

Set up a Windows Server 2022 domain controller and manage AD with PowerShell.

Introduction

30 Second Summary

Every time you log in to a work computer, your credentials flow through a system called Active Directory. It manages who can access what across an entire company network.

In this project, you will build your own Active Directory home lab by setting up a Windows Server 2022 virtual machine as a domain controller, then populate it with users, groups, and organizational units.

What You'll Build

A fully functional Active Directory domain controller running inside VirtualBox on your own PC, complete with departments, user accounts, security groups, and a PowerShell automation script.

By the end of this project, you'll have:

  • A Windows Server 2022 VM configured as a domain controller running your own forest and domain.
  • Organizational Units for IT, HR, and Sales departments with user accounts and security groups you created.
  • A PowerShell script that bulk-creates Active Directory users from a CSV file.
  • Secret Mission: Join a Windows client VM to your domain and enforce a desktop wallpaper using Group Policy.

Are there any prerequisites?

You need a Windows PC with at least 8 GB of RAM (16 GB recommended), 60 GB of free disk space, and an internet connection to download ISOs. No prior Active Directory experience is required.

Download and Install VirtualBox

To build your Active Directory home lab, you need a way to run a second operating system inside your PC.

A virtual machine lets you do exactly that. In this step, you will install Oracle VirtualBox (free virtualization software) and download the Windows Server 2022 installer file so everything is ready for the next step.

In this step, get ready to:
  • Install Oracle VirtualBox on your Windows PC.
  • Verify VirtualBox is running correctly.
  • Download the Windows Server 2022 Evaluation ISO from Microsoft.
Install Oracle VirtualBox

VirtualBox is a free application from Oracle that lets you create and run virtual machines on your PC. You will use it to host your Windows Server throughout this project.

  • Press the Windows key to open your search bar.
  • Type VirtualBox and press Enter.

✔️ I see VirtualBox Manager (version 7.2 or higher)

Great, VirtualBox is already installed and up to date. Close VirtualBox for now and skip ahead to the next substep.

ⓧ I see an older version of VirtualBox

You have VirtualBox installed but it needs an update. Download the latest version and install it over your existing copy.

  • Open your browser and go to https://www.virtualbox.org/.
  • Click Downloads in the navigation menu.
  • Under Windows hosts, click the download link to get the installer.
  • Once the download finishes, locate the file in your Downloads folder. It will be named something like VirtualBox-7.2.8-173730-Win.exe.
  • Right-click the file and select Run as administrator.
  • Click Next through each wizard screen, accepting all default settings.
  • Click Install when prompted.
  • If Windows asks to allow network interface changes, click Yes.
  • Click Finish to close the installer.

VirtualBox will launch automatically after installation. If it does not, search for VirtualBox in your Start menu.

ⓧ Nothing came up (VirtualBox is not installed)

VirtualBox is not on your machine yet. Follow these steps to download and install it.

  • Open your browser and go to https://www.virtualbox.org/.
  • Click Downloads in the navigation menu.
  • Under Windows hosts, click the download link to get the installer.
  • Once the download finishes, locate the file in your Downloads folder. It will be named something like VirtualBox-7.2.8-173730-Win.exe.
  • Right-click the file and select Run as administrator.
  • Click Next through each wizard screen, accepting all default settings.
  • Click Install when prompted.
  • If Windows asks to allow network interface changes, click Yes.
  • Click Finish to close the installer.

VirtualBox will launch automatically after installation. If it does not, search for VirtualBox in your Start menu.

Why VirtualBox instead of Hyper-V?

Windows Pro includes a built-in hypervisor called Hyper-V, but it is not available on Windows Home editions. VirtualBox works on every Windows edition, is completely free, and teaches a transferable virtualization skill you can use on macOS or Linux too.

Verify VirtualBox is ready

With VirtualBox open, confirm it installed the correct version.

  • In the VirtualBox Manager window, click Help in the menu bar.
  • Click About VirtualBox.
  • Confirm the version number shows 7.2.8 or higher.
  • Click OK to close the About dialog.

Don't see a version number?

Make sure VirtualBox is fully open and you see the main VirtualBox Manager window (a toolbar at the top and an empty machine list). If the window did not appear, search for VirtualBox in your Start menu and open it from there.

Help me troubleshoot my VirtualBox installation.

Download the Windows Server 2022 evaluation ISO

Microsoft offers a free 180-day evaluation of Windows Server 2022. You will download the ISO file now so it is ready when you create your virtual machine in the next step.

  • Open your browser and go to the Microsoft Evaluation Center: https://www.microsoft.com/en-us/evalcenter/evaluate-windows-server-2022.
  • Click Download the ISO (you may need to scroll down to find this option).
  • Sign in with your Microsoft account. If you do not have one, create a free account when prompted.
  • Fill out the registration form with your details and click Continue.
  • Select English as the language.
  • Select the 64-bit edition ISO download.
  • Click Download. The ISO file is approximately 4.7 GB, so the download may take several minutes depending on your internet speed.
  • Save the file to a location you can easily find later, such as your Downloads folder.

What is a 180-day evaluation?

The evaluation ISO is a fully functional copy of Windows Server 2022 that expires after 180 days. No product key is required during installation. You simply select the Evaluation edition when prompted.

The server must activate over the internet within the first 10 days to avoid automatic shutdown. For a home lab, this is more than enough time to learn Active Directory.

Having trouble downloading?

If the download page asks for a product key, you are on the wrong page. Make sure you are on the Evaluation Center page, not the Volume Licensing page. The evaluation does not require a product key.

If the download is very slow, try pausing and resuming, or use a different browser.

Help me download Windows Server 2022.

Your tools are ready. Next up, you will create a virtual machine in VirtualBox and install Windows Server 2022 inside it.

Create and Configure the Windows Server VM

You have VirtualBox installed and the Windows Server ISO ready to go. Now it is time to build the virtual machine that will become your domain controller.

A domain controller needs a predictable network address so other machines can always find it. In this step, you will create the VM, install Windows Server, assign a static IP address, and rename the machine to its final identity.

In this step, get ready to:
  • Create a virtual machine named DC01 with the correct hardware settings.
  • Install Windows Server 2022 Standard Evaluation (Desktop Experience) on DC01.
  • Configure a static IP address, set the DNS server, and rename the computer.
Create the DC01 virtual machine

Every server in your lab runs inside its own virtual machine. You will create one now with enough RAM and disk space to run Active Directory comfortably.

  • In the VirtualBox Manager window, click New in the toolbar at the top.
  • In the Name field, type DC01.
  • For ISO Image, click the dropdown and browse to the Windows Server 2022 ISO you downloaded earlier.
  • VirtualBox will auto-detect the OS. Confirm that Type is set to Microsoft Windows and Version is set to Windows Server 2022 (64-bit).
  • Check the Skip Unattended Installation checkbox. You will install Windows manually to choose the correct edition.
  • Click Next.

Why skip unattended installation?

The unattended installer may not let you choose the Desktop Experience edition. Installing manually ensures you get the full GUI version of Windows Server, which makes administration much easier for learning.

  • On the Hardware page, set Base Memory to 4096 MB (4 GB).
  • Leave the Processors at 1 CPU (the default).
  • Click Next.
  • On the Virtual Hard Disk page, select Create a Virtual Hard Disk Now.
  • Set the disk size to 50 GB.
  • Click Next.
  • Review the summary and click Finish.

Your new DC01 virtual machine now appears in the VirtualBox Manager list on the left side.

What is a virtual machine?

A virtual machine is a software-based computer that runs inside your real computer. It has its own CPU, RAM, and disk, all carved out from your host PC's resources.

This lets you run Windows Server without needing a second physical machine. You can delete or reset the VM at any time without affecting your main system.

Don't see Windows Server 2022 (64-bit) in the Version dropdown?

If VirtualBox does not auto-detect the OS from the ISO, manually set Type to Microsoft Windows and Version to Windows Server 2022 (64-bit) from the dropdown.

If Windows Server 2022 does not appear at all, make sure you installed the latest VirtualBox 7.2.8 and that your PC supports hardware virtualization (VT-x or AMD-V enabled in BIOS).

Help me fix this

Install Windows Server 2022 on DC01

With the VM created, you will now boot it from the ISO and install the operating system. This is similar to installing Windows on a real PC.

  • In VirtualBox Manager, select DC01 in the left panel.
  • Click Start in the toolbar.
  • The VM boots from the Windows Server ISO. On the first screen, leave the language and keyboard defaults.
  • Click Next.
  • Click Install now.
  • When asked for a product key, click I don't have a product key. The evaluation version does not require one.
  • On the edition selection screen, choose Windows Server 2022 Standard Evaluation (Desktop Experience).
  • Click Next.
  • Accept the license terms.
  • Click Next.
  • Select Custom: Install Microsoft Server Operating System only (advanced).
  • Select the 50 GB virtual disk (Drive 0 Unallocated Space).
  • Click Next.
  • Windows begins installing. This takes several minutes. The VM will restart automatically during the process.

Why Desktop Experience?

Windows Server comes in two flavours: Server Core (command line only) and Desktop Experience (full GUI). For learning Active Directory, Desktop Experience gives you Server Manager, the MMC snap-ins, and all the graphical tools you need to explore the system visually.

  • After installation finishes, Windows prompts you to set an Administrator password.
  • Enter a strong password you will remember. You will use this to log in every time.
  • Click Finish.
  • To unlock the login screen, you need to send Ctrl+Alt+Delete to the VM. In the VM window menu bar, click Input.
  • Select Keyboard.
  • Click Insert Ctrl-Alt-Del.
  • Enter your Administrator password and press Enter to log in.

You should see the Windows Server desktop with Server Manager opening automatically.

Take note of your password

Write down or save this Administrator password somewhere safe. You will need it every time you log into DC01 and later when configuring Active Directory.

VM window is black or not booting?

Make sure the ISO is attached. Right-click DC01 in VirtualBox Manager, select Settings, go to Storage, and confirm the ISO file appears under the optical drive.

If the screen stays black for more than 30 seconds, try pressing a key inside the VM window. Some systems need a keypress to boot from CD/DVD.

Help me troubleshoot this

Configure the static IP and rename the computer

A domain controller needs a fixed IP address because other machines on the network will point their DNS settings at it. If the address changed, those machines would lose contact with the domain.

  • In the taskbar at the bottom of the VM desktop, right-click the network icon (a monitor with a cable).
  • Select Open Network & Internet settings.
  • Click Change adapter options.
  • Right-click your Ethernet adapter and select Properties.
  • Select Internet Protocol Version 4 (TCP/IPv4) in the list.
  • Click Properties.
  • Select Use the following IP address.
  • Enter 10.0.0.1 in the IP address field.
  • Enter 255.255.255.0 in the Subnet mask field.
  • Leave the Default gateway field empty. This is an isolated lab network with no router.
  • In the Preferred DNS server field, enter 127.0.0.1. This points DNS to the local machine, which will run the DNS service after Active Directory is installed.
  • Click OK.
  • Click Close on the adapter properties window.

Why set DNS to 127.0.0.1?

When you promote this server to a domain controller in the next step, it will also become a DNS server. Setting the DNS to 127.0.0.1 (localhost) tells the server to use itself for name resolution.

This is essential for Active Directory to function correctly. AD relies heavily on DNS to locate services within the domain.

Now rename the computer so it has a clean, recognizable name before joining the domain.

  • Right-click the Start button and select System.
  • In the About page, scroll down and click Rename this PC.
  • Type DC01 as the new computer name.
  • Click Next.
  • Click Restart now when prompted. The VM will reboot.
  • After the restart, log back in as Administrator using your password.
  • Verify your IP configuration by opening a command prompt. Press the Windows key, type cmd, and press Enter.
  • Confirm your settings by running this command:
ipconfig /all

You should see IPv4 Address showing 10.0.0.1, Subnet Mask showing 255.255.255.0, and DNS Servers showing 127.0.0.1.

The hostname at the top of the output should show DC01.

IP address still showing a different value?

Make sure you applied the changes by clicking OK on both the IPv4 Properties window and the adapter Properties window. If you only closed one window, the settings may not have saved.

If ipconfig /all shows the correct IP but the GUI shows DHCP, this is a known display issue. Trust the ipconfig output as the authoritative result.

Help me troubleshoot this

Your VM is configured and ready. Next up, you will install Active Directory Domain Services and promote DC01 to a domain controller.

Install Active Directory Domain Services

Your Windows Server VM is configured and ready. Now it's time to transform DC01 from a plain server into the brain of your network: a domain controller.

Active Directory Domain Services (AD DS) is the role that lets a Windows Server manage users, computers, and permissions across a network. Installing this role and promoting DC01 to a domain controller creates your own private directory, just like the ones that run inside real companies.

In this step, get ready to:
  • Install the AD DS role using Server Manager.
  • Promote DC01 to a domain controller and create a new forest.
  • Verify the domain is active and accessible.
Install the AD DS role via Server Manager

Before DC01 can manage users and groups, it needs the Active Directory Domain Services role installed. You will add this role through the built-in wizard in Server Manager.

  • In Server Manager, click Manage in the top menu bar.
  • Select Add Roles and Features.
  • On the Before You Begin page, click Next.
  • On the Installation Type page, keep Role-based or feature-based installation selected and click Next.
  • On the Server Selection page, confirm DC01 is highlighted and click Next.
  • On the Server Roles page, check the box for Active Directory Domain Services.
  • A popup appears asking to add required features. Click Add Features.
  • Click Next through the remaining pages until you reach the Confirmation page.
  • Click Install.

The installation takes a minute or two. Wait for the progress bar to finish before continuing.

What is a server role?

A role is a major function you assign to a Windows Server. By installing the AD DS role, you are telling this server that its job is to manage identity and access for your network.

The management tools (including the PowerShell module and GUI consoles) are installed alongside the role automatically.

Don't see Active Directory Domain Services in the list?

Make sure you are on the Server Roles page, not the Features page. AD DS appears under Roles. If the checkbox is greyed out, the role may already be installed.

help me find Active Directory Domain Services in the Add Roles and Features wizard

Promote DC01 to a domain controller

Installing the role alone does not make DC01 a domain controller. You need to promote the server, which creates a brand-new Active Directory forest and domain for your lab.

  • After the installation finishes, look for a yellow notification flag (warning triangle) near the top-right of Server Manager.
  • Click the notification flag.
  • Click Promote this server to a domain controller.
  • On the Deployment Configuration page, select Add a new forest.
  • In the Root domain name field, type yourlab.local.
  • Click Next.
  • On the Domain Controller Options page, set a DSRM password. This is a recovery password you would use if Active Directory ever needed repair. Choose something memorable.
  • Click Next through the remaining pages, accepting all defaults.
  • On the final Prerequisites Check page, click Install.

The server reboots automatically after promotion completes. This is expected.

What is a forest?

A forest is the top-level container in Active Directory. It holds one or more domains that share a common schema and trust each other automatically. Your forest has a single domain: yourlab.local.

The .local suffix keeps your lab isolated from real public DNS names on the internet, so there is no risk of conflicts.

What is a DSRM password?

DSRM stands for Directory Services Restore Mode. If your domain controller ever fails to start normally, you can boot into DSRM and use this password to repair or restore Active Directory. Think of it as an emergency-only admin password.

Seeing prerequisite check warnings?

Yellow warnings about DNS delegation or cryptography are normal in a lab environment. As long as the Install button is available at the bottom, you can safely proceed.

If you see a red error that blocks installation, make sure you typed yourlab.local correctly on the Deployment Configuration page with no extra spaces.

help me troubleshoot the prerequisites check for promoting my server to a domain controller

Verify the domain is active

After the reboot, your login screen looks different. You are now logging into a domain, not just a standalone server.

  • Log in as YOURLAB\Administrator using the same Administrator password you set during Windows installation.
  • Wait for Server Manager to open automatically.
  • In the left sidebar of Server Manager, confirm you see AD DS and DNS listed with green indicators (no red or yellow icons).
  • Click Tools in the top menu bar of Server Manager.
  • Select Active Directory Users and Computers.
  • In the left pane, confirm you see yourlab.local listed as your domain. You can expand it to see default containers like Users and Computers.

You now have a working Active Directory domain. DC01 is managing the yourlab.local domain and is ready to host users, groups, and policies.

Server Manager shows red indicators on AD DS or DNS?

Give the server a minute or two after login. These services can take time to fully start after a reboot. If the indicators stay red after a few minutes, restart the VM and try again.

Also check that the static IP and DNS settings are still correct. Your DNS should point to 127.0.0.1 because DC01 is now its own DNS server.

help me troubleshoot AD DS and DNS not starting on my domain controller

Your domain is live. Next up, you will populate it with Organizational Units, user accounts, and security groups to simulate a real company structure.

Create Organizational Units, Users, and Groups

Your domain controller is live and your yourlab.local forest is ready to be populated.

A real corporate network organizes users into departments, assigns them accounts, and groups them by team for permissions. In this step, you will build that same structure inside your domain using Active Directory Users and Computers.

In this step, get ready to:
  • Create three Organizational Units for IT, HR, and Sales.
  • Create user accounts in each department OU.
  • Create Security Groups and assign users to their department group.
Create three Organizational Units

Organizational Units (OUs) are containers inside Active Directory that let you group objects like users and computers by department, location, or function.

  • In Server Manager, click Tools in the top menu bar.
  • Click Active Directory Users and Computers.
  • In the left panel, expand your domain by clicking the arrow next to yourlab.local.
  • Right-click yourlab.local in the left panel.
  • Select New, then click Organizational Unit.
  • Type IT in the Name field and click OK.
  • Repeat the same process to create a second OU named HR.
  • Repeat once more to create a third OU named Sales.

You should now see three new folders (IT, HR, Sales) listed under yourlab.local in the left panel of Active Directory Users and Computers.

Don't see the new OUs?

Make sure you right-clicked the domain name yourlab.local itself, not one of the default containers like Users or Computers.

If the OUs still don't appear, right-click yourlab.local and click Refresh.

Still stuck? Help me find my Organizational Units in Active Directory Users and Computers.

Create user accounts in each OU

Each OU needs at least one user account so you can test group membership and permissions later.

  • In the left panel, click the IT OU to select it.
  • Right-click the IT OU, select New, then click User.
  • Enter a first name in the First name field (for example, Alex).
  • Enter a last name in the Last name field (for example, Park).
  • Enter a logon name in the User logon name field (for example, apark).
  • Click Next.
  • Enter a password in the Password and Confirm password fields (for example, P@ssw0rd123).
  • Uncheck User must change password at next logon.
  • Click Next, then click Finish.

Why uncheck password change at logon?

In a production environment, you would require users to change their password on first login. For a home lab, unchecking this option saves you from managing forced password resets every time you test a logon.

Password complexity requirements

Active Directory enforces password complexity by default. Your password must be at least 7 characters and contain characters from three of these four categories: uppercase letters, lowercase letters, numbers, and special characters.

A password like P@ssw0rd123 meets all four categories and works well for lab accounts.

  • Repeat the same user creation process in the HR OU. Use a different name and logon name (for example, Jordan Lee with logon name jlee).
  • Repeat once more in the Sales OU. Use a different name and logon name (for example, Sam Rivera with logon name srivera).

Click each OU in the left panel to verify its user appears in the right panel.

Seeing a password error?

If you get an error when setting the password, make sure it meets complexity requirements. Use at least 7 characters with a mix of uppercase, lowercase, numbers, and symbols.

Help me fix a password complexity error when creating an Active Directory user.

Create Security Groups and add members

Security Groups control access to resources like shared folders and printers. By placing users in department groups, you can grant permissions to an entire team at once instead of managing each user individually.

  • In the left panel, right-click the IT OU.
  • Select New, then click Group.
  • Type IT-Staff in the Group name field.
  • Set Group scope to Global and Group type to Security.
  • Click OK.
  • Repeat to create a group named HR-Staff in the HR OU.
  • Repeat to create a group named Sales-Staff in the Sales OU.

Now add each user to their respective department group.

  • In the IT OU, right-click the IT-Staff group.
  • Click Properties.
  • Click the Members tab.
  • Click Add.
  • Type the user's logon name (for example, apark) in the Enter the object names to select field.
  • Click Check Names to verify the name resolves, then click OK.
  • Click OK to close the Properties window.
  • Repeat the same process for the HR-Staff group in the HR OU, adding your HR user.
  • Repeat for the Sales-Staff group in the Sales OU, adding your Sales user.

To verify, right-click any group, open Properties, and check the Members tab. You should see your user listed.

Check Names not finding your user?

Make sure you are typing the user's logon name (the short name like apark), not their full display name. If it still fails, click Advanced, then Find Now to browse all users in the domain.

Help me add a user to a Security Group in Active Directory.

Your domain now has a realistic department structure with users assigned to their teams. Next up, you will learn to manage all of this from the command line using PowerShell.

Manage Active Directory with PowerShell

Your domain is taking shape. You have Organizational Units, user accounts, and security groups ready to go.

Managing a few users through the GUI works fine, but enterprise environments can have thousands of accounts. PowerShell gives you the power to query, create, and manage Active Directory objects at scale.

In this step, get ready to:
  • Query existing users and OUs with PowerShell commands.
  • Create a new user account entirely from the command line.
  • Write and run a script that bulk-creates users from a CSV file.
Query your domain with PowerShell

Before creating anything new, you can use PowerShell to inspect what already exists in your domain. This confirms the users and OUs from the previous step are live.

  • Right-click the Start button on your DC01 desktop.
  • Select Windows PowerShell (Admin).

Why run as Administrator?

Active Directory cmdlets need elevated privileges to read and modify domain objects. Running as Administrator ensures every command in this step has the access it needs.

  • List all user accounts in your domain by running this command:
Get-ADUser -Filter *

You should see a list of user accounts including the ones you created in the previous step, plus built-in accounts like Administrator and Guest.

  • List all Organizational Units by running:
Get-ADOrganizationalUnit -Filter *

You should see your IT, HR, and Sales OUs listed alongside the default OUs like Domain Controllers. Each entry shows its DistinguishedName and Name.

Not seeing your OUs or users?

Make sure you are logged in as YOURLAB\Administrator. If you opened a regular (non-admin) PowerShell window, close it and reopen using right-click on the Start button.

help me troubleshoot why Get-ADUser or Get-ADOrganizationalUnit is not returning my users and OUs in Active Directory

Create a new user from PowerShell

Creating users through the GUI is fine for one or two accounts, but typing each field into dialog boxes gets repetitive fast. The New-ADUser cmdlet lets you create a fully configured user in a single command.

  • Create a new user called Jane Smith in the IT OU by running this command:
New-ADUser `
    -Name "Jane Smith" `
    -GivenName "Jane" `
    -Surname "Smith" `
    -SamAccountName "jsmith" `
    -UserPrincipalName "jsmith@yourlab.local" `
    -Path "OU=IT,DC=yourlab,DC=local" `
    -AccountPassword (ConvertTo-SecureString "P@ssw0rd123" -AsPlainText -Force) `
    -Enabled $true

What does this command do?

-Name sets the display name. -SamAccountName is the short logon name (like jsmith), while -UserPrincipalName is the full email-style logon (jsmith@yourlab.local).

-Path uses the Distinguished Name format to place the user in the IT OU. -AccountPassword converts a plain text string into a secure string that AD requires. -Enabled $true activates the account immediately.

  • Verify the user was created by running:
Get-ADUser -Identity jsmith

You should see Jane Smith's account details including her SamAccountName, UserPrincipalName, and Enabled: True.

Seeing an error about the path or identity?

If you see an error about the OU path, double-check the -Path value matches your domain exactly: OU=IT,DC=yourlab,DC=local. The Distinguished Name is case-sensitive for OU names.

If the command ran without output (no error, no confirmation), that means it succeeded. PowerShell does not print confirmation for New-ADUser by default.

help me fix a New-ADUser error in my Active Directory lab

Bulk-create users with a PowerShell script

Creating users one at a time works, but a real sysadmin might onboard dozens of people in a single day. You will write a script that reads a list of users from a CSV file and creates them all automatically.

  • Create a folder to store your scripts by running:
mkdir C:\Scripts
  • Open a new file in Notepad for the user list by running:
notepad C:\Scripts\Users.csv
  • When Notepad opens and asks if you want to create a new file, click Yes.
  • Paste the following content into the blank file:
FirstName,LastName,Department,Username
Alice,Johnson,IT,ajohnson
Bob,Williams,HR,bwilliams
Carol,Brown,Sales,cbrown
David,Garcia,IT,dgarcia
Emma,Martinez,HR,emartinez
Frank,Anderson,Sales,fanderson
Grace,Taylor,IT,gtaylor
Henry,Thomas,HR,hthomas

What does this CSV do?

Each row is one user account to create. The column headers (FirstName, LastName, Department, Username) become property names when PowerShell reads the file with Import-Csv.

The Department value maps directly to your OU names (IT, HR, Sales), so the script can place each user in the correct OU automatically.

  • Press Ctrl+S to save the file, then close Notepad.
  • Now create the PowerShell script file by running:
notepad C:\Scripts\Create-Users.ps1
  • Click Yes when Notepad asks to create the new file.
  • Paste the following script:
# Bulk-create Active Directory users from a CSV file
# CSV must have columns: FirstName, LastName, Department, Username

$csvPath = "C:\Scripts\Users.csv"
$defaultPassword = ConvertTo-SecureString "P@ssw0rd123" -AsPlainText -Force

$users = Import-Csv -Path $csvPath

foreach ($user in $users) {
    $ou = "OU=$($user.Department),DC=yourlab,DC=local"
    $upn = "$($user.Username)@yourlab.local"
    $displayName = "$($user.FirstName) $($user.LastName)"

    New-ADUser `
        -Name $displayName `
        -GivenName $user.FirstName `
        -Surname $user.LastName `
        -SamAccountName $user.Username `
        -UserPrincipalName $upn `
        -Path $ou `
        -AccountPassword $defaultPassword `
        -Enabled $true `
        -ChangePasswordAtLogon $false

    Write-Host "Created user: $displayName in $ou"
}

Write-Host "All users created successfully!"

What does this script do?

The script reads Users.csv and loops through each row. For every user, it builds the OU path and user principal name from the CSV columns, then calls New-ADUser with all the required parameters.

ConvertTo-SecureString converts the plain text password into the secure format that Active Directory requires. -ChangePasswordAtLogon $false keeps lab accounts ready to use without a forced password reset.

Write-Host prints a confirmation line for each user so you can watch the progress in real time.

  • Press Ctrl+S to save the script, then close Notepad.
  • Back in PowerShell, navigate to the Scripts folder and run the script:
cd C:\Scripts
.\Create-Users.ps1

You should see eight lines of output, each confirming a user was created. The final line reads All users created successfully!.

  • Verify the new users in the GUI by opening Server Manager, clicking Tools, then selecting Active Directory Users and Computers.
  • Expand yourlab.local and click each OU (IT, HR, Sales).

You should see the new users distributed across their respective OUs. The IT OU now contains Alice Johnson, David Garcia, and Grace Taylor. HR contains Bob Williams, Emma Martinez, and Henry Thomas. Sales contains Carol Brown and Frank Anderson.

Script errors or missing users?

If you see an error about an OU path not being found, make sure the Department column in your CSV exactly matches your OU names (IT, HR, Sales). These are case-sensitive.

If you get an "access denied" error, confirm you are running PowerShell as Administrator. Close and reopen it using right-click on the Start button.

If the script runs but some users are missing, check for duplicate SamAccountName values. Each username must be unique across the entire domain.

help me fix errors in my bulk user creation PowerShell script for Active Directory

✔️ Awesome, I've got everything!

Great. Double check you have saved both Users.csv and Create-Users.ps1 in C:\Scripts.

ⓧ I'd like to double check the full code

Here is the complete Create-Users.ps1 script:

# Bulk-create Active Directory users from a CSV file
# CSV must have columns: FirstName, LastName, Department, Username

$csvPath = "C:\Scripts\Users.csv"
$defaultPassword = ConvertTo-SecureString "P@ssw0rd123" -AsPlainText -Force

$users = Import-Csv -Path $csvPath

foreach ($user in $users) {
    $ou = "OU=$($user.Department),DC=yourlab,DC=local"
    $upn = "$($user.Username)@yourlab.local"
    $displayName = "$($user.FirstName) $($user.LastName)"

    New-ADUser `
        -Name $displayName `
        -GivenName $user.FirstName `
        -Surname $user.LastName `
        -SamAccountName $user.Username `
        -UserPrincipalName $upn `
        -Path $ou `
        -AccountPassword $defaultPassword `
        -Enabled $true `
        -ChangePasswordAtLogon $false

    Write-Host "Created user: $displayName in $ou"
}

Write-Host "All users created successfully!"

And here is the complete Users.csv file:

FirstName,LastName,Department,Username
Alice,Johnson,IT,ajohnson
Bob,Williams,HR,bwilliams
Carol,Brown,Sales,cbrown
David,Garcia,IT,dgarcia
Emma,Martinez,HR,emartinez
Frank,Anderson,Sales,fanderson
Grace,Taylor,IT,gtaylor
Henry,Thomas,HR,hthomas

Secret mission

Join a Client to the Domain and Apply Group Policy

Your domain controller is running and your users are created. But a real corporate network has workstations that join the domain and receive centrally managed settings. In this secret mission, you will add a Windows 10 client VM to your lab, join it to your domain, and create a Group Policy Object that enforces a custom desktop wallpaper on IT users.

Clean Up Your Resources

Clean Up Your Resources

This project runs entirely on your local machine using free software and evaluation licenses. There are no ongoing cloud costs.

Decide whether to keep your resources running, pause them to come back later, or delete them entirely.

Resources you used:

  • DC01 virtual machine (Windows Server 2022 domain controller).
  • CLIENT01 virtual machine (Windows 10, if you completed the Secret Mission).
  • Windows Server 2022 Evaluation ISO file.
  • Windows 10 Enterprise Evaluation ISO file (if you completed the Secret Mission).
  • C:\Scripts folder with PowerShell scripts and CSV file.
  • Oracle VirtualBox application.

Keep everything running

No action needed. Choose this if you are still actively building or want to continue practicing Active Directory administration.

  • Your VMs remain on disk and can be started anytime from VirtualBox Manager.
  • The Windows Server 2022 evaluation license lasts 180 days from activation.
  • VirtualBox stays installed on your machine for future lab work.

Pause - I'll come back to this later

Shut down your virtual machines to free up RAM and CPU while keeping all files intact for later.

  • In VirtualBox Manager, right-click DC01 and select Close > Power Off.
  • If CLIENT01 is running, right-click it and select Close > Power Off.
  • Your VMs and ISO files stay on disk. When you are ready to resume, open VirtualBox and start DC01.

Delete - I don't want to use this again

Remove all project resources and free up disk space. This deletes your domain controller, all Active Directory data, and the virtual machines permanently.

  • In VirtualBox Manager, right-click DC01 and select Remove. When prompted, choose Delete all files to remove the virtual hard disk.
  • If you created CLIENT01, right-click it and select Remove > Delete all files.
  • Delete the Windows Server 2022 ISO file from your Downloads folder (or wherever you saved it).
  • Delete the Windows 10 Enterprise ISO file if you downloaded it for the Secret Mission.
  • Delete the scripts folder by opening File Explorer, navigating to C:\Scripts, and deleting the folder.
  • To uninstall VirtualBox, open Settings > Apps > Installed apps. Find Oracle VirtualBox in the list, click the three-dot menu, and select Uninstall.

Nice Work!

Nice Work!

You just built a fully functional Active Directory environment from scratch. You now have a personal home lab that proves you can set up and manage the identity system at the core of most corporate Windows networks.

You've learned how to:

  • Built and configured a Windows Server 2022 virtual machine as a domain controller hosting a new Active Directory forest and domain.
  • Organized your domain with Organizational Units, user accounts, and security groups using both Server Manager and the GUI.
  • Wrote a PowerShell script that bulk-creates users from a CSV file to automate Active Directory administration.
  • Joined a Windows client to your domain and enforced a custom desktop wallpaper using Group Policy.

Ready to quiz yourself?