Build a Windows Server Enterprise Lab

Deploy Active Directory, DNS, DHCP, and Group Policy on 4 VMs.

Introduction

30 Second Summary

Every time you log into a work computer, access a shared drive, or get prompted to change your password, an IT team built the infrastructure making that possible. Those systems run on Windows Server with Active Directory, and managing them is the core skill of a systems engineer.

In this project, you will build a complete enterprise network on your laptop using four virtual machines. You will deploy domain controllers, configure automatic IP addressing, create department file shares, and enforce security policies through Group Policy.

What You'll Build

A fully functional 4-VM enterprise Windows Server environment simulating a small company called "CorpLab" with redundant domain controllers, centralized network services, and policy-managed workstations.

By the end of this project, you'll have:

  • A private virtual network with two redundant domain controllers (DC01 and DC02), a file server (FILE01), and a domain-joined Windows 11 workstation (CLIENT01) running on Hyper-V.
  • A new Active Directory forest (corplab.local) with DNS, DHCP, and department-based Organizational Units for IT, HR, and Finance.
  • Department file shares with layered NTFS and share permissions, automatically mapped to workstations via Group Policy.
  • Secret Mission: Implement an advanced security baseline GPO that restricts USB storage devices and configures Windows Firewall rules across all domain computers.

Are there any prerequisites?

This project requires a Windows 11 Pro or Enterprise machine with at least 32GB RAM, 8 CPU cores, and 250GB of free SSD space. You will also need a Windows Server 2019 evaluation ISO and a Windows 11 Enterprise evaluation ISO, both of which are free 180-day downloads from Microsoft.

Step 1 walks you through enabling Hyper-V and creating all four virtual machines from scratch.

Before We Start

Every enterprise network starts with infrastructure. Before you can configure Active Directory, DNS, or Group Policy, you need the virtual machines that will run your servers and workstations.

In this step, you will enable Hyper-V on your Windows 11 laptop, create an isolated virtual network, and build the four VMs that make up your CorpLab environment.

In this step, get ready to:
  • Enable Hyper-V and confirm it is working.
  • Create a private virtual switch for isolated lab networking.
  • Create four virtual machines (DC01, DC02, FILE01, CLIENT01) with correct specs.
Enable Hyper-V on your Windows 11 laptop

Hyper-V is the built-in virtualization platform on Windows 11 Pro and Enterprise. It lets you run multiple operating systems as virtual machines on a single physical computer.

  • Press the Windows key to open your Start menu.
  • Type PowerShell and look for Windows PowerShell in the results.
  • Click Run as administrator on the right side of the search results.
  • Click Yes on the User Account Control prompt that appears.

Why Run as administrator?

Enabling Hyper-V modifies Windows system features. Only an elevated (administrator) PowerShell session has permission to make these changes.

  • Enable Hyper-V by running this command in your administrator PowerShell window:
Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V -All

What does this command do?

Enable-WindowsOptionalFeature turns on Windows features that are not active by default. The -FeatureName Microsoft-Hyper-V parameter targets the Hyper-V platform. The -All flag includes all sub-features like management tools and platform components.

  • When prompted, type Y and press Enter to restart your computer.
  • Wait for your computer to restart. This may take a few minutes as Windows configures the Hyper-V components.

Seeing an error about virtualization?

If you see a message about hardware virtualization not being enabled, you need to enable it in your BIOS/UEFI settings. Restart your computer, enter BIOS (usually by pressing F2 or Delete during boot), and enable Intel VT-x or AMD-V under the CPU settings.

Help me troubleshoot my Hyper-V installation error

  • After restart, press the Windows key, type Hyper-V Manager, and press Enter to open it.

You should see the Hyper-V Manager window with your computer name listed in the left panel. This confirms Hyper-V is installed and ready.

Create a private virtual switch for the lab network

Virtual machines need a network to communicate with each other. A private virtual switch creates an isolated network where only your lab VMs can talk to one another, with no internet access and no connection to your host machine.

  • In Hyper-V Manager, click Virtual Switch Manager in the Actions pane on the right side.
  • Select Private from the list of switch types.
  • Click Create Virtual Switch.
  • In the Name field, type CorpLab-Switch.
  • Click OK.

What is a Private virtual switch?

A Private switch allows communication only between VMs connected to it on the same host. Unlike an Internal switch (which also connects to the host OS) or an External switch (which bridges to your physical network), a Private switch is completely isolated.

This is perfect for a lab environment. Your domain controllers, file server, and client will communicate on their own 10.0.0.0/24 subnet without interference from your home network.

You should see CorpLab-Switch listed under Virtual Switches in the left pane of Virtual Switch Manager.

Don't see the switch listed?

Make sure you clicked OK (not just Apply) to save the switch. If you see an error about network changes, close Virtual Switch Manager and reopen it to check if the switch was created.

Help me troubleshoot my virtual switch creation issue

Create the four lab virtual machines

Your CorpLab network needs four VMs. You will create each one through the Hyper-V New Virtual Machine wizard, then adjust security settings before booting.

Start with DC01, your primary domain controller.

  • In Hyper-V Manager, click New in the Actions pane, then click Virtual Machine.
  • On the Specify Name and Location page, enter DC01 as the name. Click Next.
  • On the Specify Generation page, select Generation 2. Click Next.
  • On the Assign Memory page, enter 4096 MB. Uncheck Use Dynamic Memory for this virtual machine. Click Next.
  • On the Configure Networking page, select CorpLab-Switch from the dropdown. Click Next.
  • On the Connect Virtual Hard Disk page, select Create a virtual hard disk and set the size to 40 GB. Click Next.
  • On the Installation Options page, select Install an operating system from a bootable image file. Browse to your Windows Server 2019 ISO file. Click Next.
  • Click Finish to create the VM.

Why Generation 2 and static memory?

Generation 2 VMs support UEFI firmware, which is required for modern Windows installations. Static memory (instead of Dynamic) gives each VM a guaranteed allocation, preventing memory contention when all four VMs run simultaneously.

  • Now configure the processor count. Right-click DC01 in the VM list and click Settings.
  • In the left panel, click Processor.
  • Set Number of virtual processors to 2.
  • In the left panel, click Security.
  • Uncheck Enable Secure Boot.
  • Click OK.

Why disable Secure Boot?

Windows Server 2019 evaluation ISOs can encounter boot issues with Secure Boot enabled on Generation 2 VMs. Disabling it (or setting the template to "Microsoft UEFI Certificate Authority") prevents the VM from refusing to boot the ISO.

DC01 is ready. Now repeat this process for the remaining three VMs using these specifications:

  • DC02: 4096 MB RAM (static), 2 virtual processors, 40 GB disk, connected to CorpLab-Switch, Windows Server 2019 ISO, Secure Boot disabled.
  • FILE01: 4096 MB RAM (static), 2 virtual processors, 50 GB disk, connected to CorpLab-Switch, Windows Server 2019 ISO, Secure Boot disabled.
  • CLIENT01: 4096 MB RAM (static), 2 virtual processors, 60 GB disk, connected to CorpLab-Switch, Windows 11 Enterprise ISO, Secure Boot disabled.

Same wizard, different values

The only differences between VMs are the name, disk size, and which ISO you attach. Follow the exact same wizard steps (New > Virtual Machine), then adjust the processor count and Secure Boot in Settings afterwards.

  • After creating all four VMs, verify they appear in the Hyper-V Manager VM list: DC01, DC02, FILE01, and CLIENT01.

All four VMs should show a status of Off in the State column. Do not start them yet.

VM not showing in the list?

If a VM is missing, you may have cancelled the wizard before clicking Finish. Try creating it again. If you see an error about insufficient disk space, confirm you have at least 250 GB free on your SSD.

Help me figure out why my VM is missing

✔️ Awesome, I've got everything!

Great. You should have all four VMs listed in Hyper-V Manager, each connected to CorpLab-Switch, with Secure Boot disabled.

ⓧ I'd like to double check the full setup

Here is exactly what each VM should look like in its Settings:

  • DC01: Generation 2, 4096 MB static RAM, 2 virtual processors, 40 GB virtual hard disk, connected to CorpLab-Switch, Windows Server 2019 ISO attached under DVD Drive, Secure Boot disabled.
  • DC02: Generation 2, 4096 MB static RAM, 2 virtual processors, 40 GB virtual hard disk, connected to CorpLab-Switch, Windows Server 2019 ISO attached under DVD Drive, Secure Boot disabled.
  • FILE01: Generation 2, 4096 MB static RAM, 2 virtual processors, 50 GB virtual hard disk, connected to CorpLab-Switch, Windows Server 2019 ISO attached under DVD Drive, Secure Boot disabled.
  • CLIENT01: Generation 2, 4096 MB static RAM, 2 virtual processors, 60 GB virtual hard disk, connected to CorpLab-Switch, Windows 11 Enterprise ISO attached under DVD Drive, Secure Boot disabled.

To verify any VM's settings, right-click it in Hyper-V Manager and select Settings. Check Memory, Processor, Network Adapter (should say CorpLab-Switch), and Security (Secure Boot unchecked).

Your virtual infrastructure is ready. Next up, you will install Windows Server 2019 on DC01 and configure it as the foundation of your enterprise network.

Install Windows Server 2019 on DC01

Your four VMs are created and ready to go. Now it is time to bring the first one to life.

DC01 will be the backbone of your entire lab. It needs a stable operating system, a fixed identity, and a predictable IP address before you can install any server roles on it. In this step, you will install Windows Server 2019 on DC01, rename it, and assign a static IP so the rest of the lab can find it.

In this step, get ready to:
  • Install Windows Server 2019 Standard (Desktop Experience) on the DC01 VM.
  • Rename the server to DC01 and configure a static IP address.
  • Verify the network configuration is correct.
Boot DC01 and install Windows Server 2019

Before you can configure any server roles, you need an operating system running. The installation wizard walks you through selecting the edition, choosing the drive, and setting an Administrator password.

  • In Hyper-V Manager, right-click the DC01 VM and select Start.
  • Right-click DC01 again and select Connect to open the VM console window.
  • When prompted, press any key to boot from the ISO.
  • On the language and keyboard screen, leave the defaults and click Next.
  • Click Install Now.
  • On the edition selection screen, choose Windows Server 2019 Standard (Desktop Experience) and click Next.
  • Accept the license terms and click Next.
  • Select Custom: Install Windows only (advanced).
  • Select the 40 GB drive (it shows as Drive 0 Unallocated Space) and click Next.
  • Wait for installation to complete. This takes approximately 10-15 minutes.
  • When the server restarts and asks you to set a password, enter P@ssw0rd!2024 as the Administrator password.
  • Confirm the password and click Finish.

Why Desktop Experience?

Windows Server 2019 comes in two installation options. Server Core is a command-line-only environment with a smaller footprint. Desktop Experience includes the full graphical interface with Server Manager, which makes learning and troubleshooting much easier.

For a learning lab, Desktop Experience gives you access to GUI tools like Active Directory Users and Computers, DHCP Manager, and Group Policy Management Console.

VM won't boot from the ISO?

If you see a black screen with no boot prompt, the ISO might not be attached. Shut down the VM, go to Settings > SCSI Controller, and confirm the Windows Server 2019 ISO is loaded in the DVD Drive.

If you see a Secure Boot error, make sure you disabled Secure Boot in the previous step (Settings > Security > uncheck Enable Secure Boot).

Help me troubleshoot my DC01 VM not booting from the Windows Server 2019 ISO in Hyper-V.

Rename the server and configure a static IP

Every server in a domain needs a proper hostname and a static IP address. Other machines will look for DC01 by name and by its fixed address. Setting these now prevents issues when you promote this machine to a Domain Controller later.

  • Log in to DC01 as Administrator using the password you just set.
  • Right-click the Start button and select Windows PowerShell (Admin).
  • Rename the computer to DC01 by running this command:
Rename-Computer -NewName "DC01" -Restart

What does this command do?

This renames the computer from its random default name (like WIN-XXXXXXX) to DC01. The -Restart flag tells the server to reboot immediately so the new name takes effect.

  • Wait for the server to restart and log back in as Administrator.
  • Open Windows PowerShell (Admin) again.
  • Configure the static IP address and DNS by running these commands:
# Assign a static IP address to DC01
New-NetIPAddress -InterfaceAlias "Ethernet" -IPAddress 10.0.0.10 -PrefixLength 24

# Point DNS to itself (this server will become the DNS server later)
Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses 127.0.0.1

What do these commands do?

`New-NetIPAddress` assigns the static address 10.0.0.10 with a /24 subnet mask to the Ethernet adapter. This means DC01 will always be reachable at this address on the CorpLab-Switch network.

`Set-DnsClientServerAddress` points the server's DNS lookups to 127.0.0.1 (itself). Once you promote DC01 to a Domain Controller with DNS installed, it will resolve its own domain name queries.

  • Verify the configuration by running:
ipconfig /all

You should see 10.0.0.10 listed as the IPv4 Address, a subnet mask of 255.255.255.0, and 127.0.0.1 as the DNS Server.

Seeing an error about InterfaceAlias?

The interface name might differ on your VM. Run Get-NetAdapter to see the actual name of your network adapter. If it shows something other than Ethernet, replace "Ethernet" in both commands with your adapter's actual name.

Help me find and fix my network adapter name for the static IP commands.

Verify network configuration

DC01 is the only VM running right now, so you cannot test connectivity to other machines yet. You can confirm the IP is correctly assigned to the right interface.

  • Confirm the IP assignment by running this command:
Get-NetIPAddress -InterfaceAlias "Ethernet"

You should see 10.0.0.10 with a PrefixLength of 24 in the output.

Why 10.0.0.10 and not 10.0.0.1?

In enterprise networks, x.x.x.1 is typically reserved for the default gateway (the router). Even though this private lab has no router, following this convention keeps the setup realistic. Domain controllers start at .10 and .11, file servers at .20, and workstations get dynamic addresses from .100 onwards via DHCP.

DC01 now has a clean operating system, a proper hostname, and a fixed network address. Next up, you will promote it to a Domain Controller and create your Active Directory forest.

Promote DC01 to Domain Controller

DC01 is running Windows Server 2019 with a static IP and DNS configured. The next step is to transform it from a standalone server into the first Domain Controller for your enterprise network.

A Domain Controller is the server that runs Active Directory Domain Services (AD DS), which is the central identity and access management system in every Windows enterprise. Once DC01 is promoted, it becomes the authority that authenticates users, stores group policies, and controls resource access for the entire corplab.local domain.

In this step, get ready to:
  • Install the Active Directory Domain Services role on DC01.
  • Create a new Active Directory forest called corplab.local.
  • Verify that AD DS and DNS services are running correctly.
Install Active Directory Domain Services role

Before DC01 can become a Domain Controller, you need to install the AD DS server role. This adds the binaries and management tools required for domain promotion.

  • In the PowerShell window on DC01 (still running as Administrator), install the AD DS role by running this command:
Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools

What does this command do?

  • Install-WindowsFeature adds a Windows Server role or feature to the server.
  • -Name AD-Domain-Services specifies the Active Directory Domain Services role.
  • -IncludeManagementTools installs the GUI tools like Active Directory Users and Computers, which you will use to manage your domain.
  • Wait for the installation to complete (2-3 minutes).
  • Verify the role is installed by running:
Get-WindowsFeature AD-Domain-Services
  • You should see AD-Domain-Services listed with an [X] next to it, indicating it is installed.

Command not recognized?

  • Make sure you are running PowerShell as Administrator. Right-click the PowerShell icon in the taskbar and select Run as Administrator.
  • If you see a permissions error, confirm you are logged in as the local Administrator account.

Help me troubleshoot the AD DS role installation

Create a new Active Directory forest

An Active Directory forest is the top-level container for your entire domain structure. Creating a new forest makes DC01 the very first Domain Controller and establishes corplab.local as your enterprise domain.

  • Promote DC01 to a Domain Controller by running this command:
Install-ADDSForest -DomainName "corplab.local" -DomainNetbiosName "CORPLAB" -ForestMode "WinThreshold" -DomainMode "WinThreshold" -InstallDns:$true -DatabasePath "C:\Windows\NTDS" -SysvolPath "C:\Windows\SYSVOL" -LogPath "C:\Windows\NTDS" -Force:$true

What does this command do?

  • -DomainName "corplab.local" sets the fully qualified domain name for your new forest.
  • -DomainNetbiosName "CORPLAB" is the short name used by older systems and login screens (e.g. CORPLAB\Administrator).
  • -ForestMode "WinThreshold" and -DomainMode "WinThreshold" set the functional level to Windows Server 2016, which is the highest level available on Windows Server 2019.
  • -InstallDns:$true installs the DNS server role alongside AD DS. Active Directory depends on DNS for name resolution.
  • -Force:$true suppresses confirmation prompts so the promotion proceeds without asking "are you sure?" at each step.

What is DSRM?

After you run this command, PowerShell will prompt you to enter and confirm a Safe Mode (DSRM) password. DSRM stands for Directory Services Restore Mode.

This password is used to log into the Domain Controller if Active Directory ever fails to start. Use a strong, memorable password. You can reuse your Administrator password for this lab environment.

  • When prompted for the SafeModeAdministratorPassword, type a strong password and press Enter.
  • Confirm the password by typing it again and pressing Enter.
  • The server will automatically restart after promotion completes. This takes 5-10 minutes.

Keep the VM window open

You will see several warning messages during promotion about DNS delegation and cryptography. These are informational and expected in a lab environment. The promotion will succeed despite these warnings.

Promotion failing or hanging?

  • Make sure the DSRM password is not blank. It must be at least one character.
  • Verify your static IP is still set correctly by running ipconfig /all before retrying. If the IP is missing, reconfigure it using the commands from the previous step.
  • If the command errors out, try restarting the VM and running it again. Transient WinRM issues can interrupt the process.

Help me troubleshoot my AD DS forest promotion

Verify AD DS and DNS are running

After the restart, DC01 is now a Domain Controller. You need to confirm that all the critical Active Directory services started successfully.

  • Log in to DC01 as CORPLAB\Administrator using the same password you set earlier.
  • Open PowerShell as Administrator and check that AD services are running:
Get-Service adws,kdc,netlogon,dns

What are these services?

  • adws (Active Directory Web Services) handles PowerShell and remote management connections to AD.
  • kdc (Key Distribution Center) handles Kerberos authentication for the domain.
  • netlogon authenticates users and computers joining or logging into the domain.
  • dns resolves domain names like DC01.corplab.local to IP addresses.
  • All four services should show a Status of Running.
  • Verify the domain details by running:
Get-ADDomain corplab.local
  • You should see the domain name corplab.local, the NetBIOS name CORPLAB, and infrastructure details like the PDC emulator and RID master listed.
  • Confirm DC01 is registered as a Domain Controller by running:
Get-ADDomainController -Filter *
  • You should see DC01 listed with its IP address 10.0.0.10 and the domain corplab.local.
  • Open Active Directory Users and Computers from Server Manager > Tools to confirm the domain is visible in the GUI.

You should see corplab.local listed in the left panel with default containers like Computers, Domain Controllers, and Users.

Services not running or domain not found?

  • If any service shows Stopped, try restarting the VM. AD services sometimes need a clean boot to initialize after promotion.
  • If Get-ADDomain fails, make sure you logged in as CORPLAB\Administrator, not the local Administrator. After promotion, the domain account is required.
  • If Active Directory Users and Computers is not in the Tools menu, run Install-WindowsFeature RSAT-AD-Tools to add the management snap-ins.

Help me troubleshoot AD DS services not starting on my Domain Controller

DC01 is now the authoritative Domain Controller for corplab.local. Next up, you will configure DHCP on DC01 so that workstations joining the network receive their IP addresses automatically.

Configure DHCP on DC01

DC01 is now your domain controller, running Active Directory and DNS for corplab.local. The next piece of the puzzle is automatic IP addressing for any workstations that join the network.

DHCP (Dynamic Host Configuration Protocol) hands out IP addresses to devices automatically. Without it, you would need to manually configure networking on every single machine that joins your domain. In this step, you will install and configure DHCP on DC01 so that CLIENT01 (and any future workstations) receive their network settings the moment they power on.

In this step, get ready to:
  • Install the DHCP Server role and authorize it in Active Directory.
  • Create a DHCP scope that assigns IPs in the 10.0.0.100-200 range.
  • Reserve a block of addresses for your servers so DHCP never gives them away.
Install the DHCP Server role

Before DC01 can hand out IP addresses, it needs the DHCP Server role installed. You will also authorize the DHCP server in Active Directory, which is a security requirement that prevents rogue DHCP servers from disrupting the network.

  • Install the DHCP Server role by running this command in PowerShell (Administrator):
Install-WindowsFeature DHCP -IncludeManagementTools

You should see Success reported as True in the output table.

  • Authorize the DHCP server in Active Directory by running:
Add-DhcpServerInDC -DnsName "DC01.corplab.local" -IPAddress 10.0.0.10

Why authorize DHCP in Active Directory?

Active Directory requires DHCP servers to be explicitly authorized before they can lease addresses. This prevents someone from accidentally (or maliciously) plugging in an unauthorized DHCP server that hands out wrong IP settings to the entire network.

  • Verify the authorization succeeded by running:
Get-DhcpServerInDC

You should see a table listing DC01.corplab.local with IP address 10.0.0.10.

Authorization not showing up?

Make sure you are logged in as CORPLAB\Administrator (the domain admin account), not the local Administrator. Only Enterprise Admins can authorize DHCP servers in AD.

If you see an access denied error, close PowerShell and reopen it as Administrator while logged in with domain credentials.

Help me troubleshoot DHCP authorization in Active Directory.

Create a DHCP scope for the lab network

A DHCP scope defines the pool of IP addresses that the server can hand out, along with the network settings each client receives. You will create a scope covering 10.0.0.100 through 10.0.0.200, giving you 101 addresses for workstations.

  • Create the DHCP scope by running:
Add-DhcpServerv4Scope -Name "CorpLab Network" -StartRange 10.0.0.100 -EndRange 10.0.0.200 -SubnetMask 255.255.255.0 -State Active

What does this scope define?

The scope tells the DHCP server which IP addresses it is allowed to lease. Any device that connects to the CorpLab-Switch and requests an address via DHCP will receive one from the 10.0.0.100-200 range.

Setting -State Active means the scope starts handing out addresses immediately.

  • Configure the scope options so clients know their default gateway and DNS servers. Run these three commands:
Set-DhcpServerv4OptionValue -ScopeId 10.0.0.0 -OptionId 3 -Value 10.0.0.1
Set-DhcpServerv4OptionValue -ScopeId 10.0.0.0 -OptionId 6 -Value 10.0.0.10,10.0.0.11
Set-DhcpServerv4OptionValue -ScopeId 10.0.0.0 -DnsDomain "corplab.local"

What do these options configure?

  • Option 3 (Router/Default Gateway): tells clients to route traffic through 10.0.0.1. In a real enterprise, this would be your router or firewall.
  • Option 6 (DNS Servers): points clients to both DC01 (10.0.0.10) and DC02 (10.0.0.11) for name resolution. Having two DNS servers provides redundancy.
  • DNS Domain: sets the DNS suffix to corplab.local so clients can resolve short names like DC01 without typing the full domain.

Seeing a scope ID error?

The -ScopeId 10.0.0.0 refers to the network ID of your scope, not a specific IP address. Make sure you created the scope in the previous command before running these option commands.

Help me fix DHCP scope option errors on Windows Server 2019.

Create exclusions for static servers

Your servers (DC01, DC02, FILE01) use static IPs in the 10.0.0.1-50 range. You need to tell DHCP to never assign addresses from that range, even though it falls within the 10.0.0.0/24 subnet.

  • Add an exclusion range to reserve addresses for servers by running:
Add-DhcpServerv4ExclusionRange -ScopeId 10.0.0.0 -StartRange 10.0.0.1 -EndRange 10.0.0.50

Why exclude instead of just using a smaller scope?

The scope range (100-200) already avoids your server IPs, so the exclusion is a safety layer. If you ever expand the scope range in the future, the exclusion ensures DHCP never accidentally leases a server address to a workstation. This is standard practice in enterprise environments.

  • Verify the complete DHCP configuration by running these two commands:
Get-DhcpServerv4Scope
Get-DhcpServerv4OptionValue -ScopeId 10.0.0.0

The first command should show your CorpLab Network scope with a range of 10.0.0.100-200 and state Active. The second command should list your configured options including the router (10.0.0.1), DNS servers (10.0.0.10 and 10.0.0.11), and DNS domain (corplab.local).

Scope not showing as Active?

If the scope state shows Inactive, you can activate it manually by running:

Set-DhcpServerv4Scope -ScopeId 10.0.0.0 -State Active

Then run Get-DhcpServerv4Scope again to confirm the state changed.

Help me troubleshoot my DHCP scope configuration.

DHCP is ready to hand out addresses to any workstation that joins the CorpLab-Switch network. Next up, you will install Windows Server on DC02 and promote it as a second domain controller for redundancy.

Deploy DC02 as a Second Domain Controller

Your first Domain Controller is up and running, serving Active Directory, DNS, and DHCP to the corplab.local domain.

In a real enterprise, a single Domain Controller is a critical point of failure. If DC01 goes down, nobody can log in, resolve names, or authenticate. Adding a second DC gives you redundancy through AD replication. Both controllers hold identical copies of the directory, so the domain keeps running even if one fails.

In this step, get ready to:
  • Install Windows Server 2019 on DC02 and configure its static IP.
  • Join DC02 to the domain and promote it as an additional Domain Controller.
  • Verify replication between DC01 and DC02.
Install Windows Server 2019 on DC02 and configure networking

DC02 needs the same base OS as DC01, plus a static IP address that points to DC01 for DNS resolution. This lets DC02 find and join the existing domain.

  • In Hyper-V Manager, right-click DC02 and click Connect.
  • Click Start to boot the VM.
  • When the Windows Setup screen appears, select your language and keyboard, then click Install Now.
  • Choose Windows Server 2019 Standard (Desktop Experience) and click Next.
  • Accept the license terms.
  • Select Custom: Install Windows only (advanced).
  • Select the 40 GB drive and click Next.
  • Wait 10-15 minutes for the installation to complete.
  • When prompted, set the Administrator password to something memorable (for example, P@ssw0rd!2024).

Once logged in as Administrator, you need to rename the server and assign its static IP.

  • Open PowerShell as Administrator and rename the computer by running this command:
Rename-Computer -NewName "DC02" -Restart

What does this command do?

This renames the computer from the random default name to DC02 and immediately restarts the server to apply the change.

  • After the restart, log back in as Administrator and open PowerShell again.
  • Configure the static IP address and DNS client by running these commands:
New-NetIPAddress -InterfaceAlias "Ethernet" -IPAddress 10.0.0.11 -PrefixLength 24
Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses 10.0.0.10

What do these commands do?

The first command assigns the static IP 10.0.0.11 with a /24 subnet mask to DC02's Ethernet adapter.

The second command points DC02's DNS client to DC01 (10.0.0.10). DC02 needs to resolve corplab.local through DC01's DNS before it can join the domain.

  • Test connectivity to DC01 by running:
ping 10.0.0.10

You should see replies from 10.0.0.10, confirming the two VMs can communicate over the CorpLab-Switch private network.

Not getting ping replies?

  • Verify DC01 is still running in Hyper-V Manager.
  • Confirm both DC01 and DC02 are connected to the CorpLab-Switch virtual switch (check VM Settings > Network Adapter on each).
  • On DC02, run Get-NetIPAddress -InterfaceAlias "Ethernet" to confirm 10.0.0.11 is assigned.

Help me troubleshoot why DC02 cannot ping DC01 on my private Hyper-V switch.

Join DC02 to the domain and promote to Domain Controller

With networking confirmed, you can join DC02 to the corplab.local domain and then promote it as a second Domain Controller. This is a two-phase process: domain join first, then AD DS installation and promotion.

  • Join DC02 to the domain by running:
Add-Computer -DomainName "corplab.local" -Credential (Get-Credential) -Restart

What happens when you run this?

A credential dialog will pop up asking for a username and password. Enter CORPLAB\Administrator and the password you set on DC01. The server then joins the domain and restarts.

  • After the restart, log in as CORPLAB\Administrator (not the local Administrator).
  • Install the AD DS role by running:
Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools

What does this command do?

This installs the Active Directory Domain Services binaries and management tools on DC02. The server is not yet a Domain Controller. Promotion happens in the next command.

  • Promote DC02 as an additional Domain Controller by running:
Install-ADDSDomainController -DomainName "corplab.local" -InstallDns:$true -Credential (Get-Credential) -DatabasePath "C:\Windows\NTDS" -SysvolPath "C:\Windows\SYSVOL" -LogPath "C:\Windows\NTDS" -Force:$true

What does this command do?

This promotes DC02 from a regular domain member to a full Domain Controller for corplab.local. It also installs DNS on DC02 so both controllers can resolve domain names.

The -DatabasePath, -SysvolPath, and -LogPath parameters specify where AD stores its database, shared policies (SYSVOL), and transaction logs.

What prompts will you see?

You will be prompted for credentials again. Enter CORPLAB\Administrator and the domain admin password.

You will also be prompted to set a Safe Mode (DSRM) password. This is a recovery password used if you ever need to boot the DC in Directory Services Restore Mode. Use a strong password and remember it.

The server will automatically restart after promotion completes. This takes 3-5 minutes.

Promotion fails with a credential error?

  • Make sure you are entering the full domain credentials: CORPLAB\Administrator (not just "Administrator").
  • Verify DC02 can resolve corplab.local by running nslookup corplab.local before attempting promotion.
  • Confirm DC01 is running and reachable with ping 10.0.0.10.

Help me fix my DC promotion failure.

Verify replication between DC01 and DC02

After DC02 restarts and promotion is complete, you need to confirm that AD replication is working between the two controllers. Successful replication means both DCs hold identical copies of the domain directory.

  • Log in to DC02 as CORPLAB\Administrator.
  • Open PowerShell and verify both Domain Controllers are visible by running:
Get-ADDomainController -Filter *

You should see both DC01 and DC02 listed in the output with their IP addresses and site information.

  • Check the replication status between the two DCs by running:
repadmin /showrepl
repadmin /replsummary

What do these commands show?

The repadmin /showrepl command displays the replication partners and the last time replication succeeded for each directory partition.

The repadmin /replsummary command gives you a quick overview showing how many replication attempts succeeded or failed across all DCs. You want to see zero failures.

  • Finally, confirm that the DNS zone has replicated by switching to DC01 and running:
Get-DnsServerZone

You should see corplab.local listed as an Active Directory-integrated zone. Because it is AD-integrated, the zone data automatically replicates to DC02 as well.

Seeing replication failures?

  • If replication just finished, wait 5 minutes and run repadmin /replsummary again. Initial replication can take a few minutes to complete.
  • Verify both DCs can ping each other (ping 10.0.0.10 from DC02 and ping 10.0.0.11 from DC01).
  • Check that the DNS client on DC02 still points to 10.0.0.10 by running Get-DnsClientServerAddress.

Help me troubleshoot AD replication failures between my two domain controllers.

Your domain now has full redundancy. If DC01 ever goes offline, DC02 can continue authenticating users and resolving DNS queries. Next up, you will deploy FILE01 as a dedicated file server with department shared folders.

Deploy FILE01 as a File Server

Your two domain controllers are replicated and running. Now the network needs a place for users to store and share files.

In this step, you will deploy FILE01 as a dedicated File Server. You will join it to the corplab.local domain and create department-specific shared folders that only the right people can access.

In this step, get ready to:
  • Install Windows Server 2019 on FILE01 and join it to the domain.
  • Install the File Server role and create department folder structures.
  • Create SMB shares with appropriate permissions for each department.
Install Windows Server 2019 on FILE01 and join to domain

FILE01 will serve as the central location for all department file shares. It needs a static IP so other machines can always find it, and it needs to be a member of the domain so it can use Active Directory security groups for access control.

  • In Hyper-V Manager, right-click DC01 and click Connect to open the VM console.
  • Start the FILE01 VM and connect to it.
  • Install Windows Server 2019 Standard (Desktop Experience) following the same process you used for DC01 and DC02.
  • Select language and keyboard, click Install Now.
  • Choose Windows Server 2019 Standard (Desktop Experience).
  • Accept the license, select Custom: Install Windows only, select the 50GB drive, and click Next.
  • Wait for installation to complete (10-15 minutes) and set the Administrator password when prompted.

Once Windows is installed, you need to rename the server and configure its network settings.

  • Log in as Administrator and rename the server by running this command in PowerShell (as Administrator):
Rename-Computer -NewName "FILE01" -Restart

What does this command do?

Rename-Computer changes the Windows computer name and automatically restarts the server so the new name takes effect.

  • After the restart, log back in as Administrator and set the static IP address by running these commands:
New-NetIPAddress -InterfaceAlias "Ethernet" -IPAddress 10.0.0.20 -PrefixLength 24
Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses 10.0.0.10,10.0.0.11

What does this code do?

New-NetIPAddress assigns FILE01 the static IP 10.0.0.20 on the lab network. A static IP ensures other machines and DNS always know where to find the file server.

Set-DnsClientServerAddress points FILE01 to both domain controllers for DNS resolution. This gives redundancy. If DC01 goes down, FILE01 still resolves domain names through DC02.

  • Verify connectivity to DC01 by running:
ping 10.0.0.10

You should see reply packets from 10.0.0.10, confirming FILE01 can reach DC01 across the private switch.

Not getting ping replies?

  • Confirm FILE01 is connected to CorpLab-Switch in its VM Settings > Network Adapter.
  • Run Get-NetIPAddress -InterfaceAlias "Ethernet" to verify the IP is actually assigned.
  • If the interface name is not "Ethernet", run Get-NetAdapter to find the correct adapter name and re-run the IP commands with the right name.

Why can't FILE01 reach DC01 over the private switch?

  • Join FILE01 to the domain by running:
Add-Computer -DomainName "corplab.local" -Credential (Get-Credential) -Restart
  • When the credential prompt appears, enter CORPLAB\Administrator as the username and the Administrator password you set on DC01.
  • The server will restart automatically after joining the domain.
  • After the restart, log in as CORPLAB\Administrator.

Why join the domain?

A domain-joined file server can use Active Directory security groups in its share permissions. This means you control file access centrally from AD instead of managing local accounts on every server.

Domain join failing?

  • Make sure the DNS server addresses are set to 10.0.0.10 and 10.0.0.11. Domain joins depend on DNS to find the domain controller.
  • Verify DC01 is running. The domain join needs an available DC to authenticate against.
  • Double-check the credentials. You need the domain Administrator account, not the local one.

Help me troubleshoot my domain join failure on FILE01.

Install the File Server role and create department folders

The File Server role adds management tools for shared folders. You will also create the folder structure that maps to your company's departments: IT, HR, and Finance.

  • Install the File Server role by running this command in PowerShell (as Administrator):
Install-WindowsFeature -Name FS-FileServer

What does this command do?

Install-WindowsFeature adds the FS-FileServer role to Windows Server. This role is often installed by default with Desktop Experience, but explicitly installing it ensures the full set of file sharing management tools are available.

You should see a success result with Exit Code: NoChangeNeeded (if already present) or Success.

  • Create the department shared folder structure by running these commands:
New-Item -Path "C:\Shares\IT" -ItemType Directory
New-Item -Path "C:\Shares\HR" -ItemType Directory
New-Item -Path "C:\Shares\Finance" -ItemType Directory

What does this code do?

New-Item creates directories on the file system. You are creating a parent C:\Shares folder with three subdirectories, one per department.

Each department folder will become its own network share. Users in IT will only see the IT folder, HR users only the HR folder, and so on.

  • Verify the folders were created by running:
Get-ChildItem C:\Shares

You should see three directories listed: Finance, HR, and IT.

Folder creation failed?

  • Make sure you are running PowerShell as Administrator. Creating folders on the C:\ drive requires elevated permissions.
  • If you see an error about the path already existing, the folder was already created. You can safely continue.

Help me fix folder creation errors on FILE01.

Create SMB shares with appropriate permissions

Now you will turn those folders into network shares that users can access from their workstations. Each share grants full control to Domain Admins and change access to the matching department security group.

  • Create the three department SMB shares by running these commands:
New-SmbShare -Name "IT" -Path "C:\Shares\IT" -FullAccess "CORPLAB\Domain Admins" -ChangeAccess "CORPLAB\IT-Staff"
New-SmbShare -Name "HR" -Path "C:\Shares\HR" -FullAccess "CORPLAB\Domain Admins" -ChangeAccess "CORPLAB\HR-Staff"
New-SmbShare -Name "Finance" -Path "C:\Shares\Finance" -FullAccess "CORPLAB\Domain Admins" -ChangeAccess "CORPLAB\Finance-Staff"

What does this code do?

New-SmbShare creates a network share that other computers can connect to over the network using the SMB protocol.

FullAccess gives Domain Admins complete control over every share. ChangeAccess lets department members read, write, and modify files in their own share but not change permissions or take ownership.

Why do the security groups not exist yet?

The groups IT-Staff, HR-Staff, and Finance-Staff will be created in the next step when you build out the OU structure and user accounts. Windows allows you to reference groups in share permissions before they exist. The permissions will take effect once the groups are created in Active Directory.

  • Verify your shares were created by running:
Get-SmbShare

You should see IT, HR, and Finance listed among the shares (alongside the default administrative shares like C$ and ADMIN$).

Share creation command showing a warning?

  • You may see a warning about the security groups not being found. This is expected because the groups do not exist in AD yet. The shares are still created successfully.
  • If you see an access denied error, make sure you are logged in as CORPLAB\Administrator and running PowerShell as Administrator.

Help me troubleshoot SMB share creation errors on FILE01.

What is the difference between NTFS and share permissions?

Share permissions control access over the network. NTFS permissions control access at the file system level, whether the user connects over the network or logs in locally.

When both are set, the most restrictive permission wins. You will configure NTFS permissions in the next step to lock down folder access at the file system level.

FILE01 is now live on the network with three department shares ready to go. Next up, you will build out the OU structure, create the security groups these shares reference, and add user accounts for each department.

Create OU Structure, Users, and NTFS Permissions

Your domain controllers are running and FILE01 has its shared folders ready. Right now, those shares reference security groups (IT-Staff, HR-Staff, Finance-Staff) that do not exist yet.

In this step, you will build the organizational backbone of your domain. You will create Organizational Units to group resources by department, populate them with security groups and user accounts, and then lock down the file shares with proper NTFS permissions.

In this step, get ready to:
  • Create a department-based OU hierarchy with sub-OUs for Users and Computers.
  • Create security groups and six domain user accounts across IT, HR, and Finance.
  • Configure explicit NTFS permissions on FILE01's department shares.
Create the Organizational Unit hierarchy

Organizational Units are containers inside Active Directory that let you group users, computers, and other objects logically. Microsoft best practice recommends separating Users and Computers into different OUs to simplify Group Policy application later.

  • Switch back to your DC01 PowerShell session (logged in as CORPLAB\Administrator).
  • Create the full OU structure by running these commands:
# Top-level department OUs
New-ADOrganizationalUnit -Name "IT" -Path "DC=corplab,DC=local"
New-ADOrganizationalUnit -Name "HR" -Path "DC=corplab,DC=local"
New-ADOrganizationalUnit -Name "Finance" -Path "DC=corplab,DC=local"

# Sub-OUs for Users and Computers in each department
New-ADOrganizationalUnit -Name "Users" -Path "OU=IT,DC=corplab,DC=local"
New-ADOrganizationalUnit -Name "Computers" -Path "OU=IT,DC=corplab,DC=local"
New-ADOrganizationalUnit -Name "Users" -Path "OU=HR,DC=corplab,DC=local"
New-ADOrganizationalUnit -Name "Computers" -Path "OU=HR,DC=corplab,DC=local"
New-ADOrganizationalUnit -Name "Users" -Path "OU=Finance,DC=corplab,DC=local"
New-ADOrganizationalUnit -Name "Computers" -Path "OU=Finance,DC=corplab,DC=local"

# Servers OU
New-ADOrganizationalUnit -Name "Servers" -Path "DC=corplab,DC=local"

What does this code do?

Each New-ADOrganizationalUnit command creates one OU container in your domain. The -Path parameter specifies where the OU lives in the directory tree.

You are creating three department OUs (IT, HR, Finance) at the top level, then nesting Users and Computers sub-OUs inside each. The Servers OU will hold your member server computer accounts later.

  • Verify the OU structure was created by running:
Get-ADOrganizationalUnit -Filter 'Name -like "*"' | Format-Table Name, DistinguishedName -A

You should see all 10 OUs listed (Domain Controllers plus your 9 new OUs: IT, HR, Finance, Servers, and the six sub-OUs).

Not seeing your OUs?

  • Make sure you ran each command in a PowerShell session on DC01 as CORPLAB\Administrator.
  • Check for typos in the -Path values. The distinguished name must match DC=corplab,DC=local exactly (case-insensitive, but comma placement matters).
  • If you see an error about a duplicate object, the OU already exists from a previous attempt. You can safely continue.

Help me troubleshoot my OU creation commands in Active Directory.

Create security groups and user accounts

Security groups are how you assign permissions to multiple users at once. Instead of granting access to individual users on every share, you add users to a group and grant the group access.

  • Create the three department security groups by running:
# Department security groups
New-ADGroup -Name "IT-Staff" -GroupScope Global -GroupCategory Security -Path "OU=IT,DC=corplab,DC=local"
New-ADGroup -Name "HR-Staff" -GroupScope Global -GroupCategory Security -Path "OU=HR,DC=corplab,DC=local"
New-ADGroup -Name "Finance-Staff" -GroupScope Global -GroupCategory Security -Path "OU=Finance,DC=corplab,DC=local"

What does this code do?

Each New-ADGroup command creates a Global Security group inside the corresponding department OU. Global scope means the group can be used across the domain, and Security category means it can be assigned permissions on resources.

  • Create the six user accounts (two per department) and add them to their department groups by running:
# IT Users
New-ADUser -Name "Ahmed Ali" -SamAccountName "a.ali" -UserPrincipalName "a.ali@corplab.local" -Path "OU=Users,OU=IT,DC=corplab,DC=local" -AccountPassword (ConvertTo-SecureString "Welcome1!" -AsPlainText -Force) -Enabled $true
New-ADUser -Name "Sara Khan" -SamAccountName "s.khan" -UserPrincipalName "s.khan@corplab.local" -Path "OU=Users,OU=IT,DC=corplab,DC=local" -AccountPassword (ConvertTo-SecureString "Welcome1!" -AsPlainText -Force) -Enabled $true
Add-ADGroupMember -Identity "IT-Staff" -Members "a.ali","s.khan"

# HR Users
New-ADUser -Name "John Smith" -SamAccountName "j.smith" -UserPrincipalName "j.smith@corplab.local" -Path "OU=Users,OU=HR,DC=corplab,DC=local" -AccountPassword (ConvertTo-SecureString "Welcome1!" -AsPlainText -Force) -Enabled $true
New-ADUser -Name "Maria Garcia" -SamAccountName "m.garcia" -UserPrincipalName "m.garcia@corplab.local" -Path "OU=Users,OU=HR,DC=corplab,DC=local" -AccountPassword (ConvertTo-SecureString "Welcome1!" -AsPlainText -Force) -Enabled $true
Add-ADGroupMember -Identity "HR-Staff" -Members "j.smith","m.garcia"

# Finance Users
New-ADUser -Name "David Lee" -SamAccountName "d.lee" -UserPrincipalName "d.lee@corplab.local" -Path "OU=Users,OU=Finance,DC=corplab,DC=local" -AccountPassword (ConvertTo-SecureString "Welcome1!" -AsPlainText -Force) -Enabled $true
New-ADUser -Name "Lisa Chen" -SamAccountName "l.chen" -UserPrincipalName "l.chen@corplab.local" -Path "OU=Users,OU=Finance,DC=corplab,DC=local" -AccountPassword (ConvertTo-SecureString "Welcome1!" -AsPlainText -Force) -Enabled $true
Add-ADGroupMember -Identity "Finance-Staff" -Members "d.lee","l.chen"

What does this code do?

Each New-ADUser command creates a domain account in the appropriate department Users sub-OU. The -AccountPassword parameter sets an initial password, and -Enabled $true activates the account immediately.

The Add-ADGroupMember commands add each pair of users to their department security group. This is what connects users to the file share permissions you configured earlier on FILE01.

  • Verify users and group membership by running:
Get-ADUser -Filter * -SearchBase "DC=corplab,DC=local" | Format-Table Name, SamAccountName, DistinguishedName -A

You should see all six user accounts listed with their correct OU paths.

  • Open Active Directory Users and Computers from Server Manager > Tools to visually confirm your OU tree with the users and groups inside each department.

Getting an error about password not meeting requirements?

The default domain password policy requires complexity. The password Welcome1! satisfies this (uppercase, lowercase, number, special character). If you changed the password in your command, make sure it has at least one character from three of the four categories: uppercase, lowercase, digit, special character.

Help me fix password complexity errors when creating AD users.

Configure NTFS permissions on FILE01 department shares

Your shares already have share-level permissions, but share permissions only control access over the network. NTFS permissions control access at the file system level regardless of how users connect.

Why set NTFS permissions separately from share permissions?

When both NTFS and share permissions apply, the most restrictive permission wins. Best practice is to set share permissions broadly and control actual access through NTFS permissions on the folder. This gives you fine-grained control at the file system layer.

  • Switch to your FILE01 VM (logged in as CORPLAB\Administrator).
  • Open PowerShell as Administrator.
  • Set the NTFS permissions for the IT share by running:
# Remove inherited permissions and set explicit ones
$acl = Get-Acl "C:\Shares\IT"
$acl.SetAccessRuleProtection($true, $false)
$acl.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule("CORPLAB\Domain Admins","FullControl","ContainerInherit,ObjectInherit","None","Allow")))
$acl.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule("CORPLAB\IT-Staff","Modify","ContainerInherit,ObjectInherit","None","Allow")))
$acl.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule("BUILTIN\Administrators","FullControl","ContainerInherit,ObjectInherit","None","Allow")))
$acl.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule("NT AUTHORITY\SYSTEM","FullControl","ContainerInherit,ObjectInherit","None","Allow")))
Set-Acl "C:\Shares\IT" $acl

What does this code do?

  • Get-Acl retrieves the current access control list for the folder.
  • SetAccessRuleProtection($true, $false) disables inheritance and removes all inherited entries. This gives you a clean slate.
  • Each AddAccessRule line grants a specific identity a permission level. The ContainerInherit,ObjectInherit flags ensure the permission flows to subfolders and files.
  • Set-Acl writes the modified ACL back to the folder.
  • Repeat the same pattern for the HR share by running:
# HR share permissions
$acl = Get-Acl "C:\Shares\HR"
$acl.SetAccessRuleProtection($true, $false)
$acl.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule("CORPLAB\Domain Admins","FullControl","ContainerInherit,ObjectInherit","None","Allow")))
$acl.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule("CORPLAB\HR-Staff","Modify","ContainerInherit,ObjectInherit","None","Allow")))
$acl.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule("BUILTIN\Administrators","FullControl","ContainerInherit,ObjectInherit","None","Allow")))
$acl.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule("NT AUTHORITY\SYSTEM","FullControl","ContainerInherit,ObjectInherit","None","Allow")))
Set-Acl "C:\Shares\HR" $acl
  • Set permissions for the Finance share by running:
# Finance share permissions
$acl = Get-Acl "C:\Shares\Finance"
$acl.SetAccessRuleProtection($true, $false)
$acl.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule("CORPLAB\Domain Admins","FullControl","ContainerInherit,ObjectInherit","None","Allow")))
$acl.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule("CORPLAB\Finance-Staff","Modify","ContainerInherit,ObjectInherit","None","Allow")))
$acl.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule("BUILTIN\Administrators","FullControl","ContainerInherit,ObjectInherit","None","Allow")))
$acl.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule("NT AUTHORITY\SYSTEM","FullControl","ContainerInherit,ObjectInherit","None","Allow")))
Set-Acl "C:\Shares\Finance" $acl

What is the pattern across all three shares?

Each department share follows the same structure: Domain Admins get FullControl for management, the department group (IT-Staff, HR-Staff, or Finance-Staff) gets Modify so they can create and edit files, and SYSTEM plus local Administrators get FullControl for the operating system to function.

No other groups or users have access. An HR user trying to open the IT share will be denied at the NTFS level even if they could somehow reach it over the network.

  • Verify the NTFS permissions on the IT share by running:
Get-Acl "C:\Shares\IT" | Format-List

You should see four Access entries listed: CORPLAB\Domain Admins, CORPLAB\IT-Staff, BUILTIN\Administrators, and NT AUTHORITY\SYSTEM. No inherited permissions should appear.

Still seeing inherited permissions?

  • Make sure the SetAccessRuleProtection($true, $false) line uses $false as the second parameter. The first $true enables protection (blocks inheritance), and the second $false removes existing inherited entries.
  • If the IT-Staff group is not resolving, wait a minute for AD replication from DC01 to DC02 to complete, then try again.

Help me troubleshoot NTFS permissions not applying correctly on my file server.

Your domain now has a complete organizational structure with users, groups, and properly secured file shares. Next up, you will create Group Policy Objects that enforce password rules, map department drives, and restrict desktops.

Configure Group Policy Objects

Your domain infrastructure is running, your OU structure is built, and your file shares are locked down with proper permissions. Now it is time to put Group Policy to work.

Group Policy Objects (GPOs) let you control security settings, map network drives, and restrict desktop features across your entire domain from a single console. In this step, you will create three GPOs that enforce a password policy, automatically map department drives, and lock down the desktop for non-IT staff.

In this step, get ready to:
  • Create a Domain Password Policy GPO with minimum length, complexity, and maximum age settings.
  • Create a Department Drive Maps GPO using Group Policy Preferences with item-level targeting per security group.
  • Create a Desktop Restrictions GPO linked to HR and Finance OUs.
Create a Domain Password Policy GPO

Password policies are the first line of defence in any enterprise environment. You will create a GPO that enforces minimum password standards across the entire domain.

  • On DC01, open Group Policy Management by clicking Server Manager > Tools > Group Policy Management.
  • In the console tree, expand Forest: corplab.local > Domains > corplab.local.
  • Right-click corplab.local and select Create a GPO in this domain, and Link it here.
  • In the Name field, type Domain Password Policy and click OK.
  • Right-click the new Domain Password Policy GPO and select Edit.
  • In the Group Policy Management Editor, navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Password Policy.
  • Double-click Minimum password length, check Define this policy setting, set the value to 8 characters, and click OK.
  • Double-click Password must meet complexity requirements, check Define this policy setting, select Enabled, and click OK.
  • Double-click Maximum password age, check Define this policy setting, set the value to 90 days, and click OK.
  • Close the Group Policy Management Editor.

Why link the password policy to the domain?

Password policies in Active Directory only take effect when linked at the domain level. Linking a password policy GPO to an OU has no effect on account lockout or password settings. The domain is the only valid scope for these account policies.

What is GPO processing order?

GPOs are processed in this order: Local, Site, Domain, then OU. Settings from GPOs linked to OUs override those linked to the domain when there is a conflict. This is why your Desktop Restrictions GPO (linked to specific OUs later) will not interfere with the domain-wide password policy.

Create a Drive Mapping GPO using Group Policy Preferences

Instead of writing login scripts, you can use Group Policy Preferences to map network drives automatically. Item-level targeting lets you assign different drives to different security groups within a single GPO.

  • Back in the Group Policy Management console, right-click corplab.local and select Create a GPO in this domain, and Link it here.
  • Name it Department Drive Maps and click OK.
  • Right-click Department Drive Maps and select Edit.
  • Navigate to User Configuration > Preferences > Windows Settings > Drive Maps.
  • Right-click in the right pane, select New > Mapped Drive.

You will now configure the first drive map for the IT department.

  • In the New Drive Properties dialog, set Action to Create.
  • In the Location field, type \\FILE01\IT.
  • Set Drive Letter to S:.
  • In the Label as field, type IT Department.
  • Click the Common tab.
  • Check Item-level targeting and click the Targeting button.
  • In the Targeting Editor, click New Item > Security Group.
  • Click the ... (browse) button next to the Group field.
  • Type IT-Staff in the object name field, click Check Names, then click OK.
  • Click OK to close the Targeting Editor, then click OK to save the drive map.

Always use Browse for group selection

When adding security groups to item-level targeting, always use the Browse button to select the group. This resolves the group name to its Security Identifier (SID). Typing the name manually does not resolve the SID, which can cause targeting to fail silently.

Now repeat this process for the HR and Finance departments.

  • Create a second Mapped Drive: Action Create, Location \\FILE01\HR, Drive Letter T:, Label HR Department.
  • On the Common tab, enable Item-level targeting, add a Security Group targeting item, and browse for HR-Staff.
  • Create a third Mapped Drive: Action Create, Location \\FILE01\Finance, Drive Letter U:, Label Finance Department.
  • On the Common tab, enable Item-level targeting, add a Security Group targeting item, and browse for Finance-Staff.
  • Close the Group Policy Management Editor.

What does item-level targeting do?

Item-level targeting filters individual preference items within a single GPO so each one applies only to the users or computers you specify. The drive map for S: only appears for IT-Staff members, T: only for HR-Staff, and U: only for Finance-Staff.

This keeps all your drive mappings in one GPO instead of creating three separate policies. It is cleaner to manage and easier to audit.

Create a Desktop Restrictions GPO for non-IT users

In a real enterprise environment, you restrict what non-technical users can access to reduce support tickets and prevent accidental system changes. This GPO removes the Recycle Bin, blocks the command prompt, and hides Control Panel for HR and Finance users only.

  • Back in the Group Policy Management console, right-click the HR OU (under corplab.local) and select Create a GPO in this domain, and Link it here.
  • Name it Desktop Restrictions and click OK.
  • Right-click the Finance OU and select Link an Existing GPO.
  • Select Desktop Restrictions from the list and click OK.

Why link to OUs instead of the domain?

By linking this GPO to the HR and Finance OUs only, IT staff in the IT OU are unaffected. GPOs linked at the OU level apply only to users and computers within that OU. This is why you designed separate department OUs earlier.

Now configure the restriction settings inside the GPO.

  • Right-click the Desktop Restrictions GPO (under the HR OU) and select Edit.
  • Navigate to User Configuration > Policies > Administrative Templates > Desktop.
  • Double-click Remove Recycle Bin icon from desktop, select Enabled, and click OK.
  • Navigate to User Configuration > Policies > Administrative Templates > System.
  • Double-click Prevent access to the command prompt, select Enabled, and click OK.
  • Navigate to User Configuration > Policies > Administrative Templates > Control Panel.
  • Double-click Prohibit access to Control Panel and PC settings, select Enabled, and click OK.
  • Close the Group Policy Management Editor.

Verify that your three GPOs are visible in the Group Policy Management console.

  • In the Group Policy Management console, expand Group Policy Objects under corplab.local.
  • Confirm you see Domain Password Policy, Department Drive Maps, and Desktop Restrictions listed.
  • Click corplab.local and check the Linked Group Policy Objects tab to confirm Domain Password Policy and Department Drive Maps are linked there.
  • Click the HR OU and check the Linked Group Policy Objects tab to confirm Desktop Restrictions is linked.
  • Click the Finance OU and confirm Desktop Restrictions is also linked there.

Don't see your GPOs listed?

If a GPO does not appear under Group Policy Objects, make sure you created it in the corplab.local domain and not in a different container. Right-click Group Policy Objects and press F5 to refresh the view.

If a GPO is listed but not linked, right-click the target domain or OU, select Link an Existing GPO, and choose the GPO from the list.

Help me troubleshoot my GPOs not appearing in Group Policy Management

All three GPOs are configured and linked. Next up, you will install Windows 11 on CLIENT01, join it to the domain, and test that all your policies actually work on a real workstation.

Join CLIENT01 to the Domain and Test Everything

Your server-side infrastructure is fully built. You have redundant domain controllers, centralized DHCP, a file server with department shares, and three Group Policy Objects controlling security and user experience.

Now it is time to prove that everything works from the perspective of an actual end user. You will install Windows 11 on CLIENT01, join it to the corplab.local domain, and log in as different department users to verify that GPOs, drive mappings, and file share permissions all behave correctly.

In this step, get ready to:
  • Install Windows 11 Enterprise on CLIENT01 and join it to the domain.
  • Test Group Policy application by logging in as HR and IT users.
  • Verify the complete infrastructure including DHCP leases, AD replication, and file share permissions.
Install Windows 11 and join to the domain

CLIENT01 simulates an employee workstation. Once it is domain-joined, it receives Group Policy settings automatically. This is how real enterprises manage thousands of machines from a central console.

  • In Hyper-V Manager, right-click CLIENT01 and click Connect.
  • Click Start to power on the VM.
  • Press any key when prompted to boot from the Windows 11 Enterprise ISO.
  • Select your language and keyboard layout, then click Install Now.
  • Choose Windows 11 Enterprise as the edition.
  • Accept the license terms.
  • Select Custom: Install Windows only.
  • Select the 60 GB drive and click Next.
  • Wait 10-15 minutes for the installation to complete.
  • Complete the initial setup wizard (region, keyboard, local account creation). Create a local administrator account with a memorable password.

Skip the Microsoft account requirement

If Windows 11 asks you to sign in with a Microsoft account during setup, choose Domain join instead or Sign-in options to create a local account. You will join the domain properly in the next steps.

Now verify that CLIENT01 received an IP address from DHCP and that DNS is configured correctly.

  • Open PowerShell on CLIENT01 (press the Windows key, type PowerShell, and press Enter).
  • Verify your network configuration by running:
ipconfig /all

What should I see?

You should see an IPv4 address in the 10.0.0.100-10.0.0.200 range (assigned by DHCP). The DNS servers should show 10.0.0.10 and 10.0.0.11 (your domain controllers).

Not seeing an IP address from DHCP?

If CLIENT01 shows a 169.254.x.x address (APIPA), the VM cannot reach the DHCP server. Make sure CLIENT01 is connected to CorpLab-Switch in its VM settings. Also confirm DC01 is powered on and the DHCP service is running.

If DHCP is not assigning DNS automatically, you can set DNS manually by running:

Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses 10.0.0.10,10.0.0.11

help me troubleshoot DHCP on CLIENT01

With networking confirmed, join CLIENT01 to the Active Directory domain.

  • On CLIENT01, open PowerShell as Administrator (right-click the Start button, select Terminal (Admin)).
  • Join CLIENT01 to the domain by running:
Add-Computer -DomainName "corplab.local" -Credential (Get-Credential) -Restart
  • When the credential prompt appears, enter CORPLAB\Administrator as the username and the Administrator password you set on DC01.
  • CLIENT01 will automatically restart after joining the domain.

What does this command do?

Add-Computer creates a computer account in Active Directory and configures CLIENT01 to authenticate against your domain controllers. After the restart, CLIENT01 can receive Group Policy Objects and domain users can log in.

Getting a 'domain could not be contacted' error?

This usually means DNS is not pointing to your domain controller. Run nslookup corplab.local to test. If it fails, set DNS manually to 10.0.0.10 and try the domain join again.

help me join CLIENT01 to the domain

Test GPO application with different users

The real test of your Group Policy configuration is whether different department users experience different restrictions. An HR user should have a locked-down desktop, while an IT user should have full access.

  • After CLIENT01 restarts, click Other user on the login screen.
  • Log in as CORPLAB\j.smith with the password Welcome1! (this is John Smith, an HR user).

First login takes a while

The first domain login on a new machine creates a local user profile. This can take a few minutes as Windows applies Group Policy settings, creates the profile folder, and maps drives.

Now verify that the Desktop Restrictions GPO and Drive Mapping GPO are working for this HR user.

  • Open File Explorer (press Windows+E) and check that drive T: (HR Department) appears under This PC.
  • Check that the Recycle Bin icon is gone from the desktop.
  • Try opening Command Prompt (press the Windows key, type cmd, press Enter). You should see a message that command prompt access has been disabled.
  • Try opening Control Panel (press the Windows key and type Control Panel). Access should be blocked.
  • Confirm which GPOs were applied by opening PowerShell and running:
gpresult /r

What should I see in gpresult?

Under Applied Group Policy Objects, you should see Desktop Restrictions and Department Drive Maps listed. This confirms the GPOs linked to the HR OU are being applied to j.smith.

Now test that IT users are not restricted by the Desktop Restrictions GPO.

  • Sign out of j.smith (click the Start menu, click the user icon, then Sign out).
  • Log in as CORPLAB\a.ali with the password Welcome1! (this is Ahmed Ali, an IT user).
  • Open File Explorer and verify that drive S: (IT Department) appears.
  • Verify that Command Prompt opens normally (press the Windows key, type cmd, press Enter).
  • Verify that Control Panel opens normally.

Why does a.ali have full access?

The Desktop Restrictions GPO is linked only to the HR and Finance OUs. Since a.ali's account lives in the IT OU, that GPO never applies to this user. This demonstrates how OU-based GPO linking gives you granular control over which users receive which policies.

GPO restrictions not applying to j.smith?

If j.smith still has access to Command Prompt or Control Panel, the GPO may not have applied yet. Run gpupdate /force in PowerShell, then sign out and sign back in. Also confirm in Active Directory Users and Computers on DC01 that j.smith is in the OU=Users,OU=HR path.

help me troubleshoot GPO not applying

Verify the complete infrastructure

The final check confirms that all your infrastructure services are working together. You will verify DHCP leases, AD replication, and file share access controls.

  • Switch to the DC01 VM window in Hyper-V Manager.
  • Open PowerShell as Administrator on DC01.
  • Verify that CLIENT01 received a DHCP lease by running:
Get-DhcpServerv4Lease -ScopeId 10.0.0.0

What should I see?

You should see CLIENT01 listed with an IP in the 10.0.0.100-10.0.0.200 range, a lease status of Active, and the hostname CLIENT01.

  • Verify that AD replication between DC01 and DC02 is healthy by running:
repadmin /replsummary

What does this tell me?

You should see both DC01 and DC02 listed with zero failures. This confirms that your redundant domain controllers are synchronizing the Active Directory database correctly. If one DC goes down, the other can serve all authentication requests.

Now test file share permissions from CLIENT01 to confirm that department isolation is working.

  • Switch back to the CLIENT01 VM (logged in as CORPLAB\j.smith). If you are still logged in as a.ali, sign out and log in as j.smith.
  • Open File Explorer and type \\FILE01\HR in the address bar. Press Enter.
  • The HR share should open successfully because j.smith is a member of the HR-Staff group.
  • Now type \\FILE01\IT in the address bar and press Enter.
  • Access should be denied. This proves your NTFS and share permissions are correctly restricting cross-department access.

Why was access denied?

The IT share grants Change access only to the IT-Staff security group. j.smith belongs to HR-Staff, not IT-Staff. Windows evaluates both the share permissions and the NTFS permissions, and the most restrictive result wins.

Finally, take screenshots to document your completed lab.

  • On DC01, open Active Directory Users and Computers from Server Manager > Tools. Expand the corplab.local domain to show your OU structure. Take a screenshot.
  • Open the DHCP console from Server Manager > Tools. Expand Address Leases to show CLIENT01's lease. Take a screenshot.
  • Open Group Policy Management from Server Manager > Tools. Expand the domain to show your three GPOs. Take a screenshot.
  • On CLIENT01 (logged in as any domain user), open File Explorer and navigate to This PC to show the mapped network drive. Take a screenshot.

File share access not working as expected?

If j.smith cannot access \\FILE01\HR, check that j.smith is a member of the HR-Staff group on DC01. Run Get-ADGroupMember HR-Staff to verify. If the group membership was added recently, sign out and back in on CLIENT01 to refresh the Kerberos ticket.

help me troubleshoot file share permissions

Secret mission

Implement an Advanced Security Baseline GPO

Build an enterprise security baseline that restricts USB storage devices and configures Windows Firewall rules across all domain computers. This is what separates a junior admin from a systems engineer who can harden an environment against real threats.

Clean Up Your Resources

Clean Up Your Resources

This project runs entirely on your local machine using Hyper-V. There are no ongoing cloud costs.

However, the four VMs consume approximately 16 GB of RAM while running and over 150 GB of disk space. Decide whether to keep your VMs running, shut them down to free memory, or delete everything entirely.

Resources you used:

  • DC01 VM (Windows Server 2019, 40 GB disk).
  • DC02 VM (Windows Server 2019, 40 GB disk).
  • FILE01 VM (Windows Server 2019, 50 GB disk).
  • CLIENT01 VM (Windows 11 Enterprise, 60 GB disk).
  • CorpLab-Switch (Private virtual switch).

Keep everything running

No action needed. Choose this if you are still actively building or experimenting with your lab environment.

  • All four VMs remain on disk and can be started from Hyper-V Manager at any time.
  • The CorpLab-Switch stays configured.
  • Hyper-V remains enabled on your laptop.

Pause - I'll come back to this later

Shut down all running VMs to free up RAM. Your virtual hard disks and VM configurations stay on disk so you can start them again later.

  • Open PowerShell as Administrator on your host machine.
  • Shut down all lab VMs by running the following commands:
Stop-VM -Name "DC01"
Stop-VM -Name "DC02"
Stop-VM -Name "FILE01"
Stop-VM -Name "CLIENT01"
  • Once all VMs show a state of Off in Hyper-V Manager, they are no longer consuming RAM.
  • To resume later, open Hyper-V Manager and start DC01 first (it hosts DHCP and primary DNS), then DC02, FILE01, and CLIENT01 in that order.

Delete - I don't want to use this again

Remove all VMs, their virtual hard disks, and the virtual switch. This frees up all disk space used by the lab.

  • Open PowerShell as Administrator on your host machine.
  • Stop all running VMs first:
Stop-VM -Name "DC01" -TurnOff
Stop-VM -Name "DC02" -TurnOff
Stop-VM -Name "FILE01" -TurnOff
Stop-VM -Name "CLIENT01" -TurnOff
  • Remove all four VMs from Hyper-V (this deletes VM configurations but not the virtual hard disks):
Remove-VM -Name "DC01" -Force
Remove-VM -Name "DC02" -Force
Remove-VM -Name "FILE01" -Force
Remove-VM -Name "CLIENT01" -Force
  • Delete the virtual hard disk files. To find where they are stored, open Hyper-V Manager, click Hyper-V Settings in the Actions pane, and check the Virtual Hard Disks default location. Navigate to that folder and delete the .vhdx files for DC01, DC02, FILE01, and CLIENT01.
  • Remove the virtual switch:
Remove-VMSwitch -Name "CorpLab-Switch" -Force
  • You can also delete the Windows Server 2019 and Windows 11 Enterprise ISO files from your Downloads folder if you no longer need them.
  • Hyper-V itself remains enabled as a Windows feature. If you want to disable it to reclaim the hypervisor overhead, run the following command and restart your computer:
Disable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V-All

Why not disable Hyper-V?

Hyper-V is a built-in Windows feature, not a standalone application. Disabling it is optional and requires a restart.

If you plan to use virtual machines again in the future, leaving Hyper-V enabled saves you setup time later.

Nice Work!

Nice Work!

You just built a complete enterprise Windows Server environment from scratch. This lab demonstrates the exact skills listed in systems engineer job postings: Active Directory, DNS, DHCP, GPO management, file server administration, and security hardening.

You've learned how to:

  • Deploy redundant Domain Controllers (DC01 + DC02) with AD DS replication, centralized DNS, and DHCP for automatic IP assignment across a private virtual network.
  • Build a File Server with department-isolated SMB shares secured by layered NTFS and share permissions, following the principle that the most restrictive permission wins.
  • Design an Organizational Unit structure with department-based users and computers, then enforce security and user experience through layered Group Policy Objects (password policy, drive mapping, and desktop restrictions scoped per department).
  • Secret Mission: Implement an advanced security baseline GPO that restricts USB storage devices, configures Windows Firewall inbound rules, and enables audit logging across all domain computers.

Ready to quiz yourself?