Build an Active Directory Home Lab with Windows Server

Part of our free Build Your Own Cyber Lab series. Work through it in order, or jump to the part you need.

1. Plan your lab: hardware, hypervisors and safe networking
2. VirtualBox and VMware basics, then Kali, Parrot and Windows 11
3. Beyond VirtualBox: Hyper-V, VMware Workstation and Proxmox
4. Dual boot Kali Linux and Windows safely
5. Ubuntu in your lab: desktop, server, SSH and Docker
6. Active Directory lab with Windows Server (you are here)
7. Attack-and-defend network: firewall and vulnerable targets
8. Metasploitable 2 and 3: install and first exploits
9. Blue-team lab: Wazuh, Sysmon and Security Onion
10. Android app testing lab: emulator, MobSF, Frida and Burp
11. OT/ICS security lab: OpenPLC, Modbus and an HMI
12. Network lab: build it in Packet Tracer or GNS3, read it in Wireshark

Why Active Directory

Most enterprise breaches end in Active Directory: Kerberoasting, pass-the-hash, misconfigured delegation and certificate templates. You cannot learn to defend AD - or pass exams that test it - without running one. The good news is that a working domain needs only two VMs.

The lab layout

Put all three on one isolated network (a VirtualBox internal network, a Hyper-V private switch or a Proxmox bridge with no port). Give them internet only briefly through a NAT adapter or the firewall in part 7 when you need updates.

Step 1: Install Windows Server

1. Download the Windows Server evaluation ISO from the Microsoft Evaluation Center.
2. Create a VM (4 GB RAM, 2 CPUs, 60 GB disk) and install. Choose a Desktop Experience edition so you get the GUI while you learn.
3. Set a strong local Administrator password.

Step 2: Prepare the server

Do these before promoting - renaming a domain controller later is painful.

# Static IP. The DC points DNS at itself.
New-NetIPAddress -InterfaceAlias "Ethernet" -IPAddress 10.20.0.10 -PrefixLength 24 -DefaultGateway 10.20.0.1
Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses 127.0.0.1

# Meaningful name, then restart
Rename-Computer -NewName "DC01" -Restart

Check the interface name with Get-NetAdapter if "Ethernet" does not match.

Step 3: Promote the domain controller

Choose the domain name carefully. Microsoft recommends a subdomain of a domain you own (for example ad.yourname.com). For a throwaway lab, a name under the reserved .test top-level domain such as lab.test avoids clashing with anything real. Avoid .local, which conflicts with multicast DNS.

Install-WindowsFeature AD-Domain-Services -IncludeManagementTools
Install-ADDSForest -DomainName "lab.test" -DomainNetbiosName "LAB" -InstallDns

You will be asked for a Directory Services Restore Mode (DSRM) password - store it safely. The server restarts as a domain controller. Log in as LAB\Administrator.

Prefer the GUI? Server Manager > Add roles and features > Active Directory Domain Services, then the yellow flag > Promote this server to a domain controller > Add a new forest.

Step 4: Create users, groups and OUs

New-ADOrganizationalUnit -Name "LabUsers"
New-ADGroup -Name "Helpdesk" -GroupScope Global -Path "OU=LabUsers,DC=lab,DC=test"

$pw = Read-Host -AsSecureString "Password for new users"
New-ADUser -Name "Alice Analyst" -SamAccountName alice -AccountPassword $pw -Enabled $true -Path "OU=LabUsers,DC=lab,DC=test"
New-ADUser -Name "Bob Helpdesk" -SamAccountName bob -AccountPassword $pw -Enabled $true -Path "OU=LabUsers,DC=lab,DC=test"
Add-ADGroupMember -Identity "Helpdesk" -Members bob

Step 5: Join a Windows 11 client

1. Install Windows 11 on WS01 and connect it to the same network.
2. Point its DNS at the DC (10.20.0.10) - this is the step most people miss. Domain join fails if the client cannot resolve the domain.
3. Join the domain:

Add-Computer -DomainName "lab.test" -Credential LAB\Administrator -Restart

4. Log in as LAB\alice to confirm.

Step 6: Group Policy basics

Open Group Policy Management on DC01, create a GPO linked to an OU, and practise the controls exams ask about: password and account lockout policy (Default Domain Policy), audit policy, disabling LLMNR, and restricting local administrator rights. Run gpupdate /force on WS01 and verify with gpresult /r.

Step 7: Make it a practice range

Once the clean domain works, snapshot every VM. Then deliberately introduce the weaknesses real attacks use, one at a time, and practise both sides:

• A service account with a weak password and an SPN - practise Kerberoasting, then detect it (event 4769 with RC4 encryption).
• A user with "Do not require Kerberos preauthentication" - AS-REP roasting.
• A shared local administrator password across machines - pass-the-hash, then fix it with Windows LAPS.

Roll back to the clean snapshot after each exercise. Our free Haxplain lessons on Kerberoasting and pass-the-hash explain each attack and its detections.

Keep it legal and contained

Only attack machines you own or have written permission to test. Vulnerable VMs and malware samples belong on an isolated network with no route to your home LAN or the internet, and never expose a deliberately vulnerable machine with a bridged adapter or a port forward.

Next step

Part 7 adds a firewall and deliberately vulnerable targets so you can practise web and network attacks safely.