AD Domain Lab Setup — TESTER.LAB

#windows #windows-11 #active-directory #lab #domain-controller

AD Domain Lab Setup — `TESTER.LAB`

Summary

Win11 cannot be a domain controller. This guide deploys a Windows Server 2022 Eval DC on the lab LAN, joins .114 as a member, and unlocks domain auth telemetry for Module 10.


Proposed DC	`192.168.50.115` — hostname `DC01`
Domain	`TESTER.LAB` (NetBIOS: `TESTERLAB`)
Client	`192.168.50.114` — join as `TESTER\tester808`
Status	Planned — DC VM not yet provisioned (2026-09-01)
Eval ISO	Windows Server 2022 Eval — no retail key; 180-day trial

VM sizing — DC01 on Proxmox

Licensing

Use the Evaluation ISO from Microsoft’s eval center. No purchase key for a homelab. Register with a Microsoft account, download 64-bit ISO, choose Server with Desktop Experience. Eval runs 180 days; snapshot after promotion.

Tier	vCPU	RAM	Disk	When to use
Minimum (Microsoft floor)	2	2 GB	32 GB	Will feel tight after updates
Recommended (this lab)	2	4 GB	60 GB	Single DC + DNS; matches our plan
Comfortable	2–4	8 GB	80–100 GB	Long-lived eval, extra snapshots, spare roles

Proxmox settings (annotated)

Setting	Value	Why
Machine	Default (i440fx or Q35)	Either works for Server 2022
BIOS	UEFI	Required for modern Windows
SCSI controller	VirtIO SCSI	Better performance than IDE
Disk bus	VirtIO	Install VirtIO drivers during setup if needed
NIC	VirtIO	Same — have `virtio-win` ISO handy
Disk format	qcow2	Snapshots friendly
Disk size	60 GB minimum	AD DB + SYSVOL + Windows Update cache
RAM	4096 MB	Fixed; skip ballooning for a DC if unsure
CPU	2 cores	`host` or `x86-64-v2-AES` on Proxmox

After install

Activate eval within 10 days (internet once)
Static IP: 192.168.50.115/24, GW 192.168.50.1
DNS → 127.0.0.1 after DC promotion (not before)
Snapshot immediately after Install-ADDSForest succeeds

.114 (Win11 client) sizing is unchanged — domain join does not require resizing the client VM.

0. Why AD on this lab?

Workgroup (today)	Domain (target)
NTLM-only local auth	Kerberos + domain logons
No 4768/4769 on DC	KDC events on DC01
LSASS packages idle	Full Kerberos/NTLM domain path
RSAT optional	RSAT required for ADUC

Already enabled on .114 (client prep):

Advanced audit policy (4688 w/ command line, logon categories)
Sysmon + script block logging
Hunt workbook baseline

1. Architecture

flowchart LR
  subgraph lan [192.168.50.0/24]
    MAC[MiniMac .127]
    DC[DC01 .115
Windows Server 2022]
    CLI[TESTER .114
Win11 Pro client]
  end
  MAC -->|SSH/RDP/VNC| CLI
  MAC -->|RDP/SSH| DC
  CLI -->|LDAP/Kerberos 88| DC

Host	Role	Resources
`192.168.50.115`	DC01 — AD DS + DNS	2 vCPU · 4 GB RAM · 60 GB disk (see sizing table above)
`192.168.50.114`	Member workstation	Existing VM — no resize needed

Isolated GOAD

GOAD-Light lives on drone bench 192.168.56.0/24 (MiniMac). Do not bridge it to .50.0/24 without a deliberate design.

2. Step 1 — Create Server VM (Proxmox)

Download eval ISO: Windows Server 2022 Evaluation → 64-bit ISO → Server with Desktop Experience.
Proxmox → Create VM (see VM sizing section above):
- Name: win-server-dc01
- OS: Win11/Win2022, UEFI, VirtIO SCSI + VirtIO NIC, 60 GB qcow2
- RAM: 4096 MB, CPUs: 2
- IP: static 192.168.50.115/24, GW 192.168.50.1, DNS 127.0.0.1 after promo
Install Server 2022 Desktop Experience.
Set admin password; enable OpenSSH optional.

3. Step 2 — Promote DC01 (on Server VM)

Script: ~/code/CodeCollector/win11_server_promote_dc.ps1

# Run on DC01 (192.168.50.115) as Administrator
powershell -NoProfile -ExecutionPolicy Bypass -File C:\Setup\win11_server_promote_dc.ps1 `
  -DomainName 'TESTER.LAB' -NetBiosName 'TESTERLAB' -SafeModePassword 'ChangeMeLab123!'

Manual alternative:

Install-WindowsFeature AD-Domain-Services, DNS -IncludeManagementTools
Import-Module ADDSDeployment
Install-ADDSForest `
  -DomainName 'TESTER.LAB' `
  -DomainNetbiosName 'TESTERLAB' `
  -InstallDns `
  -SafeModeAdministratorPassword (ConvertTo-SecureString 'ChangeMeLab123!' -AsPlainText -Force) `
  -Force

Reboot when prompted.

4. Step 3 — Join `.114` to domain

Script: ~/code/CodeCollector/win11_lab_join_domain.ps1

# On .114 — requires DC reachable + domain admin creds
powershell -NoProfile -ExecutionPolicy Bypass -File C:\Users\tester808\win11_lab_join_domain.ps1 `
  -DomainName 'TESTER.LAB' -DcIp '192.168.50.115' `
  -DomainAdmin 'TESTERLAB\Administrator' -DomainPassword 'YourDcAdminPassword'

Verify:

(Get-CimInstance Win32_ComputerSystem).PartOfDomain   # True
(Get-CimInstance Win32_ComputerSystem).Domain         # TESTER.LAB
nltest /dsgetdc:TESTER.LAB

5. Step 4 — RSAT on `.114` (AD management)

Install from elevated Proxmox console (DISM failed over SSH with access denied 2026-09-01):

Add-WindowsCapability -Online -Name Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0
# or
dism /online /add-capability /capabilityname:Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0

Launch: dsa.msc (Active Directory Users and Computers)

Create lab OU: OU=Lab,DC=TESTER,DC=LAB

6. Domain hunt telemetry (after join)

Event	Log	Where
4768	Security	DC01 — Kerberos TGT
4769	Security	DC01 — Kerberos service ticket
4776	Security	DC01 — NTLM auth
4624	Security	Client + DC — logon type matters
4648	Security	Explicit creds

Enable Advanced Audit Policy on DC01 (same categories as .114).

7. Lab accounts (suggested)

Account	Purpose
`TESTERLAB\Administrator`	DC break-glass
`TESTERLAB\labuser`	Standard domain user for hunts
`TESTERLAB\labadmin`	Domain Admins — sparingly

Do not reuse production passwords.

8. Current `.114` status (2026-09-01)

Item	Status
Domain joined	No — WORKGROUP
RSAT AD tools	Not installed — DISM access denied via SSH; use console
Advanced audit	Enabled
DNS points to DC	N/A until DC exists

9. Scripts inventory

Script	Host	Purpose
`win11_server_promote_dc.ps1`	DC01	Promote forest
`win11_lab_join_domain.ps1`	.114	Join domain
`win11_lab_enable_rdp_audit.ps1`	.114	RDP + audit (done)
`win11_lab_post_gui_ad.ps1`	.114	VNC firewall + RSAT attempt

All in ~/code/CodeCollector/.

← Hunt workbook · LSASS module · Baseline