Build an Active Directory Domain Controller

Set up a Windows Server 2025 VM as a Domain Controller with OUs, users, and GPOs.

Introduction

30 Second Summary

Every time you log in to a work computer, access a shared drive, or get blocked from changing a system setting, there is a good chance Active Directory is running the show behind the scenes. It is the backbone of identity and access management in almost every enterprise Windows environment.

In this project, you will build your own Active Directory lab from scratch. You will set up a Windows Server 2025 virtual machine, promote it to a Domain Controller, create a realistic corporate structure with users, groups, and security policies, and verify everything with PowerShell.

What You'll Build

You will build a complete Active Directory Domain Services lab environment that simulates a small company's IT infrastructure, running on a VirtualBox VM on your Linux machine.

By the end of this project, you'll have:

  • A Windows Server 2025 VM running as the Domain Controller for the corp.local domain.
  • A department-based Organizational Unit hierarchy with user accounts and security groups managed through both the GUI and PowerShell.
  • Two Group Policy Objects that enforce a domain-wide password policy and a desktop restriction policy for a specific department.
  • Secret Mission: Write a PowerShell script that bulk-creates 50 users from a CSV file.

Are there any prerequisites?

No prior Windows Server or Active Directory experience is needed. This guide walks you through every step from installation to verification.

You will need a Linux machine (this project uses Pop!_OS) with at least 8 GB of RAM. The project allocates 4 GB to the virtual machine, so 8 GB total keeps both your host and the VM running smoothly.

Before We Start

Before We Start...

Install VirtualBox and Download Windows Server 2025

Every Active Directory environment starts with a server. Since your machine runs Pop!_OS (Linux), you need a way to run Windows Server alongside it without dual-booting.

In this step, you'll install VirtualBox to create virtual machines on your Linux desktop. You'll then download a free evaluation copy of Windows Server 2025 and build a VM named DC01.

In this step, get ready to:
  • Install VirtualBox 7.1 on Pop!_OS.
  • Download the Windows Server 2025 Evaluation ISO.
  • Create and configure a VM named DC01 with Windows Server installed.
Install VirtualBox on Pop!_OS

VirtualBox is a free, open-source hypervisor that lets you run a guest operating system inside a window on your existing machine. Pop!_OS is based on Ubuntu, so you'll use Ubuntu's package manager to install it.

  • Open a terminal by pressing the Super key to open the Pop!_OS launcher.
  • Type Terminal and press Enter to open it.

Pop!_OS is based on a specific Ubuntu release. You need to know which one so you can add the correct VirtualBox repository.

  • Check your Ubuntu codename by running this command:
grep 'UBUNTU_CODENAME' /etc/os-release

You should see either jammy (Pop!_OS 22.04) or noble (Pop!_OS 24.04). Note this value down.

  • Download and import the Oracle GPG signing key by running this command:
wget -O- https://www.virtualbox.org/download/oracle_vbox_2016.asc | sudo gpg --yes --output /usr/share/keyrings/oracle-virtualbox-2016.gpg --dearmor

What does this command do?

This downloads Oracle's public signing key and stores it in a format your package manager can use. The key lets your system verify that VirtualBox packages are genuinely from Oracle and haven't been tampered with.

Your terminal will ask for your sudo password. This is normal for any command that modifies system files.

  • Add the VirtualBox repository to your system by running this command:
echo "deb [arch=amd64 signed-by=/usr/share/keyrings/oracle-virtualbox-2016.gpg] https://download.virtualbox.org/virtualbox/debian [[UBUNTU_CODENAME="your Ubuntu codename (jammy or noble)"]] contrib" | sudo tee /etc/apt/sources.list.d/virtualbox.list

What does this command do?

This tells your package manager where to find VirtualBox packages. Replace the highlighted placeholder with the codename you noted earlier (jammy or noble).

  • Verify the repository file was created by running:
cat /etc/apt/sources.list.d/virtualbox.list

You should see the deb line you just added, with your codename in place of the placeholder.

  • Install VirtualBox 7.1 by running these commands:
sudo apt-get update
sudo apt-get install virtualbox-7.1

The installer will ask you to confirm by typing Y and pressing Enter. This may take a few minutes.

What does this command do?

The first command refreshes your package index so it includes the new VirtualBox repository. The second command downloads and installs VirtualBox 7.1 along with its dependencies.

During installation, VirtualBox compiles kernel modules for your running Linux kernel. These modules let VirtualBox interact with your hardware for virtualization.

  • Verify VirtualBox is installed by running:
virtualbox --help

You should see VirtualBox help text printed in your terminal.

Seeing a Secure Boot error or module loading failure?

If VirtualBox fails to load kernel modules, Secure Boot may be blocking unsigned modules. Check your Secure Boot status by running:

mokutil --sb-state

If it says SecureBoot enabled, the simplest fix for a lab environment is to disable Secure Boot in your BIOS settings. Reboot your machine, enter BIOS (usually by pressing F2 or Del during boot), find the Secure Boot option, disable it, save, and reboot.

After disabling Secure Boot, run sudo rcvboxdrv setup to rebuild the kernel modules, then try virtualbox --help again.

Help me troubleshoot VirtualBox kernel module loading on Pop!_OS with Secure Boot.

Download the Windows Server 2025 evaluation ISO

Microsoft provides a free 180-day evaluation of Windows Server 2025. This gives you a fully functional server OS to build your lab without spending anything.

  • Open this link in your browser: Microsoft Evaluation Center - Windows Server 2025.
  • Sign in with a Microsoft account. If you don't have one, create a free account when prompted.
  • Fill in the registration form with your details.
  • Select 64-bit edition as the download type.
  • Choose English as the language.
  • Click Download to start the ISO download.

The ISO file is approximately 5 GB. This download may take a while depending on your internet connection.

What about the evaluation period?

The evaluation is free for 180 days. You must activate it over the internet within 10 days of installation. For a learning lab, 180 days is more than enough time.

Create the Windows Server 2025 VM in VirtualBox

With VirtualBox installed and the ISO downloaded, you can now create a virtual machine that will become your Domain Controller.

  • Open VirtualBox by pressing the Super key, typing VirtualBox, and pressing Enter.
  • Click New in the VirtualBox Manager toolbar to start the Create Virtual Machine wizard.

Switch to Expert mode

If VirtualBox opens in Basic (guided) mode, click Expert at the top of the VirtualBox Manager window. Expert mode shows all settings on a single page, which makes configuration faster.

On the Name and Operating System page of the wizard:

  • Enter DC01 in the Name field.
  • Set Type to Microsoft Windows.
  • Set Version to Windows 2025 (64-bit).
  • Check Skip Unattended Installation so you can walk through the installer manually.

On the Hardware page:

  • Set Base Memory to 4096 MB (4 GB).
  • Set Processors to 2.

On the Virtual Hard Disk page:

  • Select Create a Virtual Hard Disk Now.
  • Set the disk size to 50 GB. The disk is dynamically allocated by default, so it only uses space on your real drive as the VM fills it.
  • Click Finish to create the VM.

Your DC01 VM now appears in the VirtualBox Manager list. Before starting it, you need to attach the Windows Server ISO and confirm the network settings.

  • Select the DC01 VM in the list and click Settings.
  • Go to Storage in the left sidebar.
  • Under Controller: IDE, click the empty disc icon (it says Empty).
  • On the right side, click the small disc icon next to Optical Drive and select Choose a disk file.
  • Browse to your Downloads folder and select the Windows Server 2025 ISO file you downloaded earlier.
  • Go to Network in the left sidebar.
  • Confirm that Adapter 1 is set to NAT. This is the default, so it should already be selected.

What is NAT networking?

NAT (Network Address Translation) lets your VM access the internet through your host machine's connection. This is important for activating Windows Server and downloading updates.

  • Click OK to save the settings.
  • Click Start in the VirtualBox Manager toolbar to boot the VM.

The VM window opens and boots from the ISO. The Windows Setup wizard starts after a moment of loading.

  • On the first screen, leave the language, time, and keyboard settings as defaults and click Next.
  • Click Install now.
  • Select Windows Server 2025 Standard Evaluation (Desktop Experience) from the list of editions.

Why Desktop Experience?

The "Desktop Experience" edition includes the full graphical interface with Server Manager, Active Directory Users and Computers, and other GUI tools. The "Server Core" option is command-line only. For learning, the GUI makes it much easier to follow along.

  • Click Next.
  • Accept the license terms and click Next.
  • Select Custom: Install Windows only (advanced).
  • Select the 50 GB virtual disk (it should be the only option listed) and click Next.

Windows Server will now install. This takes approximately 10 to 15 minutes. The VM will reboot automatically during installation.

  • When prompted, set the Administrator password to P@ssw0rd123! and click Finish.

Use a memorable lab password

This password is for your isolated lab environment only. Using P@ssw0rd123! keeps things simple for the rest of this project. Never use simple passwords in production environments.

  • Press Ctrl+Alt+Del to unlock the login screen. In VirtualBox, use the menu Input > Keyboard > Insert Ctrl-Alt-Del if the keyboard shortcut doesn't reach the VM.
  • Enter the Administrator password P@ssw0rd123! and press Enter.

You should see the Windows Server desktop with Server Manager opening automatically. Your VM is running and ready.

Run Windows Update now

While you're on a fresh install, it's a good time to run Windows Update. Click Start > Settings > Windows Update and install any available updates. An April 2026 update (KB5091157) fixes a known issue with domain controllers, so getting current updates is especially important.

VM hangs on the Windows logo during installation?

If the installation freezes on the blue Windows logo, make sure you selected Windows 2025 (64-bit) as the Version when creating the VM. Using the wrong OS type can cause boot failures.

If the issue persists, power off the VM, open a terminal, and run the following command before starting the VM again:

VBoxManage modifyvm "DC01" --hpet on

Help me troubleshoot a Windows Server 2025 installation that hangs in VirtualBox.

Your VM is up and running with a fresh install of Windows Server 2025. Next, you'll configure its network settings and promote it to a Domain Controller for your corp.local domain.

Configure Networking and Promote to Domain Controller

Your Windows Server 2025 VM is up and running. Now it's time to turn this standalone server into something much more powerful.

A Domain Controller is a server that manages all user authentication and security policies for a network. To create one, you need to give your server a stable network address, install Active Directory Domain Services, and promote it to control a new domain called corp.local.

In this step, get ready to:
  • Configure a static IP address and rename the server to DC01.
  • Install the Active Directory Domain Services and DNS Server roles.
  • Promote the server to a Domain Controller for the corp.local domain.
Set a static IP address and configure DNS

Every Domain Controller needs a predictable, fixed network address. Other machines on the network rely on the DC for DNS lookups and authentication, so its IP address can't change between reboots.

  • Inside your DC01 VM, click the Start menu.
  • Click Settings.
  • Select Network & Internet from the left sidebar.
  • Click Ethernet.
  • Next to IP assignment, click Edit.
  • Change the dropdown from Automatic (DHCP) to Manual.
  • Toggle IPv4 to On.

A set of fields appears for your IPv4 configuration.

  • In the IP address field, enter 10.0.2.15.
  • In the Subnet mask field, enter 255.255.255.0.
  • In the Gateway field, enter 10.0.2.2.
  • In the Preferred DNS field, enter 127.0.0.1.
  • Click Save.

Why these network values?

The IP address 10.0.2.15 and gateway 10.0.2.2 match VirtualBox's default NAT network. This keeps your VM connected to the internet for activation and updates.

Setting the preferred DNS to 127.0.0.1 tells the server to use itself for all domain name lookups. After you install Active Directory, this server becomes a DNS server, so it needs to point to itself.

Now you need to rename the server. The Windows hostname is still a random default name like WIN-XXXXXXXX. You'll change it to DC01 to match the VM name you set in VirtualBox.

  • Open Server Manager. It should launch automatically at login. If it doesn't, click the Start menu and select Server Manager.
  • Click Local Server in the left sidebar.
  • Click the computer name link next to Computer name. It will show the random default name.
  • In the System Properties window, click Change.
  • In the Computer name field, type DC01.
  • Click OK.
  • A prompt tells you the server must be restarted. Click OK.
  • Close the System Properties window and click Restart Now.
  • After the restart, log back in as Administrator with password P@ssw0rd123!.
  • Open Server Manager and click Local Server.
  • Confirm the computer name now shows DC01.
  • Confirm the Ethernet section shows your static IP address 10.0.2.15.

Run Windows Update before continuing

Before promoting to a Domain Controller, install the latest updates. Open Settings, select Windows Update, and click Check for updates. Install any available updates and restart if prompted.

Lost network connectivity after setting the static IP?

  • Double-check that the gateway is 10.0.2.2 and not 10.0.2.15. The gateway must point to VirtualBox's NAT router, not the server itself.
  • Verify that the VirtualBox network adapter is set to NAT. Right-click the VM in VirtualBox Manager, go to Settings, then Network, and confirm Adapter 1 is attached to NAT.
  • Help me troubleshoot my static IP and network connectivity in VirtualBox
Install Active Directory Domain Services and DNS

Active Directory Domain Services (AD DS) is the Windows Server role that stores and manages information about your network's users, computers, and policies. DNS is required alongside it because Active Directory uses DNS to locate domain controllers and services on the network.

  • In Server Manager, click Manage in the top menu bar.
  • Click Add Roles and Features.
  • On the Before You Begin page, click Next.
  • Select Role-based or feature-based installation. Click Next.
  • Select the local server (DC01) from the server pool. Click Next.
  • On the Server Roles page, check the box for Active Directory Domain Services.
  • A popup appears asking to add required features. Click Add Features.
  • Back on the Server Roles page, also check the box for DNS Server.
  • Another popup appears asking to add required features. Click Add Features.
  • Click Next through the Features page.
  • Click Next through the AD DS information page.
  • Click Next through the DNS Server information page.
  • Click Install.

The installation takes a few minutes. Wait for the progress bar to complete. When it finishes, you'll see a message saying "Installation succeeded on DC01".

What did you just install?

AD DS is the directory service that will store all your domain objects like users, groups, and computers. Think of it as the central database for your entire network's identity information.

The DNS Server role handles name resolution for your domain. When a computer needs to find the Domain Controller for corp.local, DNS is what directs it to the right IP address.

Don't see DC01 in the server pool?

  • Make sure you renamed the server to DC01 and restarted before opening the Add Roles wizard.
  • If you see a different server name, close the wizard, rename the server through Local Server, restart, and try again.
  • Help me fix the server name in Add Roles and Features
Promote the server to a Domain Controller

Installing the AD DS role only adds the software to your server. Promotion is the separate process that actually creates the domain database, configures DNS zones, and activates the server as a functioning Domain Controller.

  • In Server Manager, click the yellow notification flag icon in the top menu bar.
  • Click Promote this server to a domain controller.

Where is the yellow flag?

After installing AD DS, a small yellow warning triangle appears on the flag icon at the top of Server Manager. This is your cue that post-installation configuration is needed. If you don't see it, try clicking the flag icon and looking for the promotion link in the dropdown.

  • On the Deployment Configuration page, select Add a new forest.
  • In the Root domain name field, type corp.local.
  • Click Next.

Why corp.local?

Using a .local domain name is standard practice for isolated lab environments. It avoids conflicts with real internet domains.

In a production environment, you would use a subdomain of a domain your organization owns. For a lab, .local is the conventional choice.

What is a forest?

A forest is the top-level container in Active Directory. It holds one or more domains that share a common schema and trust relationships. Your lab has a single forest with a single domain: corp.local.

  • On the Domain Controller Options page, leave the Forest functional level set to Windows Server 2016.
  • Leave the Domain functional level set to Windows Server 2016.
  • Make sure both Domain Name System (DNS) server and Global Catalog (GC) are checked.
  • In the DSRM password fields, enter P@ssw0rd123! and confirm it.
  • Click Next.

What is DSRM?

Directory Services Restore Mode is a special boot mode used to repair or recover the Active Directory database. The DSRM password is your emergency access key if the domain database ever becomes corrupted. Keep it safe.

  • On the DNS Options page, you will see a warning about DNS delegation. This is expected. Click Next.
  • On the Additional Options page, the NetBIOS domain name auto-fills as CORP. Click Next.
  • On the Paths page, leave the default locations for the database, log files, and SYSVOL. Click Next.
  • Review your selections on the Review Options page. Click Next.
  • On the Prerequisites Check page, wait for the check to complete. You may see some warnings. These are normal for a new lab environment.
  • Click Install.

Seeing a DNS delegation warning? Don't freak out

The warning says "A delegation for this DNS server cannot be created..." This is safe to ignore. It only matters if this domain needs to be reachable from a parent DNS zone, which does not apply to an isolated lab.

The promotion process takes several minutes. Your server will automatically restart when it completes.

  • After the restart, press Ctrl+Alt+Delete to reach the login screen. In VirtualBox, use the Input menu at the top of the VM window and select Insert Ctrl+Alt+Del.
  • Log in with the username CORP\Administrator and password P@ssw0rd123!.

Server Manager opens automatically after login. You should see AD DS and DNS listed in the left sidebar. This confirms your server is now a Domain Controller for the corp.local domain.

Why CORP\Administrator?

Before promotion, you logged in as the local Administrator. After promotion, the server joined the CORP domain. You now need to include the domain prefix CORP\ to tell Windows which domain account you're using.

Can't log in after promotion?

  • Use CORP\Administrator as the username, not just Administrator. After promotion, the server requires the domain prefix.
  • If the VM seems stuck on a black screen after restart, give it a couple of minutes. The first boot after promotion takes longer than usual as Active Directory initializes.
  • If you're typing the password but nothing appears, that's normal. Windows hides password characters entirely.
  • Help me log in to my Domain Controller after promotion

Your Domain Controller is live and managing the corp.local domain. Next up, you'll build out the organizational structure inside Active Directory by creating departments, security groups, and the building blocks of a real corporate directory.

Create Organizational Units and Security Groups

Your server is now a Domain Controller for the corp.local domain. Right now, your Active Directory environment is empty, so any new objects would land in the default containers with no organization at all.

In this step, you'll create a department-based structure using Organizational Units. You'll also set up security groups for each department so you can manage access later.

In this step, get ready to:
  • Create an OU hierarchy that mirrors a real company's department structure.
  • Set up security groups for the IT, Sales, and HR departments.
  • Verify your structure using PowerShell commands.
Open Active Directory Users and Computers and create the OU structure

Organizational Units act like folders inside Active Directory. They let you group users, groups, and computers by department, location, or function.

  • In Server Manager, click Tools in the top-right corner of the menu bar.
  • Select Active Directory Users and Computers.

A new window opens showing the corp.local domain tree in the left panel. This tool is commonly called ADUC, and you'll build your entire OU structure here.

First, create the top-level OU that will hold all your department folders.

  • In the left panel, right-click on corp.local.
  • Select New, then Organizational Unit.
  • Type Corp in the Name field.
  • Click OK.

You should see Corp appear under corp.local in the left panel. Now create the three department OUs inside it.

  • Right-click on the Corp OU in the left panel.
  • Select New, then Organizational Unit.
  • Type IT in the Name field and click OK.
  • Right-click on Corp again.
  • Select New, then Organizational Unit.
  • Type Sales in the Name field and click OK.
  • Right-click on Corp one more time.
  • Select New, then Organizational Unit.
  • Type HR in the Name field and click OK.

You should now see three OUs (IT, Sales, HR) listed under Corp. Each department needs two sub-OUs: one for users and one for groups.

  • Click the arrow next to the IT OU to expand it.
  • Right-click on IT.
  • Select New, then Organizational Unit.
  • Type Users in the Name field and click OK.
  • Right-click on IT again.
  • Select New, then Organizational Unit.
  • Type Groups in the Name field and click OK.

The IT OU now contains Users and Groups sub-OUs. Repeat this exact process for the remaining two departments.

  • Right-click on the Sales OU and create two new Organizational Units: Users and Groups.
  • Right-click on the HR OU and create two new Organizational Units: Users and Groups.
  • Click the arrows next to each department OU to expand them.

Your final tree should look like this: corp.local > Corp > IT > Users, Groups | Sales > Users, Groups | HR > Users, Groups.

What is an Organizational Unit?

An Organizational Unit (OU) is a container inside Active Directory that holds users, groups, computers, and even other OUs.

OUs let you organize objects by department, office, or function. They also serve as targets for Group Policy, which you'll configure in a later step to enforce security settings on specific departments.

Don't see all the OUs in the tree?

Make sure you're expanding each parent OU by clicking the arrow next to it. The sub-OUs are nested inside.

If an OU is missing, right-click the parent OU and select Refresh. The tree view sometimes doesn't update automatically.

Double-check that you created each OU under the correct parent. For example, Users should be under IT, not directly under Corp.

My OU tree in ADUC doesn't match the expected structure. How do I fix this?

Create security groups in each department

Each department needs a security group that you'll use to manage access and permissions. Instead of assigning permissions to individual users, you assign them to a group.

  • In ADUC, navigate to Corp > IT > Groups in the left panel.
  • Right-click on the Groups OU.
  • Select New, then Group.
  • Type IT-Staff in the Group name field.
  • Set Group scope to Global.
  • Set Group type to Security.
  • Click OK.

What is a security group?

A security group in Active Directory is a collection of user accounts that share the same access permissions. When you grant a folder, application, or resource access to a group, every member of that group gets access automatically.

When someone joins or leaves the group, their access updates immediately. This makes managing permissions across hundreds of users much simpler than assigning them one by one.

Now create the remaining two department groups using the same steps.

  • Navigate to Corp > Sales > Groups in the left panel.
  • Right-click on Groups and select New, then Group.
  • Type Sales-Staff in the Group name field.
  • Set Group scope to Global.
  • Set Group type to Security.
  • Click OK.
  • Navigate to Corp > HR > Groups in the left panel.
  • Right-click on Groups and select New, then Group.
  • Type HR-Staff in the Group name field.
  • Set Group scope to Global.
  • Set Group type to Security.
  • Click OK.

Each Groups OU now contains its department security group. You should see IT-Staff under Corp > IT > Groups, Sales-Staff under Corp > Sales > Groups, and HR-Staff under Corp > HR > Groups.

Groups not appearing in the right OU?

Double-check that you right-clicked on the Groups sub-OU, not the department OU itself. The group should live inside Groups, not directly under IT or Sales.

If a group ended up in the wrong OU, right-click it and select Move to relocate it to the correct Groups OU.

I created a security group in the wrong OU in ADUC. How do I move it to the correct location?

Verify your structure with PowerShell

PowerShell can query Active Directory directly, giving you a quick way to confirm everything is in place without clicking through the GUI.

  • Click the Start button in the taskbar.
  • Type PowerShell.
  • Right-click Windows PowerShell and select Run as administrator.
  • List all the OUs in your domain by running this command:
Get-ADOrganizationalUnit -Filter 'Name -like "*"' | Format-Table Name, DistinguishedName -AutoSize

What does this command do?

  • Get-ADOrganizationalUnit queries Active Directory for all Organizational Unit objects.
  • -Filter 'Name -like "*"' matches every OU name, so nothing is filtered out.
  • Format-Table displays the results in a clean table with the OU name and its full path (called the Distinguished Name) in the directory.

The output lists every OU in your domain. Look for all 10 of your custom OUs: Corp, the three department OUs (IT, Sales, HR), and their Users and Groups sub-OUs. You may also see the default Domain Controllers OU.

  • Verify the three security groups by running this command:
Get-ADGroup -Filter 'Name -like "*-Staff"' | Format-Table Name, GroupScope, DistinguishedName -AutoSize

What does this command do?

  • Get-ADGroup queries Active Directory for group objects.
  • -Filter 'Name -like "*-Staff"' narrows the results to groups whose names end in -Staff.
  • The table shows each group's name, scope, and full path in the directory tree.

You should see three groups listed: IT-Staff, Sales-Staff, and HR-Staff. Each one should show a GroupScope of Global.

PowerShell command returning an error?

If you see The term 'Get-ADOrganizationalUnit' is not recognized, the Active Directory module is not loaded. Run Import-Module ActiveDirectory first, then try the command again.

Make sure you're running PowerShell on the DC01 server itself, not on your Linux host machine.

I'm getting an error when running Active Directory PowerShell commands on my domain controller. How do I fix this?

Your domain now has a clean organizational structure that mirrors a real company. In the next step, you'll populate these OUs with user accounts and assign them to their department groups.

Create User Accounts and Assign Group Memberships

In the last step, you built the organizational structure for your domain. The Corp OU, three department folders, and security groups are all in place.

Now it's time to create the user accounts that represent employees in each department. You'll add six users to their correct OUs, then assign each one to their department security group so they inherit the right permissions.

In this step, get ready to:
  • Create six user accounts across the IT, Sales, and HR departments.
  • Add each user to their department security group.
  • Verify your users and group memberships with PowerShell.
Create user accounts in Active Directory Users and Computers

Each employee in your organization needs a user account to log in and access domain resources. You'll create these accounts inside the Users sub-OU of each department, keeping everything organized in the structure you built in the last step.

Start by creating the first user, Alice Johnson, in the IT department. The walkthrough below covers every click. You'll repeat the same process for the remaining five users afterward.

  • Open Server Manager if it is not already open.
  • Click Tools in the top menu bar.
  • Select Active Directory Users and Computers.
  • In the left panel, expand corp.local, then Corp, then IT.
  • Right-click on the Users OU under IT.
  • Select New, then User.
  • Enter Alice in the First name field.
  • Enter Johnson in the Last name field.
  • Enter ajohnson in the User logon name field.
  • Click Next.
  • Enter Welcome1! in both the Password and Confirm password fields.
  • Uncheck User must change password at next logon.
  • Click Next, then click Finish.

What is a User logon name?

The User logon name is what the employee types to sign in. For Alice Johnson, it's ajohnson. Active Directory combines this with the domain name to create a User Principal Name like ajohnson@corp.local.

You unchecked User must change password at next logon because this is a lab environment. In a real company, you would leave it checked so employees set their own password on first login.

Now create the remaining five users by following the same steps. Use the details below for each one.

  • Navigate to Corp > IT > Users and create Bob Chen with the logon name bchen.
  • Navigate to Corp > Sales > Users and create Carol Davis with the logon name cdavis.
  • In the same Corp > Sales > Users OU, create Dan Miller with the logon name dmiller.
  • Navigate to Corp > HR > Users and create Eva Wilson with the logon name ewilson.
  • In the same Corp > HR > Users OU, create Frank Lee with the logon name flee.
  • Use Welcome1! as the password for every user.
  • Uncheck User must change password at next logon for every user.
  • Click on the Users OU under each department in the left panel to confirm the accounts appear in the right panel.

Under IT > Users you should see Alice Johnson and Bob Chen. Under Sales > Users you should see Carol Davis and Dan Miller. Under HR > Users you should see Eva Wilson and Frank Lee.

User creation failing?

Make sure you are right-clicking the Users sub-OU, not the department OU itself. For example, right-click the Users folder inside IT, not the IT folder directly.

If the password is rejected, it does not meet the domain's complexity requirements. The password Welcome1! includes uppercase, lowercase, a number, and a special character, so it should pass. Double check for typos.

Help me troubleshoot creating a user account in Active Directory Users and Computers.

Add users to their department security groups

Your users exist in the right OUs, but they are not yet members of any security group. Security groups control what resources users can access, so each person needs to be added to their department's group.

  • In Active Directory Users and Computers, navigate to Corp > IT > Groups in the left panel.
  • Double-click the IT-Staff group to open its properties.
  • Click the Members tab.
  • Click Add.
  • Type ajohnson; bchen in the text field.
  • Click Check Names to confirm Active Directory resolves both names.
  • Click OK to add the members, then click OK again to close the properties window.

What does Check Names do?

When you click Check Names, Active Directory searches the domain for accounts matching what you typed. If the names are valid, they get underlined to confirm the match. If a name cannot be found, you will see an error dialog.

Now repeat the same process for the other two department groups.

  • Navigate to Corp > Sales > Groups and double-click Sales-Staff.
  • Go to the Members tab, click Add, type cdavis; dmiller, click Check Names, then click OK twice.
  • Navigate to Corp > HR > Groups and double-click HR-Staff.
  • Go to the Members tab, click Add, type ewilson; flee, click Check Names, then click OK twice.

Name not found after clicking Check Names?

Double check that the logon names match exactly what you entered when creating each user. For example, if you accidentally typed ajonhson instead of ajohnson during user creation, the check will fail.

You can also click Advanced in the Add dialog, then click Find Now to browse all available accounts and select the correct ones.

Help me troubleshoot adding members to an Active Directory security group.

Verify users and memberships with PowerShell

The GUI confirms your setup visually, but PowerShell gives you a faster and more precise way to audit your domain. These commands will list every user account and group membership you just created.

  • Open PowerShell as Administrator by right-clicking the Start button and selecting Windows PowerShell (Admin).
  • List all user accounts under the Corp OU by running this command:
Get-ADUser -Filter * -SearchBase "OU=Corp,DC=corp,DC=local" -Properties Department | Format-Table Name, SamAccountName, DistinguishedName -AutoSize

What does this command do?

  • Get-ADUser -Filter * retrieves every user account in the domain that matches the search.
  • -SearchBase "OU=Corp,DC=corp,DC=local" narrows the search to only the Corp OU and everything beneath it.
  • Format-Table displays the results as a clean table with the columns you care about.

You should see all six users listed: ajohnson, bchen, cdavis, dmiller, ewilson, and flee. Each user's DistinguishedName column confirms which OU they live in.

  • Verify the IT-Staff group membership by running this command:
Get-ADGroupMember -Identity "IT-Staff" | Format-Table Name, SamAccountName -AutoSize

You should see Alice Johnson and Bob Chen listed as members.

  • Run the same command for Sales-Staff by running:
Get-ADGroupMember -Identity "Sales-Staff" | Format-Table Name, SamAccountName -AutoSize

You should see Carol Davis and Dan Miller.

  • Run the same command for HR-Staff by running:
Get-ADGroupMember -Identity "HR-Staff" | Format-Table Name, SamAccountName -AutoSize

You should see Eva Wilson and Frank Lee.

Getting zero results or an error?

If Get-ADUser returns nothing, check the -SearchBase path for typos. Every part is case-sensitive and must match your OU names exactly.

If you see Get-ADGroupMember : Cannot find an object with identity, the group name in the -Identity parameter does not match. Confirm your group names are exactly IT-Staff, Sales-Staff, and HR-Staff.

Help me troubleshoot PowerShell AD commands that return errors or empty results.

Your domain now has real users organized into departments with proper group memberships. Next up, you'll apply Group Policy Objects to enforce security settings across these users and OUs.

Apply Group Policy Objects (GPOs)

You have a fully populated Active Directory domain with users sorted into department OUs and assigned to the right security groups. The structure is in place, but nothing is controlling what those users can actually do.

Group Policy Objects let you define security rules and configuration settings in one place and push them out to every user and computer in your domain. In this step, you will create a password policy that applies domain-wide and a desktop restriction that targets only the Sales department.

In this step, get ready to:
  • Create and link a domain-wide password policy GPO.
  • Create and link a desktop restriction GPO to the Sales OU.
  • Verify GPO application using Group Policy Management and PowerShell.
Create a domain-wide password policy GPO

A password policy is one of the most fundamental security settings in any enterprise domain. You will create a GPO that enforces a minimum password length, complexity requirements, and a maximum password age across the entire corp.local domain.

  • Open Server Manager on your DC01 VM.
  • Click Tools in the top menu bar.
  • Select Group Policy Management.

What is Group Policy Management?

The Group Policy Management Console (GPMC) is the central tool for creating, editing, and linking Group Policy Objects. Think of it as the control panel where you write the rules and decide which parts of your domain those rules apply to.

  • In the left pane, expand Forest: corp.local.
  • Expand Domains, then expand corp.local.
  • Right-click Group Policy Objects and select New.
  • Enter Corp Password Policy in the Name field.
  • Click OK.

You should see Corp Password Policy appear under the Group Policy Objects folder in the left pane. Now you need to edit it and configure the password settings.

  • Right-click Corp Password Policy and select Edit.
  • In the Group Policy Management Editor, expand Computer Configuration.
  • Expand Policies, then Windows Settings, then Security Settings, then Account Policies.
  • Click Password Policy.

You should see a list of password-related settings in the right pane. Configure the following three settings one at a time.

  • Double-click Minimum password length.
  • Check the Define this policy setting box, set the value to 10 characters, and click OK.
  • Double-click Password must meet complexity requirements.
  • Select Enabled and click OK.
  • Double-click Maximum password age.
  • Set the value to 90 days and click OK.
  • Close the Group Policy Management Editor window.

What do these password settings enforce?

Minimum password length = 10 means every user in the domain must set a password that is at least 10 characters long. Complexity requirements = Enabled forces passwords to include a mix of uppercase, lowercase, numbers, and special characters.

Maximum password age = 90 days means passwords expire every 90 days, prompting users to rotate them regularly. These three settings together form the baseline of most enterprise password policies.

The GPO exists, but it is not applied anywhere yet. You need to link it to the domain so it applies to all users and computers.

  • Back in the Group Policy Management console, right-click corp.local under the Domains node.
  • Select Link an Existing GPO.
  • Select Corp Password Policy and click OK.

You should see Corp Password Policy appear under the corp.local domain node in the left pane with a small link icon. Click on it and select the Settings tab to confirm your three password settings are listed.

Don't see your GPO linked under corp.local?

Make sure you right-clicked on the corp.local domain node itself, not the Group Policy Objects container. The domain node is where you link a GPO so it applies domain-wide.

If the Settings tab shows "Not configured" for your settings, go back and re-edit the GPO. Confirm that you checked the Define this policy setting checkbox for each setting before clicking OK. Help me troubleshoot my Corp Password Policy GPO.

Create a desktop restriction GPO for the Sales OU

The password policy applies to the entire domain. GPOs can also target specific Organizational Units. You will create a second GPO that restricts the desktop for only users in the Sales department.

  • In Group Policy Management, right-click Group Policy Objects and select New.
  • Enter Sales Desktop Restrictions in the Name field and click OK.
  • Right-click Sales Desktop Restrictions and select Edit.

This GPO targets user settings instead of computer settings. Notice that you are navigating through User Configuration this time, not Computer Configuration.

  • In the Group Policy Management Editor, expand User Configuration.
  • Expand Policies, then Administrative Templates.
  • Click Desktop.
  • Double-click Hide and disable all items on the desktop.
  • Select Enabled and click OK.
  • Close the Group Policy Management Editor window.

Why hide desktop items?

This policy is chosen because it produces a visible, easy-to-verify change. If a Sales user logs into a machine where this GPO applies, their desktop icons disappear completely.

In a real enterprise, desktop restriction GPOs are used to lock down workstations for roles that only need specific applications. The principle is the same: target an OU with a policy and every user in that OU inherits it.

Now link this GPO to the Sales OU so it only affects Sales department users.

  • In the Group Policy Management left pane, expand corp.local, then Corp.
  • Right-click the Sales OU and select Link an Existing GPO.
  • Select Sales Desktop Restrictions and click OK.

You should see Sales Desktop Restrictions appear under the Sales OU in the left pane with a link icon.

Don't see the GPO linked under Sales?

Make sure you right-clicked on the Sales OU directly, not on the Users or Groups sub-OUs inside it. GPOs linked to a parent OU are inherited by all child OUs automatically.

Help me troubleshoot linking my Sales Desktop Restrictions GPO.

Verify GPO application with reports

Creating and linking GPOs is only half the job. You need to verify that the right policies are reaching the right targets. Group Policy Management has built-in reporting tools that show exactly what is applied and where.

  • In Group Policy Management, click on Corp Password Policy under the corp.local domain node.
  • Select the Settings tab in the right pane.

You should see a report showing your three configured settings: Minimum password length of 10, complexity requirements Enabled, and maximum password age of 90 days. If the browser prompts you to allow Active Content, click Yes to load the report.

  • Now click on the Sales OU in the left pane (under Corp).
  • Select the Group Policy Inheritance tab in the right pane.

You should see two GPOs listed. Corp Password Policy appears because it is inherited from the domain level. Sales Desktop Restrictions appears because it is directly linked to the Sales OU.

What is GPO inheritance?

GPOs flow downward through the Active Directory hierarchy. A policy linked at the domain level applies to every OU underneath it. A policy linked to a specific OU only applies to objects in that OU and its children.

The Inheritance tab shows this in action. Sales users get the domain-wide password policy plus their own desktop restriction. IT and HR users only get the password policy.

Finally, confirm the Resultant Set of Policy from the command line.

  • Open PowerShell as Administrator on your DC01 VM.
  • View the Resultant Set of Policy for the current machine and user by running this command:
gpresult /r

What does this command show?

gpresult /r displays a summary of which GPOs are applied to the current computer and the logged-in user. Look for the Applied Group Policy Objects section under both Computer Settings and User Settings.

You should see Corp Password Policy listed under the Computer Settings section. Since you are logged in as CORP\Administrator (not a Sales user), the Sales Desktop Restrictions GPO will not appear in your personal results.

Not seeing Corp Password Policy in the gpresult output?

Group Policy changes can take a few minutes to propagate. Force an immediate refresh by running gpupdate /force in PowerShell, then run gpresult /r again.

If you still see no applied GPOs, go back to Group Policy Management and confirm the GPO is linked (not just created). A GPO that exists under Group Policy Objects but is not linked to a domain or OU will have no effect. Help me troubleshoot why my GPO is not showing up in gpresult.

Secret mission

Bulk-Create 50 Users from a CSV with PowerShell

You've been creating users one at a time through the GUI. What happens when your company hires 50 new employees in a single week? In this mission, you'll write a PowerShell script that reads a CSV file and bulk-creates user accounts with the correct OU placements and group memberships.

Before you go

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely. This project runs entirely on your local machine using free tools, so there are no ongoing cloud costs.

Resources you used:

  • Oracle VirtualBox 7.1 installation on your Pop!_OS machine.
  • Windows Server 2025 Evaluation ISO (~5 GB file on disk).
  • DC01 virtual machine (up to 50 GB dynamically allocated disk, 4 GB RAM when running).
  • Active Directory domain corp.local with OUs, users, groups, and GPOs inside the VM.
  • C:\LabFiles directory inside the VM (if you completed the Secret Mission).

Keep everything running

No action needed. Choose this if you are still actively building or want to experiment further with your Active Directory lab.

  • Your DC01 VM will keep its current state whenever you shut it down normally from inside Windows.
  • The Windows Server 2025 evaluation license is valid for 180 days from activation.
  • The VM only uses RAM while it is running. When it is powered off, it only uses disk space.

Pause - I'll come back to this later

Shut down the VM to free up RAM, but keep all your files and VirtualBox installed so you can return later.

  • Inside the DC01 VM, click the Windows Start menu, then click the power icon, and select Shut down.
  • In VirtualBox Manager, confirm the DC01 VM shows a Powered Off state.
  • Your VM's virtual disk and all Active Directory data will remain on your machine. To resume, just select DC01 in VirtualBox and click Start.

Delete - I don't want to use this again

Remove all project resources from your machine and start fresh. This frees up to ~55 GB of disk space (the VM disk plus the ISO).

  • In VirtualBox Manager, right-click the DC01 VM and select Remove.
  • When prompted, select Delete all files to remove the virtual disk.
  • Delete the Windows Server 2025 ISO file from your Downloads folder (or wherever you saved it).
  • If you want to remove VirtualBox entirely, run this command in your terminal:
sudo apt-get remove --purge virtualbox-7.1
  • If you want to keep VirtualBox for other VMs, skip the uninstall step. Just removing the DC01 VM and the ISO is enough.

Mission accomplished

That's a Wrap!

Nice work! You just built an enterprise-grade Active Directory lab from scratch on your Linux machine. You now have a fully functional domain controller running Windows Server 2025 inside VirtualBox, complete with users, groups, and Group Policy enforcement.

You've learned how to:

  • Installed VirtualBox on Pop!_OS, created a Windows Server 2025 VM, and promoted it to a Domain Controller for the corp.local forest.
  • Built a realistic Organizational Unit hierarchy with user accounts and security groups managed through both the GUI and PowerShell.
  • Applied Group Policy Objects including a domain-wide password policy and a department-specific desktop restriction, then verified them with GPO reports.
  • Secret Mission: Automated bulk user creation from a CSV file with a PowerShell script.

Ready to quiz yourself?