Build Your First Active Directory Domain

Build an isolated Windows Server domain with Active Directory, DNS, and users.

Introduction

30 Second Summary

Keeping separate accounts on every lab computer turns a simple access change into repeated work. One forgotten account can leave the wrong person able to sign in.

In this project, you will build the first Windows identity server for your isolated cyber range using Oracle VirtualBox and Windows Server 2025. You will create the corp.contoso.com Active Directory domain as the shared home for the range's users and access groups.

What You'll Build

You will sign in to DC1, open Active Directory Users and Computers, browse corp.contoso.com, and show a small company directory with departmental users plus their security-group memberships.

By the end of this project, you'll have:

  • A resource-conscious server you can start on an 8 GB Windows host while the other cyber-range guests stay powered off.
  • A healthy isolated domain you can prove by showing DC1 at 10.10.10.30/24, with working DNS and no default gateway.
  • A company directory where you can browse departmental organizational units, inspect ordinary users, and verify their global security-group memberships.
  • Secret Mission: Add a contractor identity to a dedicated security group. Disable the account while retaining its membership as proof of controlled offboarding.

Are there any prerequisites?

This project builds on Project 1, with KALI-OPS and RANGE-PEER attached to range-lan but powered off.

Your Windows host needs Oracle VirtualBox 7.2.x, administrator access, at least 4 GB available RAM, at least 50 GB free storage, and permission to download Microsoft evaluation media.

Before We Start

This first checkpoint locks in what DC1 provides to your isolated range before any hands-on work begins. You will connect centralized Active Directory identity, DNS, and authentication to the consistent domain accounts and access controls that later projects need.

Set Up and Install RANGE-DC1

Your first Active Directory domain controller will anchor identity for the isolated range. The Windows host has only 8 GB of memory.

A clean Windows Server 2025 installation gives DC1 a supported server foundation. Oracle VirtualBox will host a deliberately small virtual machine with temporary NAT connectivity for setup.

In this step, get ready to:
  • Download the official Windows Server 2025 Evaluation ISO into host storage.
  • Create RANGE-DC1 with resource-aware virtual hardware.
  • Complete the Windows Server 2025 desktop installation.
Download the evaluation and prepare evidence

An ISO contains the bootable installation media for Windows Server. The evidence folder keeps proof of each project milestone in one place.

  • Press the Windows key to open the host search bar.
  • Type Oracle VirtualBox and press Enter.
  • Confirm KALI-OPS and RANGE-PEER each show Powered Off in VirtualBox Manager.

Good start. Both earlier range guests are staying out of the host's limited memory while you build the server.

  • Press the Windows key to return to the host search bar.
  • Type File Explorer and press Enter.
  • Create C:\CyberRange\Project-2-AD-Domain using File Explorer.
  • Confirm Project-2-AD-Domain appears inside C:\CyberRange.

Expect the evaluation download to take several minutes or longer. Transfer time depends on your internet connection.

  • Open your usual web browser from the Windows taskbar.
  • Visit the Microsoft Evaluation Center page for Windows Server 2025.
  • Complete the registration form if the page prompts you.
  • Select ISO download 64-bit edition.
  • Choose English (United States).
  • Save the ISO in a host folder with enough free space.
  • Record the downloaded ISO path here: your Windows Server ISO path.
  • Confirm the downloaded .iso file appears at that path.

Why use the ISO?

The ISO keeps the manual operating-system installation visible. You get to choose the desktop image during Microsoft setup.

An evaluation VHD starts faster because the operating system is already installed. That path skips the installation decisions this project is designed to teach.

Create the resource-conscious virtual machine

Resource-aware virtualization balances the guest's needs against the host's limits. The selected memory and disk values keep RANGE-DC1 compact enough for this cyber range.

  • Switch back to VirtualBox Manager from earlier.
  • Select Home.
  • Select New.
  • Enter RANGE-DC1 as the VM name.
  • Select the ISO at your Windows Server ISO path.
  • Deselect Install OS Using Unattended Installation.

Why install manually?

Manual installation keeps the Microsoft setup screens available. This lets you select Server with Desktop Experience instead of accepting an automated image choice.

  • Set Base Memory to 3072 MB.
  • Set Processors to 2.
  • Continue to the virtual disk settings.
  • Set Disk Size to 40 GB.
  • Keep the new virtual hard disk dynamically allocated.
  • Finish the VM creation workflow.

You should see RANGE-DC1 in VirtualBox Manager. Its state should show Powered Off.

  • Select RANGE-DC1 in VirtualBox Manager.
  • Open Settings for the selected VM.
  • Select Network.
  • Enable Adapter 1.
  • Set the attachment for Adapter 1 to NAT.
  • Confirm Adapters 2 through 4 remain disabled.
  • Save the VM settings.

RANGE-DC1 now has the temporary external connection needed for setup. KALI-OPS and RANGE-PEER remain powered off.

Install Windows Server with the desktop

Server with Desktop Experience provides the full graphical interface used by Server Manager. This keeps the project focused on domain administration through the Windows management tools.

  • Start RANGE-DC1 from VirtualBox Manager.
  • Choose English (United States) on Select language settings.
  • Choose the keyboard layout that matches your host on Select keyboard settings.
  • Choose Install Windows Server on the setup options page.
  • Accept the deletion confirmation.
  • Select the Standard evaluation image that includes Server with Desktop Experience.
  • Accept the Applicable notices and license terms.

Why choose Desktop Experience?

Desktop Experience includes the full Windows graphical interface. You will use it for Server Manager and the directory-management consoles later in the project.

The GUI uses more memory than Server Core. The 3072 MB allocation is a deliberate compromise for this host.

The next action writes the operating system to the virtual disk. Expect several automatic restarts during installation.

  • Select the 40 GB unallocated virtual disk on Select location to install Windows Server.
  • Select Install on Ready to install.
  • Wait for Customize settings to appear after the restarts.

The next screen creates a privileged local password, so take a moment to keep it private. The password must stay out of screenshots.

  • Create a strong password for the local Administrator account.
  • Store the local Administrator password in your password manager.
  • Sign in as the local Administrator.
  • Wait for Server Manager to open automatically.

That's the heaviest part done: RANGE-DC1 is running a Windows Server 2025 Standard Evaluation desktop.

Temporary NAT connectivity lets Windows Update check Microsoft for current servicing information. The server stays connected only for this setup phase.

  • Keep Adapter 1 attached to NAT during this check.
  • Open Settings inside Windows Server.
  • Select Windows Update.
  • Select Check for updates.
  • Wait for the update scan to report its current status.

The Windows Update page should now show the result of a completed update check.

Windows Update cannot connect?

  • Confirm Adapter 1 is enabled in the VM's network settings.
  • Confirm its attachment is still set to NAT.
  • Retry the update check after Windows reports an active network connection.

Ask for help with the temporary connection: Help me troubleshoot Windows Update in my VirtualBox guest.

  • Use Windows search to open Command Prompt with administrator privileges.

Before you run the check, predict whether the license dialog will identify an evaluation or a permanent license.

  • Display the detailed evaluation licensing information by running this command:
slmgr.vbs /dlv

What does this command show?

  • The slmgr.vbs script manages Windows licensing information.
  • The /dlv option requests detailed license data.
  • The value EVAL identifies the evaluation edition.
  • Review the license dialog for EVAL.
  • Record the displayed evaluation licensing details in your private notes.

Licensing check incomplete?

  • Reopen Command Prompt with administrator privileges if the detailed dialog does not appear.
  • Keep Adapter 1 attached to NAT if the evaluation has not activated.
  • Use Microsoft's in-product activation support before the 10-day deadline.
  • Avoid entering an undocumented product key.

Ask for help without sharing credentials: Help me interpret my Windows Server evaluation status.

The final screenshot proves the server reached its working desktop. Capture the VM window from the Windows host so the evidence file lands in the host folder.

  • Return to Server Manager inside RANGE-DC1.
  • Select the Windows host desktop outside the VM window.
  • Press the Windows key to open the host search bar.
  • Type Snipping Tool and press Enter.
  • Capture the VM window with Server Manager visible.
  • Save the image as C:\CyberRange\Project-2-AD-Domain\01-rangedc1-server-manager.png.
  • Return to File Explorer from earlier.
  • Confirm 01-rangedc1-server-manager.png appears in the evidence folder.

Before the final check, predict which visible clues will prove the desktop installation completed.

  • Return to the running RANGE-DC1 VM.
  • Confirm you are signed in as the local Administrator.
  • Confirm Server Manager is open on the Windows Server 2025 Standard Evaluation desktop.

You should see Server Manager running on the completed desktop. RANGE-DC1 now has its temporary NAT connection and resource-conscious virtual hardware.

RANGE-DC1 is installed with its setup connection still available. Next up, you will remove NAT and give DC1 its permanent identity on the isolated range.

Isolate and Address DC1

Your RANGE-DC1 virtual machine now runs Windows Server 2025 Standard Evaluation. You will move it from temporary NAT connectivity onto the isolated range-lan network.

NAT handled the server's online setup. A domain controller needs a stable private identity before Active Directory Domain Services is installed.

In this step, get ready to:
  • Move RANGE-DC1 from temporary NAT connectivity to isolated range-lan.
  • Rename Windows Server to DC1.
  • Give DC1 a verified static network identity.
Return DC1 to range-lan

Changing the network attachment in Oracle VirtualBox removes outside access from DC1. The server stays connected to the private lab through range-lan.

This change intentionally removes internet access from DC1. The other range guests can still communicate with it after they are started in a later project.

  • Shut down Windows Server from inside the RANGE-DC1 VM.
  • Return to Oracle VirtualBox Manager from earlier.
  • Select RANGE-DC1 in the left sidebar.
  • Open Settings for the selected VM.
  • Select Network in the left sidebar.
  • Select Adapter 1.
  • Set the attachment to Internal Network.
  • Enter range-lan in Name.

Why use an internal network?

Internal networking limits communication to virtual machines attached to the same named network. The Windows host cannot access this network from outside the selected guests.

This is your isolation checkpoint. DC1 should have no NAT adapter before domain-controller promotion.

  • Confirm Adapters 2 through 4 remain disabled.
  • Save the VM's network settings.
  • Leave KALI-OPS powered off.
  • Leave RANGE-PEER powered off.
  • Start RANGE-DC1.
  • Sign in as the local Administrator.
  • Confirm Server Manager is available on the server desktop.

The server is back on the private range. Its temporary internet route is gone.

Rename the Windows server

A stable computer name gives the server a permanent identity inside the range. You will use DC1 when administering the domain in later steps.

  • Select Local Server in Server Manager.
  • Select the hyperlinked value beside Computer name.
  • Select the Computer Name tab in System Properties.
  • Select Change.
  • Enter DC1 in the Computer name field.
  • Accept the name-change prompts.
  • Restart Windows Server when prompted.
  • Sign back in as the local Administrator.
  • Return to Local Server in Server Manager.

You should see DC1 beside Computer name. That restart locks in the server's new identity.

Configure the static internal address

A static IPv4 address keeps DC1 reachable at the same location. The blank gateway preserves the server's isolation from outside networks.

  • Return to Local Server in Server Manager.
  • Select the link beside the wired Ethernet connection.
  • Right-click the active wired adapter in Network Connections.
  • Select Properties.
  • Select Internet Protocol Version 4 (TCP/IPv4).
  • Select Properties.
  • Select Use the following IP address.

Why point DNS back to DC1?

DC1 is the first domain controller. It is also the only DNS server in this new range.

Microsoft recommends configuring the DNS client to use the server's own address in this situation. This prepares DC1 to host domain name records after promotion.

  • Enter 10.10.10.30 in IP address.
  • Enter 255.255.255.0 in Subnet mask.

The form now shows DC1's fixed address on the private range.

  • Leave Default gateway blank.
  • Enter 10.10.10.30 in Preferred DNS server.

The empty gateway blocks a direct route outside the range. The preferred DNS value points name lookups back to DC1.

  • Leave Alternate DNS server blank.
  • Save the IPv4 settings.

The fixed network values are now stored on the active adapter.

Windows Command Prompt can display the complete configuration for every adapter. This final check catches any leftover NAT connection or default gateway.

  • Press the Windows key to open search.
  • Type Command Prompt.
  • Press Enter to open Command Prompt.

Before you run this check, do you expect any NAT address or default gateway to remain? The next command tests your prediction.

  • Inspect every network adapter by running this command:
ipconfig /all

What does this command show?

The ipconfig /all command displays the full TCP/IP configuration for every adapter. It exposes any connection that could bypass the isolated range.

The output includes address details for each adapter. It also shows gateway settings and DNS configuration.

You should see DC1 as the host name. The active adapter should show 10.10.10.30 with subnet mask 255.255.255.0.

Preferred DNS should show 10.10.10.30. No adapter should show a NAT address or IPv4 default gateway.

Still seeing a NAT address or gateway?

  • Shut down DC1 if the output still shows outside routing.
  • Return to RANGE-DC1 in Oracle VirtualBox Manager.
  • Confirm only Adapter 1 is enabled.
  • Set Adapter 1 to Internal Network.
  • Confirm Name shows range-lan.
  • Repeat the network check after restarting DC1.

Ask for help with the exact adapter details you see: Help me troubleshoot DC1 network isolation

The Snipping Tool captures this final network state for your evidence folder.

  • Leave the Command Prompt result visible in the RANGE-DC1 VM window.
  • Return keyboard focus to your Windows host.
  • Press the Windows key to open host search.
  • Type Snipping Tool.
  • Press Enter to open it.
  • Capture the Command Prompt output showing the host name and active adapter configuration.
  • Save the capture as C:\CyberRange\Project-2-AD-Domain\02-ipconfig-range-lan.png.

The network foundation is now in place. DC1 has a stable private identity on range-lan.

DC1 now has a stable isolated identity. Next, you'll install the server role that supplies the directory components.

Install the AD DS Role

DC1 now has a stable address on the isolated range-lan network. It is ready for the Windows identity services your range needs.

Active Directory Domain Services supplies the Windows role behind centralized identity. This step tests whether installing that role is enough to create corp.contoso.com.

You will use Server Manager to add the role files. You will inspect the result before making any domain configuration changes.

In this step, get ready to:
  • Add the Active Directory Domain Services role to DC1.
  • Install the associated management tools.
  • Prove that role installation leaves the domain configuration incomplete.
Start the role wizard

The role wizard targets one server from the server pool. Selecting DC1 keeps the installation focused on your isolated server.

  • Switch back to Server Manager from earlier.
  • Select Manage from the top-right menu.
  • Select Add Roles and Features.
  • Advance past the introductory page if it appears.
  • On Select installation type, select Role-based or feature-based installation.
  • Select Next.
  • On Select destination server, select DC1 from the server pool.
  • Select Next.

You will now see the Select server roles page with DC1 as the destination server. This confirms that the wizard is targeting the correct machine.

Install the role and tools

Selecting the AD DS role prompts Server Manager to offer its management tools. Those tools provide the consoles needed to administer Active Directory after configuration.

  • On Select server roles, select Active Directory Domain Services.
  • In the dialog, select Add Features.
  • Select Next on the Select server roles page.
  • Keep the default selections on Select features.
  • Select Next.
  • Review the Active Directory Domain Services page.
  • Select Next.

The installation can remain on the progress screen for a few minutes. That pause is expected while Windows adds the role files.

  • On Confirm installation selections, select Install.
  • Leave the wizard open until the progress completes.

The Results page now holds the proof of installation. It also exposes the remaining configuration path.

Role Installation Stalled?

  • Keep the wizard open while the progress bar is still moving.
  • Confirm RANGE-DC1 remains powered on if the wizard stops responding.
  • Review the message on the Results page if the installation fails.

Help me diagnose an AD DS role installation problem.

Observe the promotion gap

The newly installed management tools let you test what the role installation accomplished. This check reveals whether a directory domain exists yet.

  • Predict whether role installation alone has created corp.contoso.com.
  • Leave Promote this server to a domain controller unselected.
  • Select Tools in Server Manager.

You can now see Active Directory Users and Computers in the Tools menu. Its presence proves that the management tools were installed.

  • Select Active Directory Users and Computers.

You will not see a corp.contoso.com domain tree to administer. This is the intended shortfall because DC1 has not been promoted.

  • Predict which two details on the Results page distinguish an installed role from a configured domain controller.
  • Close Active Directory Users and Computers.
  • Return to the Results page in the Add Roles and Features Wizard.
  • Confirm that Installation succeeded appears.
  • Confirm that Promote this server to a domain controller appears.

You have now proven the key distinction for yourself. The role exists before the domain does.

  • Press the Windows key to open search.
  • Type Snipping Tool into the search box.
  • Press Enter.
  • Capture the Results page with both confirmation details visible.
  • Save the capture in the evidence folder from earlier as C:\CyberRange\Project-2-AD-Domain\03-adds-role-installed.png.

DC1 now has the AD DS role files plus its management tools. Next, you will promote the server to create the new forest.

Promote DC1 into the New Forest

The Active Directory Domain Services role is installed on DC1. DC1 still has no domain to manage.

Promotion closes that gap by creating the corp.contoso.com forest. DC1 then becomes its first writable domain controller.

DC1 also provides DNS. It serves as a Global Catalog for directory searches.

In this step, get ready to:
  • Create the new corp.contoso.com forest.
  • Configure DC1 as the first writable domain controller.
  • Verify the domain tree and basic DNS health.
Define the new forest

A forest gives the directory its top-level security boundary. Its root domain name becomes the foundation for every identity that you create later.

  • Return to the Add Roles and Features Wizard Results page from the previous step.
  • Select Promote this server to a domain controller.

The AD DS Configuration Wizard opens on Deployment Configuration.

  • Select Add a new forest.

The Root domain name field is now available for the new directory name.

  • Enter corp.contoso.com in the Root domain name field.
  • Select Next.

You should now see the Domain Controller Options page for corp.contoso.com.

Why Create a New Forest?

The isolated range has no existing directory. A new forest creates the first domain plus its security boundary.

DC1 becomes the foundation for every organizational unit and identity that you add to the range.

Configure domain-controller options

Functional levels determine which domain-controller capabilities the forest can use. This environment contains only Windows Server 2025 domain controllers.

  • Select Windows Server 2025 for the forest functional level.
  • Select Windows Server 2025 for the domain functional level.

Both functional-level fields should now show Windows Server 2025.

  • Leave Domain Name System (DNS) server selected.
  • Leave Global Catalog (GC) selected.

These selections make DC1 the DNS server plus Global Catalog for the new forest.

  • Confirm Read Only Domain Controller remains unselected.

Why Keep DNS and Global Catalog?

DNS lets domain members locate directory services inside the isolated range. The DNS data is stored with Active Directory.

The first domain controller must be a Global Catalog. DC1 can then answer directory searches across the forest.

The Directory Services Restore Mode password protects recovery access to the directory. Treat it as a break-glass credential.

  • Enter a strong password in the Directory Services Restore Mode password field.
  • Enter the same password in the confirmation field.

The matching entries protect recovery access if Active Directory needs offline repair.

  • Store the Directory Services Restore Mode password separately in secure password storage.
  • Select Next.

The DNS Options page may show a DNS delegation warning. This warning is expected for the first domain controller in a new isolated forest.

  • Select Next on DNS Options.
  • Confirm the NetBIOS domain name is CORP on Additional Options.

The wizard has derived CORP from the new root domain name.

  • Select Next.
  • Keep the default database path.
  • Keep the default log path.
  • Keep the default SYSVOL path.

The default paths remain listed for the directory database and its supporting files.

  • Select Next.
  • Review the configuration on Review Options.
  • Select Next to begin the Prerequisites Check.

The prerequisite check validates whether DC1 is ready for promotion. Continue only when it reports no blocking errors.

The next action promotes DC1 and triggers an automatic restart. Your isolated range-lan network configuration remains in place.

  • Select Install when the prerequisite check has no blocking errors.

DC1 restarts automatically after promotion. This restart is expected.

Prove the forest and DNS are healthy

Promotion changes the sign-in context from the local server to the new domain. The directory tools can now display objects inside corp.contoso.com.

  • Sign in as CORP\Administrator after DC1 restarts.

You are now using the domain Administrator account created through promotion.

  • In Server Manager, select Local Server.
  • Confirm the domain value is corp.contoso.com.

The domain value proves that DC1 now belongs to the forest it hosts.

  • Select Tools in Server Manager.
  • Select Active Directory Users and Computers.

The directory console now has a domain tree that did not exist before promotion.

  • Expand corp.contoso.com in the left pane.
  • Confirm the default containers are visible.
  • Confirm the Domain Controllers organizational unit is visible.

You can now browse the new domain and see DC1 inside its domain-controller structure.

  • Press the Windows key to open Windows search.
  • Enter Command Prompt in the search field.

Windows search now shows Command Prompt as a result.

  • Use the result's administrator option to open Command Prompt with elevated permissions.

Before you run this check, do you expect DC1's new DNS service to pass its basic tests?

  • Run the basic DNS health check from the elevated Command Prompt:
dcdiag /test:DNS /DnsBasic

What Does This Command Test?

  • The dcdiag command evaluates domain-controller health.
  • The /test:DNS option selects the DNS tests.
  • The /DnsBasic option limits the run to basic DNS validation.

In the DNS summary, you should see the basic DNS test reported as passed for DC1. This proves that the new domain controller can provide its core DNS service.

DNS Test Did Not Pass?

Confirm that Command Prompt has elevated permissions. Check that DC1 still uses 10.10.10.30 as its preferred DNS server.

Verify that the domain value in Server Manager is still corp.contoso.com.

Help me diagnose the DNS health check.

That is the promotion gap closed. DC1 now hosts a working forest with basic DNS health confirmed.

  • Return to Active Directory Users and Computers from earlier.
  • Expand corp.contoso.com again if the domain tree is collapsed.
  • Position Active Directory Users and Computers beside Command Prompt so both results are visible.
  • Press the Windows key to open Windows search.
  • Enter Snipping Tool in the search field.
  • Select Snipping Tool from the results.
  • Capture the expanded domain tree plus the passing DNS summary.
  • Save the capture as 04-domain-dns-health.png in C:\CyberRange\Project-2-AD-Domain.

Your evidence folder now contains the role-installation checkpoint plus proof of a healthy promoted domain controller.

Your forest is healthy and ready for identities. Next up, you will build its departmental structure plus its first users and security groups.

Populate the Directory

DC1 now runs a healthy Active Directory forest for corp.contoso.com. The domain is ready for the people who will use this range.

An empty forest proves the installation works. A useful directory also reflects the company that relies on it.

Organizational units separate departmental objects. Global security groups classify ordinary users by role.

In this step, get ready to:
  • Create protected organizational units for the company departments.
  • Create three ordinary user accounts with first-sign-in password changes.
  • Classify each user with a global security group.
Create the organizational structure

Organizational units keep each department's accounts together. Accidental-deletion protection guards these containers from routine mistakes.

  • Return to Active Directory Users and Computers from earlier.
  • Expand corp.contoso.com in the console tree.
  • Right-click corp.contoso.com.
  • Point to New.
  • Select Organizational Unit.
  • Enter IT in the Name field.
  • Keep accidental-deletion protection enabled.
  • Select OK.

You'll see the IT OU directly beneath corp.contoso.com.

  • Repeat the protected OU process to create Finance.
  • Repeat the protected OU process to create Workstations.

You'll see IT, Finance, and Workstations beneath the domain.

Create the ordinary users

Each user account gets a unique logon name. The first-sign-in password change lets the user replace the temporary password.

Temporary passwords deserve care. Your evidence stays safe because no password screen becomes part of the final capture.

  • Select the IT OU.
  • Select Action.
  • Point to New.
  • Select User.
  • Enter Avery Stone in the Full name field.
  • Enter astone in the User logon name field.
  • Continue to the password page.

The next page controls the account's first sign-in. Avery receives a temporary password that must be changed after that sign-in.

  • Enter a learner-chosen temporary password.
  • Re-enter the same temporary password for confirmation.
  • Select User must change password at next logon.
  • Advance to the account summary.
  • Select Finish.

You'll see Avery Stone inside the IT OU.

  • Start the same user-creation wizard in the IT OU.
  • Enter Jordan Lee in the Full name field.
  • Enter jlee in the User logon name field.
  • Enter a learner-chosen temporary password.
  • Re-enter the same temporary password for confirmation.
  • Select User must change password at next logon.
  • Complete the wizard.

You'll now see Avery Stone and Jordan Lee inside the IT OU.

  • Start the same user-creation wizard in the Finance OU.
  • Enter Mina Patel in the Full name field.
  • Enter mpatel in the User logon name field.
  • Enter a learner-chosen temporary password.
  • Re-enter the same temporary password for confirmation.
  • Select User must change password at next logon.
  • Complete the wizard.

You'll see Mina Patel inside the Finance OU.

Why are these ordinary users?

The wizard creates ordinary directory accounts.

You have not added any administrative group memberships. Their access stays role-neutral until you assign departmental groups.

Build the role-based groups

A global security group collects users who need the same departmental access. Membership becomes the connection between each person and their role.

Why use groups for access?

A role-based group gives each department one access target. Staff changes only require a membership update.

  • Select the IT OU.
  • Select Action.
  • Point to New.
  • Select Group.
  • Enter GG-IT-Users as the group name.
  • Select Global for the group scope.
  • Select Security for the group type.
  • Select OK.

You'll see GG-IT-Users inside the IT OU.

  • Select the Finance OU.
  • Select Action.
  • Point to New.
  • Select Group.
  • Enter GG-Finance-Users as the group name.
  • Select Global for the group scope.
  • Select Security for the group type.
  • Select OK.

You'll see GG-Finance-Users inside the Finance OU.

  • Open Avery Stone in the IT OU.
  • Select Properties.
  • Select Member Of.
  • Select Add.
  • Enter GG-IT-Users in the Select Groups dialog.
  • Select Check Names.
  • Select OK.

You'll see GG-IT-Users in Avery Stone's Member Of list.

  • Select OK to save Avery Stone's membership.
  • Open Jordan Lee in the IT OU.
  • Select Properties.
  • Select Member Of.
  • Select Add.
  • Enter GG-IT-Users in the Select Groups dialog.
  • Select Check Names.
  • Select OK.

You'll see GG-IT-Users in Jordan Lee's Member Of list.

  • Select OK to save Jordan Lee's membership.
  • Open Mina Patel in the Finance OU.
  • Select Properties.
  • Select Member Of.
  • Select Add.
  • Enter GG-Finance-Users in the Select Groups dialog.
  • Select Check Names.
  • Select OK.

You'll see GG-Finance-Users in Mina Patel's Member Of list.

  • Select OK to save Mina Patel's membership.

Before you inspect the groups, which names do you expect each Members list to show? Keep your answer in mind.

  • Open GG-IT-Users in the IT OU.
  • Select Properties.
  • Select Members.

You'll see Avery Stone and Jordan Lee in the Members list.

  • Close the GG-IT-Users Properties window.
  • Open GG-Finance-Users in the Finance OU.
  • Select Properties.
  • Select Members.

You'll see Mina Patel in the Members list. Your prediction now matches the directory.

  • Close the GG-Finance-Users Properties window.
  • Expand the IT OU.
  • Expand the Finance OU.
  • Expand the Workstations OU.

You'll see the departmental OUs with their new users and groups in the console tree.

  • Reopen GG-IT-Users Properties.
  • Select Members.
  • Position the Properties window so the expanded OU tree remains visible.

The final evidence captures the OU tree with a verified membership view. Snipping Tool saves that state in the evidence folder from earlier.

  • Press the Windows key to open Windows search.
  • Type Snipping Tool and press Enter to bring it back.
  • Capture the expanded OU tree with the GG-IT-Users Members view visible.
  • Save the capture in C:\CyberRange\Project-2-AD-Domain as 05-ad-objects.png.

That completes the identity build: your directory now reflects a small company. The group memberships are visible and verified.

Secret mission

Add a Disabled Contractor Account

Create a contractor identity for Taylor Reed inside the existing company directory. Disable the account while preserving its security-group membership to demonstrate an audit-friendly offboarding control.

Clean Up Your Resources

Clean Up Your Resources

The lab runs entirely on your Windows host with no ongoing costs. Decide whether to keep the VM available, power it off for later, or remove it while retaining your evidence.

Resources you used:

  • The RANGE-DC1 VM in Oracle VirtualBox uses 3072 MB of memory while running. Its dynamically allocated virtual disk can grow to 40 GB.
  • The corp.contoso.com Active Directory forest lives inside RANGE-DC1.
  • The downloaded Windows Server 2025 Evaluation ISO remains on the Windows host.
  • The evidence folder at C:\CyberRange\Project-2-AD-Domain contains your six project screenshots. You can review them with File Explorer.

Keep everything running

Keep this setup intact if you are continuing the cyber range. Run RANGE-DC1 only while you are actively using the lab.

  • Keep Adapter 1 attached to Internal Network with range-lan as its name.
  • Keep KALI-OPS plus RANGE-PEER powered off while RANGE-DC1 is running.
  • Preserve C:\CyberRange\Project-2-AD-Domain as your evidence record.
  • Retain the Windows Server 2025 Evaluation ISO if you expect to rebuild the server.

Your domain remains ready for the next cyber-range project. The evidence folder keeps a record of the working directory.

Pause - I'll come back to this later

Powering off DC1 releases its guest memory. The virtual disk plus your evidence remain available for later.

  • Shut down DC1 from inside Windows Server.
  • Confirm RANGE-DC1 shows Powered Off in Oracle VirtualBox Manager.
  • Keep KALI-OPS plus RANGE-PEER powered off.
  • Retain the RANGE-DC1 VM files on the Windows host.
  • Retain the Windows Server 2025 Evaluation ISO if you expect to rebuild the VM.
  • Preserve C:\CyberRange\Project-2-AD-Domain as your evidence record.

That gives your host more available memory. RANGE-DC1 remains ready for your next lab session.

Delete - I don't want to use this again

This choice is irreversible. Deleting RANGE-DC1 permanently removes the only domain controller plus the corp.contoso.com forest.

  • Shut down DC1 from inside Windows Server.
  • Confirm RANGE-DC1 shows Powered Off in Oracle VirtualBox Manager.
  • Remove RANGE-DC1 from Oracle VirtualBox Manager.
  • Choose the option that deletes the VM files from the Windows host.

You should no longer see RANGE-DC1 in Oracle VirtualBox Manager. The server installation plus the forest are now removed.

  • Press the Windows key to open search.
  • Type File Explorer.
  • Press Enter to open File Explorer.
  • Return to the location where you saved the Windows Server 2025 Evaluation ISO.
  • Delete the ISO if you want to recover its storage.

The six screenshots are your durable project record. Keep them even if you remove the lab.

  • Keep C:\CyberRange\Project-2-AD-Domain on the Windows host.
  • Copy all six screenshots to an existing backup location if you want to remove the original evidence folder.
  • Confirm each copied screenshot opens from the backup location.
  • Delete C:\CyberRange\Project-2-AD-Domain in File Explorer only if you want no local project artifacts left.

Restore Isolation After Activation

The Windows Server Evaluation requires internet activation within the first 10 days. This recovery path applies only if you keep or pause the VM while that checkpoint remains incomplete.

  • Shut down DC1 before changing Adapter 1.
  • Set Adapter 1 to NAT temporarily.
  • Resolve activation through Microsoft's in-product support.
  • Shut down DC1 when the support session is complete.
  • Restore Adapter 1 to Internal Network with range-lan as its name.
  • Repeat the Step 2 network check before using the domain again.

Your final check should show 10.10.10.30/24 with no default gateway. It should show no NAT adapter.

Nice Work!

Nice Work!

Excellent work! You completed the second cyber-range project by building an isolated Windows Server 2025 domain controller. DC1 now anchors the corp.contoso.com Active Directory forest.

You've learned how to:

  • Built a resource-aware virtual machine for DC1. You placed it on range-lan at 10.10.10.30/24 with no default gateway.
  • Promoted DC1 into the corp.contoso.com forest with AD DS. You verified basic DNS health by running dcdiag /test:DNS /DnsBasic. DC1 also provides a Global Catalog.
  • Built protected organizational units for IT, Finance, and Workstations. You created ordinary users with Global Security group memberships that match their departments.
  • Completed the Secret Mission by adding the Contractors OU. You classified Taylor Reed through GG-Contractors. You disabled treed while preserving the account for offboarding audits.

Ready to quiz yourself?