Build an Active Directory Domain Controller

Set up a Windows Server 2025 Domain Controller with OUs, users, and GPOs.

Introduction

30 Second Summary

Every time you log in to a work computer, something behind the scenes checks who you are, what you're allowed to access, and what security rules apply to your account. That something is Active Directory.

In this project, you will build a fully functional Active Directory Domain Controller from scratch using Windows Server 2025 in a virtual machine. You will create departments, users, security groups, and enforce security policies across your domain.

What You'll Build

A complete Active Directory domain environment running locally on your machine, with an organizational structure, user accounts, and Group Policy security controls.

By the end of this project, you'll have:

  • A Windows Server 2025 VM running as a Domain Controller for the domain lab.local, with DNS and Active Directory Domain Services installed.
  • An Organizational Unit hierarchy with four departments, user accounts, and security groups implementing role-based access control.
  • A Group Policy Object enforcing password complexity and account lockout security baselines across the entire domain.
  • Secret Mission: Delegate password reset permissions to a helpdesk account and verify least-privilege enforcement.

Are there any prerequisites?

You need a Windows desktop with at least 8 GB of free RAM and VirtualBox installed. This project uses a free 180-day evaluation of Windows Server 2025, so there are no licence costs.

Set Up the Virtual Machine

Every enterprise Windows environment starts with a server. Before you can build Active Directory, you need a machine running Windows Server. Since you do not want to wipe your personal computer, you will create a virtual machine that acts as a completely separate computer running inside your existing one.

In this step, you will download the Windows Server 2025 evaluation ISO, create a virtual machine in VirtualBox, and install the operating system. By the end, you will be logged in to your fresh server and ready to start configuring it.

In this step, get ready to:
  • Download the Windows Server 2025 evaluation ISO.
  • Create a virtual machine named DC01 in VirtualBox.
  • Install Windows Server 2025 and log in to the Server Manager Dashboard.
Download the Windows Server 2025 evaluation ISO

Microsoft provides a free 180-day evaluation of Windows Server 2025. This gives you a fully functional server operating system at no cost, with no product key required during installation.

  • Open your web browser and navigate to the Windows Server 2025 evaluation download page.
  • Sign in with a Microsoft account (or create one for free) and register for the evaluation.
  • Download the 64-bit ISO edition in English.
  • Save the ISO file somewhere easy to find (for example, your Downloads folder). The file is several gigabytes, so the download may take a few minutes.

What is an ISO file?

An ISO file is a disc image. It contains all the data that would be on a physical installation DVD. VirtualBox can mount this file as a virtual DVD drive, so your VM boots from it exactly as if you inserted a real disc.

Why is this free?

Microsoft offers 180-day evaluation licenses so IT professionals can test features and learn the platform. You get full functionality during the evaluation period. No credit card or product key is needed.

Create the VM in VirtualBox

Now you will configure a virtual machine with the right hardware settings for Windows Server 2025. Think of this as assembling a computer from parts, except all the parts are virtual.

  • Press the Windows key to open your search bar.
  • Type VirtualBox and press Enter to open it.
  • In the VirtualBox Manager window, click New in the toolbar to start the Create Virtual Machine wizard.

What is VirtualBox Manager?

VirtualBox Manager is the main interface where you create, configure, and start virtual machines. The New button launches a step-by-step wizard that guides you through the process.

The wizard will walk you through several pages. Configure each page with these settings:

On the Name and Operating System page:

  • In the Name field, type DC01.
  • Set Type to Microsoft Windows.
  • Set Version to Windows Server 2025 (64-bit). If this option is not listed, select Windows 2022 (64-bit) instead.
  • In the ISO Image field, click the dropdown and select the Windows Server 2025 ISO you downloaded earlier.
  • Check the Skip Unattended Installation checkbox. You will install Windows manually so you can see each step.
  • Click Next.

On the Hardware page:

  • Set Base Memory to 4096 MB (4 GB).
  • Set Processors to 2.
  • Click Next.

On the Virtual Hard Disk page:

  • Select Create a Virtual Hard Disk Now.
  • Set the disk size to 50 GB.
  • Leave the file type as VDI and allocation as dynamically allocated (these are the defaults).
  • Click Next.

On the Summary page:

  • Review your settings and click Finish.

Your new VM named DC01 now appears in the VirtualBox machine list. You need to adjust two more settings before starting it.

  • Select DC01 in the machine list and click Settings in the toolbar.
  • Go to System in the left panel, then select the Motherboard tab.
  • Check Enable EFI (special OSes only) if the option is available. If you do not see it, leave it unchecked.
  • Go to Network in the left panel.
  • Confirm that Adapter 1 is enabled and attached to NAT. This is the default, so it should already be set.
  • Click OK to save and close Settings.

Why NAT networking?

NAT (Network Address Translation) lets your VM access the internet through your host computer's connection. This is important because Windows Server needs internet access during setup for activation.

Since this project uses a single VM with no client machines joining the domain, NAT is the simplest network mode. A future project adding client VMs would use Internal Network instead.

Don't see Windows Server 2025 in the Version dropdown?

If your VirtualBox version does not list Windows Server 2025 (64-bit), select Windows 2022 (64-bit) instead. VirtualBox uses this setting to apply default hardware recommendations. Both options work correctly for installing Windows Server 2025.

Why isn't Windows Server 2025 showing in my VirtualBox version dropdown?

Install Windows Server 2025

With the VM configured, you can now boot it and install the operating system. This process takes about 10-15 minutes.

  • Select DC01 in the VirtualBox machine list and click Start in the toolbar.
  • A new window opens showing the VM booting from the ISO. The Windows Server installer will load.

Follow the installer screens in this order:

  • On the language screen, select your preferred language (English is the default) and click Next.
  • On the keyboard screen, confirm your keyboard layout and click Next.
  • On the setup option screen, select Install Windows Server.
  • Check the box that says I agree everything will be deleted including files, apps, and settings and click Next.
  • On the edition selection screen, choose Windows Server 2025 Datacenter Evaluation (Desktop Experience) and click Next.
  • Accept the license terms by clicking Accept.
  • On the drive selection screen, select the virtual disk and click Next.
  • Click Install on the confirmation screen.

Why Desktop Experience?

Windows Server comes in two modes: Server Core (command-line only) and Desktop Experience (full graphical interface). You cannot switch between them after installation.

Desktop Experience gives you GUI management tools like Active Directory Users and Computers and Group Policy Management Console. These visual tools make learning Active Directory much easier when you are starting out.

The installation will copy files and restart the VM several times. This takes approximately 10 minutes. Do not close the VM window during this process.

After the final restart, the VM prompts you to set an Administrator password:

  • Enter a strong password. For this lab, use P@ssw0rd!Lab as the Administrator password.
  • Confirm the password by typing it again.
  • Click Finish.

Remember this password

Write down P@ssw0rd!Lab somewhere safe. You will use this Administrator password throughout the entire project. If you forget it, you will need to reinstall Windows Server from scratch.

You are now at the Windows lock screen. You need to send Ctrl+Alt+Delete to the VM to log in:

  • In the VM window menu bar, click Input then Keyboard then Insert Ctrl-Alt-Del.
  • Enter your Administrator password (P@ssw0rd!Lab) and press Enter.

Why not just press Ctrl+Alt+Delete on my keyboard?

Pressing Ctrl+Alt+Delete on your physical keyboard sends the command to your host operating system, not to the VM. Using the VirtualBox menu ensures the keystroke reaches Windows Server inside the virtual machine.

After logging in, the Server Manager Dashboard loads automatically. This is the central hub for managing your Windows Server.

VM window is black or not booting?

If the VM window stays black or shows an error, check these common causes:

  • Make sure the ISO file path is correct. Go to Settings > Storage and verify the ISO is attached to the optical drive.
  • Ensure hardware virtualization (VT-x or AMD-V) is enabled in your computer's BIOS. This is required for 64-bit VMs.
  • If you enabled EFI and the VM will not boot, try disabling it. Windows Server 2025 can install without EFI.

Help me troubleshoot my VirtualBox VM not booting for Windows Server 2025.

Your Windows Server 2025 virtual machine is up and running. Next up, you will configure the network and install Active Directory Domain Services to transform this server into a Domain Controller.

Configure Networking and Install AD DS

Your Windows Server 2025 VM is up and running. Now it is time to turn it into the central identity server for your network.

In this step, you will assign the server a fixed IP address, install the Active Directory Domain Services role, and promote the server to a Domain Controller. After this, your server will own the domain lab.local and control who can log in and what they can access.

In this step, get ready to:
  • Set a static IP address and rename the computer.
  • Install Active Directory Domain Services and Group Policy Management Console.
  • Promote the server to a Domain Controller for the lab.local domain.
Set a static IP address

A Domain Controller needs a fixed IP address because every other computer on the network will point to it for DNS lookups. If the IP changed, every device would lose contact.

  • Right-click the Start button in the taskbar.
  • Click Windows PowerShell (Admin).

Why PowerShell instead of the GUI?

Every command you run in PowerShell is repeatable, scriptable, and portfolio-ready. The GUI achieves the same result, but a screenshot of clicks is harder to share than a command you can paste into a resume or lab report.

  • Rename the computer to DC01 by running this command:
Rename-Computer -NewName "DC01" -Restart

What does this command do?

This renames the server to DC01 so it has a clean, identifiable hostname before it becomes a Domain Controller. The -Restart flag triggers an immediate reboot to apply the name change.

Your VM will restart automatically. Wait for it to come back to the login screen.

  • Log back in as Administrator using the password you set in Step 1.
  • Right-click the Start button and click Windows PowerShell (Admin) again.
  • Configure the static IP address and DNS by running these two commands:
# Set static IP address on the Ethernet adapter
New-NetIPAddress -InterfaceAlias "Ethernet" -IPAddress 10.0.2.10 -PrefixLength 24 -DefaultGateway 10.0.2.2

# Point DNS to this server (it will run its own DNS after promotion)
Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses 127.0.0.1

Why these specific values?

VirtualBox NAT uses the 10.0.2.x network by default, with a gateway at 10.0.2.2. The IP 10.0.2.10 gives the server a fixed address on that network.

DNS points to 127.0.0.1 (localhost) because after promotion, this server will run its own DNS service. It needs to resolve its own domain name.

  • Verify the IP was set correctly by running:
Get-NetIPAddress -InterfaceAlias "Ethernet" | Select IPAddress

You should see 10.0.2.10 listed in the output.

Seeing an error about the interface alias?

The adapter name might differ on your system. Run Get-NetAdapter to see all adapter names, then substitute the correct name in place of "Ethernet" in both commands above.

Help me find the correct adapter name

Install Active Directory Domain Services

With networking locked in, you can now install the AD DS role. This adds the software that lets the server manage users, computers, and security policies for an entire network.

  • Install the AD DS role and the Group Policy Management Console by running these commands:
# Install the Active Directory Domain Services role with admin tools
Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools

# Install Group Policy Management Console (not included by default)
Install-WindowsFeature -Name GPMC

What do these commands do?

The first command installs the AD DS role along with GUI management tools like Active Directory Users and Computers. Without -IncludeManagementTools, you would get the role but no admin interface.

The second command installs the Group Policy Management Console (GPMC). This tool is needed to create and manage Group Policy Objects later in the project. It is not bundled with AD DS automatically.

Each command takes 1-2 minutes. You should see Success showing True in the output table when each finishes.

Success shows False?

If the feature fails to install, confirm your VM has internet access by running Test-NetConnection -ComputerName 8.8.8.8. If that fails, check that Adapter 1 in your VirtualBox VM settings is still set to NAT.

Help me troubleshoot the installation failure

Promote the server to a Domain Controller

Installing the role is only half the job. The server has the AD DS software but is not yet controlling any domain. Promotion creates a brand new forest and domain, making this server the authority for lab.local.

  • Promote the server to a Domain Controller by running this command:
# Create a new AD forest and promote this server to Domain Controller
Install-ADDSForest -DomainName "lab.local" -DomainNetbiosName "LAB" -InstallDns:$true -SafeModeAdministratorPassword (ConvertTo-SecureString "DSRMp@ss1!" -AsPlainText -Force) -Force

What does this command do?

-DomainName "lab.local" sets the fully qualified domain name for your new forest.

-DomainNetbiosName "LAB" gives the domain a short name used for legacy logins like LAB\Administrator.

-InstallDns:$true installs a DNS server on this machine. Active Directory depends heavily on DNS for locating services.

-SafeModeAdministratorPassword sets a recovery password (DSRM) used only when booting into Directory Services Restore Mode for disaster recovery.

The server will restart automatically

After promotion completes, the server reboots on its own. This is expected. Do not interrupt the restart. It may take 2-3 minutes to come back up as AD DS initializes for the first time.

  • Wait for the VM to restart and reach the login screen.
  • Press Ctrl+Alt+Delete to log in. In VirtualBox, click Input in the menu bar, then Keyboard, then Insert Ctrl-Alt-Del.
  • Log in as LAB\Administrator with the password P@ssw0rd!Lab.

Why LAB\Administrator now?

Before promotion, you logged in as a local Administrator. Now that the server is a Domain Controller, local accounts no longer exist. The account has been elevated to a domain administrator under the LAB domain. The password is the same one you set in Step 1.

  • Right-click the Start button and click Windows PowerShell (Admin).
  • Confirm the domain is live by running:
Get-ADDomain

You should see DomainName showing lab.local and the Infrastructure Master role listed in the output.

Get-ADDomain not recognized?

If PowerShell does not recognize the command, the AD module may not have loaded yet. Close PowerShell, wait 30 seconds, then reopen it as Administrator. The AD module auto-loads on a Domain Controller but can take a moment after the first restart.

Help me load the Active Directory PowerShell module

Your server is now the central authority for the lab.local domain. Next up, you will build out the organizational structure with departments, users, and security groups.

Build the Organizational Unit Structure

Your Domain Controller is live and managing the lab.local domain. Now it's time to give it something to manage.

In a real company, every employee belongs to a department. Active Directory mirrors this structure through Organizational Units, security groups, and user accounts. In this step, you'll build a four-department organization from scratch using PowerShell.

In this step, get ready to:
  • Create Organizational Units for IT, Finance, HR, and Sales.
  • Create security groups for role-based access control.
  • Create user accounts and assign them to their departments.
Create department OUs

Organizational Units are containers that group objects together so you can apply policies and delegate control at the department level. You'll create one OU for each department at the domain root.

  • In your PowerShell window (still running as Administrator from the previous step), create the four department OUs by running these commands:
New-ADOrganizationalUnit -Name "IT" -Path "DC=lab,DC=local"
New-ADOrganizationalUnit -Name "Finance" -Path "DC=lab,DC=local"
New-ADOrganizationalUnit -Name "HR" -Path "DC=lab,DC=local"
New-ADOrganizationalUnit -Name "Sales" -Path "DC=lab,DC=local"

What do these commands do?

Each New-ADOrganizationalUnit command creates a new container in your domain. The -Name parameter sets the OU's display name. The -Path parameter tells Active Directory where to place it. DC=lab,DC=local is the distinguished name of your domain root.

These commands produce no output on success. If you see an error, the OU name may already exist or the path is wrong.

  • Verify the OUs were created by running:
Get-ADOrganizationalUnit -Filter * | Select Name

You should see Domain Controllers (the default OU) plus your four new OUs: IT, Finance, HR, and Sales.

Not seeing your OUs?

Make sure you're running PowerShell as Administrator. Check that you typed the path exactly as DC=lab,DC=local with no spaces after the commas.

help me troubleshoot why my New-ADOrganizationalUnit command is not creating OUs in my lab.local domain

Create security groups for each department

Security groups let you assign permissions to a collection of users at once. Instead of granting access to each person individually, you add them to a group and grant access to the group. This is the foundation of Role-Based Access Control.

  • Create a Global Security group inside each department OU by running:
New-ADGroup -Name "IT_Staff" -GroupScope Global -GroupCategory Security -Path "OU=IT,DC=lab,DC=local"
New-ADGroup -Name "Finance_Staff" -GroupScope Global -GroupCategory Security -Path "OU=Finance,DC=lab,DC=local"
New-ADGroup -Name "HR_Staff" -GroupScope Global -GroupCategory Security -Path "OU=HR,DC=lab,DC=local"
New-ADGroup -Name "Sales_Staff" -GroupScope Global -GroupCategory Security -Path "OU=Sales,DC=lab,DC=local"

What do these commands do?

Each New-ADGroup command creates a security group. -GroupScope Global means the group can contain members from the same domain and be used across trusted domains. -GroupCategory Security means the group can be used to assign permissions (as opposed to Distribution groups, which are for email only).

The -Path places each group inside its matching department OU. This keeps your directory organized the same way a real enterprise would structure it.

  • Verify the groups were created by running:
Get-ADGroup -Filter * -SearchBase "DC=lab,DC=local" | Select Name, GroupScope

You should see your four groups (IT_Staff, Finance_Staff, HR_Staff, Sales_Staff) listed with a GroupScope of Global.

Groups not appearing?

Double check the -Path value matches the OU name exactly. The OU path is case-sensitive. For example, OU=IT must match the name you used when creating the OU.

help me troubleshoot why my New-ADGroup command failed to create security groups in my Active Directory OUs

Create user accounts and add them to groups

Now you'll populate the directory with realistic user accounts. Each user goes into their department's OU and gets added to the matching security group.

  • Create four user accounts and assign each to their department group by running:
$password = ConvertTo-SecureString "User@1234" -AsPlainText -Force

New-ADUser -Name "Alice Chen" -SamAccountName "achen" -UserPrincipalName "achen@lab.local" -Path "OU=IT,DC=lab,DC=local" -AccountPassword $password -Enabled $true
Add-ADGroupMember -Identity "IT_Staff" -Members "achen"

New-ADUser -Name "Bob Patel" -SamAccountName "bpatel" -UserPrincipalName "bpatel@lab.local" -Path "OU=Finance,DC=lab,DC=local" -AccountPassword $password -Enabled $true
Add-ADGroupMember -Identity "Finance_Staff" -Members "bpatel"

New-ADUser -Name "Carol Jones" -SamAccountName "cjones" -UserPrincipalName "cjones@lab.local" -Path "OU=HR,DC=lab,DC=local" -AccountPassword $password -Enabled $true
Add-ADGroupMember -Identity "HR_Staff" -Members "cjones"

New-ADUser -Name "David Smith" -SamAccountName "dsmith" -UserPrincipalName "dsmith@lab.local" -Path "OU=Sales,DC=lab,DC=local" -AccountPassword $password -Enabled $true
Add-ADGroupMember -Identity "Sales_Staff" -Members "dsmith"

What does this code do?

The first line stores a secure password in a variable so you can reuse it for all four accounts. Each New-ADUser command creates a user with a display name, a login name (SamAccountName), an email-style login (UserPrincipalName), and places the account in the correct OU.

The -Enabled $true flag activates the account immediately. Each Add-ADGroupMember command adds the newly created user to their department's security group. This is how enterprises assign permissions at scale.

  • Verify all users were created by running:
Get-ADUser -Filter * | Select Name, SamAccountName

You should see your four users (Alice Chen, Bob Patel, Carol Jones, David Smith) along with the built-in Administrator and krbtgt accounts.

  • Open Active Directory Users and Computers to visually confirm your OU tree.
  • Click **Start**, then open **Server Manager**.
  • Click **Tools** in the top menu bar, then select **Active Directory Users and Computers**.
  • Expand **lab.local** in the left panel. You should see your four department OUs (IT, Finance, HR, Sales) with users and groups inside each one.

Users not created or seeing an error?

The most common issue is the password not meeting complexity requirements. Make sure you typed User@1234 exactly. It needs at least one uppercase letter, one number, and one special character.

If you see an error about the OU path, make sure the OUs exist. Re-run Get-ADOrganizationalUnit -Filter * | Select Name to confirm.

help me troubleshoot why my New-ADUser command failed when creating users in my lab.local Active Directory domain

Your directory now has a realistic department structure with users and groups. Next up, you'll lock it down with Group Policy security controls that enforce password rules and account lockout across the entire domain.

Configure Group Policy Security Controls

Your domain now has departments, users, and security groups. But there is nothing stopping a user from setting their password to password123 and never changing it.

In this step, you will create a Group Policy Object (GPO) that enforces password complexity and account lockout rules across the entire domain. This is the same security baseline that real enterprises deploy to every Windows machine in their network.

In this step, get ready to:
  • Create and link a Security Baseline Policy GPO to your domain.
  • Configure password policy settings enforcing length, complexity, and rotation.
  • Configure account lockout policy to protect against brute-force attacks.
Create a domain-wide security baseline GPO

A GPO is a collection of settings that Windows applies to every user and computer it is linked to. You will create one and link it directly to the lab.local domain so it applies to all four departments.

  • In Server Manager, click Tools in the top menu bar.
  • Click Group Policy Management.
  • In the left pane, expand Forest: lab.local, then expand Domains, then expand lab.local.
  • Right-click lab.local and select Create a GPO in this domain, and Link it here.
  • In the Name field, type Security Baseline Policy and click OK.
  • Under lab.local, right-click Security Baseline Policy and select Edit.

The Group Policy Management Editor window opens. This is where you configure all the settings inside your GPO.

What is a Group Policy Object?

A GPO is a container of rules that Active Directory pushes to computers and users. When you link a GPO to a domain, every machine in that domain receives and enforces those rules automatically.

The "Security Baseline Policy" you just created will enforce password and lockout standards across all four departments without you needing to touch each computer individually.

Configure password policy

Password policy controls how strong passwords must be and how often users must change them. You will set five rules that match common enterprise security baselines.

  • In the Group Policy Management Editor, expand Computer Configuration in the left pane.
  • Expand Policies.
  • Expand Windows Settings.
  • Expand Security Settings.
  • Expand Account Policies.
  • Click Password Policy.

You should see a list of password-related settings in the right pane. Now configure each one.

  • Double-click Minimum password length.
  • Check Define this policy setting, set the value to 12 characters, and click OK.
  • Double-click Password must meet complexity requirements.
  • Check Define this policy setting, select Enabled, and click OK.
  • Double-click Maximum password age.
  • Check Define this policy setting, set the value to 90 days, and click OK.
  • Double-click Minimum password age.
  • Check Define this policy setting, set the value to 1 day, and click OK.
  • Double-click Enforce password history.
  • Check Define this policy setting, set the value to 24 passwords remembered, and click OK.

Why these specific values?

These settings mirror common enterprise security baselines. A 12-character minimum password with complexity requirements makes brute-force attacks impractical. The 90-day maximum age forces regular rotation.

The 1-day minimum age prevents users from cycling through 24 passwords in a row just to reuse their favorite. The 24-password history means a user cannot repeat any of their last two years of passwords.

Configure account lockout policy and verify

Account lockout protects against brute-force login attempts by temporarily locking an account after too many failed passwords.

  • In the Group Policy Management Editor left pane, click Account Lockout Policy (directly below Password Policy under Account Policies).
  • Double-click Account lockout threshold.
  • Set the value to 5 invalid logon attempts and click OK.
  • A dialog box appears suggesting values for the lockout duration and reset counter. Click OK to accept the suggested defaults.
  • Double-click Account lockout duration.
  • Set the value to 30 minutes and click OK.
  • Double-click Reset account lockout counter after.
  • Set the value to 30 minutes and click OK.
  • Close the Group Policy Management Editor window.

What do these lockout settings do?

After 5 wrong password attempts, the account locks for 30 minutes. This stops automated attacks from guessing thousands of passwords. The counter resets after 30 minutes of no failed attempts, so a legitimate user who mistyped once or twice does not get locked out unfairly.

Now force the domain to apply your new policy immediately instead of waiting for the next automatic refresh cycle.

  • Force an immediate Group Policy update by running this command in PowerShell:
gpupdate /force
  • Verify your policy is active by running this command:
Get-ADDefaultDomainPasswordPolicy

You should see MinPasswordLength showing 12, LockoutThreshold showing 5, and ComplexityEnabled showing True.

Not seeing the updated values?

Make sure you clicked OK on each policy setting. If you only closed the dialog without clicking OK, the change was not saved.

Also confirm your GPO is named exactly Security Baseline Policy and is linked to lab.local (not to a specific OU). You can check this in Group Policy Management by expanding the domain and looking for the GPO icon with a small link arrow.

Run gpupdate /force again and then re-run Get-ADDefaultDomainPasswordPolicy to verify.

help me troubleshoot why my Group Policy password settings are not showing up in Get-ADDefaultDomainPasswordPolicy

Your domain now enforces a real security baseline. Every user account must follow these password and lockout rules. Next up, you will tackle the Secret Mission and delegate least-privilege permissions to a helpdesk account.

Secret mission

Delegate Least-Privilege Permissions

The most common task in IT support is resetting user passwords. In a real enterprise, junior helpdesk staff can only reset passwords for specific departments. Can you set this up and prove it works by implementing the principle of least privilege?

Clean Up Your Resources

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely. This project runs entirely locally inside a VirtualBox VM, so there are no ongoing cloud costs.

Resources you used:

  • DC01 virtual machine (Windows Server 2025, up to 50 GB on disk).
  • Windows Server 2025 evaluation ISO file (approximately 5 GB).

Keep everything running

No action needed. Choose this if you are still actively building or want to continue experimenting with Active Directory.

  • Your DC01 VM stays in VirtualBox, ready to start whenever you need it.
  • The Windows Server 2025 evaluation gives you 180 days of use.
  • You can add more users, OUs, GPOs, or even join a client VM to your domain for further practice.

Pause - I'll come back to this later

Shut down the VM to free up RAM and CPU while keeping all your work intact on disk.

  • In the DC01 VM, click Start > Power > Shut down.
  • Alternatively, in the VirtualBox Manager window, right-click DC01 and select Close > Send the shutdown signal.
  • Your VM's virtual disk stays on your machine (up to 50 GB). When you are ready to continue, double-click DC01 in VirtualBox to start it back up.

Delete - I don't want to use this again

Remove the VM and ISO to reclaim all disk space used by this project.

  • If the DC01 VM is running, shut it down first (right-click DC01 in VirtualBox Manager > Close > Power Off).
  • Right-click DC01 in VirtualBox Manager and select Remove.
  • When prompted, select Delete all files to remove the virtual hard disk (VDI) from your machine.
  • Delete the Windows Server 2025 ISO file from your Downloads folder (or wherever you saved it) to reclaim an additional ~5 GB.

Nice Work!

Nice Work!

You just built a fully functional Active Directory Domain Controller from scratch. This is the identity backbone that powers every enterprise Windows environment, and you now know how to set it up, structure it, and secure it.

You've learned how to:

  • Install Windows Server 2025 in VirtualBox and promote it to a Domain Controller for lab.local, complete with integrated DNS.
  • Design a department-based Organizational Unit structure with realistic users, security groups, and role-based access control.
  • Configure Group Policy Objects enforcing password complexity and account lockout security baselines across the domain.
  • Secret Mission: Delegated narrowly scoped helpdesk permissions to the Finance OU and verified least-privilege enforcement.

Ready to quiz yourself?